Deployment options

Before you subscribe users, decide which AWS account you'll work in. Your choice comes down to three decisions:

• Where to enable IAM Identity Center. For background, see What is IAM Identity Center? in the AWS IAM Identity Center User Guide.
• Where to create your Kiro profile. For background, see Kiro profile.
• Where to subscribe your users. For background, see Subscribe your team.

A deployment option is a combination of these three decisions. Choose an option below before you continue to Subscribe your team.

This page uses the following terms:

• Standalone account — an AWS account that isn't part of an organization managed by AWS Organizations.
• Management account — the AWS account that owns an organization managed by AWS Organizations. It's responsible for the charges of all accounts in the organization.
• Member account — any account in an organization other than the management account.

Use this option to quickly evaluate Kiro by subscribing yourself, and optionally a small team.

• What you do: In a standalone account, enable IAM Identity Center, create a Kiro profile, and subscribe yourself (and your team).
• Benefits: Good for demos and evaluation without an enterprise-wide rollout. Richer capabilities than a personal setup.
• Drawbacks: Fewer features. IAM Identity Center enabled in a standalone account is an account instance, which supports fewer features than an organization instance.

Use this option when you want distributed administration across accounts.

• What you do: In the management account, enable IAM Identity Center. In a member account, create a Kiro profile and subscribe users.
• Benefits: More features, because IAM Identity Center is an organization instance. Distributed administration: subscription-management tasks live in member accounts, which is the recommended best practice.
• Drawbacks: More complexity, since it requires coordination across accounts. Account limit: you can subscribe users in up to 20 accounts per AWS Region per organization. If a business need prevents you from choosing another option, you can request an increase by contacting AWS Support with your use case. Requests are reviewed by the Kiro service team and aren't guaranteed to be approved.

Use this option when a member-account administrator needs to deploy without an org-wide rollout.

• What you do: In a member account, enable IAM Identity Center, create a Kiro profile, and subscribe users.
• Benefits: Quick setup. A member-account administrator can deploy without waiting for an enterprise-wide implementation or approval. Flexible for complex organizations that don't have a single, unified identity provider covering everyone you want to subscribe.
• Drawbacks: Fewer features. IAM Identity Center enabled in a member account is an account instance, which supports fewer features than an organization instance.

Use this option when you manage everything centrally from the management account.

• What you do: In the management account, enable IAM Identity Center, create a Kiro profile, and subscribe users. Optionally, share the Kiro profile with member accounts.
• Benefits: More features, because IAM Identity Center is an organization instance.
• Drawbacks: Not aligned with best practice. Because delegated administrators aren't supported, subscription-management tasks must be handled by an administrator in the management account instead of being delegated to member accounts.

After you choose a deployment option, continue to Subscribe your team.