Enterprise Management API reference

The Enterprise Management APIs create, edit, publish, and assign Kiro policies. The console uses the same APIs. This page is for administrators and platform engineers who automate policy changes with the AWS CLI or an SDK. Kiro Enterprise Management is in preview for new Kiro profiles created in US East (N. Virginia) (us-east-1). It is on for all newly created profiles there; existing profiles are not affected by this change. To take a policy from nothing to live with the AWS CLI, start at Common tasks. To learn the policy format the files carry, see the KGL reference.

Protocol

Item	Value
Endpoint	`https://management.us-east-1.kiro.dev`
Protocol	`awsJson1_0`: `POST /` with the JSON body
Target header	`X-Amz-Target: KiroControlPlaneQDeveloperService.<Operation>`
Content type	`application/x-amz-json-1.0`
Signing	SigV4, service name `q`, region `us-east-1`
IAM action	`q:<Operation>`, for example `q:PublishEnterpriseManagementResource`
API version	`2025-01-12`
AWS CLI	`aws kiro-em <command>`

The kiro-em commands need the Enterprise Management service model for the AWS CLI. Every command on this page runs in us-east-1; the examples pass --region us-east-1 on the first command and omit it afterwards. The examples use the placeholders abc123 for a resource ID, <profile-id> for a Kiro profile ID, and d-1234567890 for an IAM Identity Center identity store ID.

Common tasks

These seven commands take a policy from nothing to live on a Kiro profile, then remove it. Each command links to its operation for the full list of fields and errors.

Step 1: Create the resource. The response holds the resourceId; use it in every later call. See CreateEnterpriseManagementResource.

bash

aws kiro-em create-enterprise-management-resource \
  --region us-east-1 \
  --name "Engineering policy"

Step 2: Write the policy into the draft. Describe the policy file in a JSON list such as files.json: path, type set to kgl, and content holding the KGL text with newlines escaped. The example below shows one rule to keep it short. It allows only model_use; API keys and Kiro Crew messaging and network access stay denied, and the built-in tools and Kiro Crew scheduled jobs keep Kiro's own default. Before Step 4, replace content with a complete policy: the defaults from Get started or a policy from KGL examples. The call opens a draft if none is open. See PutEnterpriseManagementResourceFiles.

json

[
  {
    "path": "policy.yaml",
    "type": "kgl",
    "content": "rules:\n  - id: model-use-allow\n    capability: model_use\n    effect: allow\n"
  }
]

bash

aws kiro-em put-enterprise-management-resource-files \
  --resource-id abc123 \
  --files file://files.json

Step 3: Check the draft. isValid is true when there is no error, and diagnostics lists errors first. Nothing is published. See ValidateEnterpriseManagementResource.

bash

aws kiro-em validate-enterprise-management-resource \
  --target byResource=abc123

Step 4: Publish. The draft becomes a numbered revision and goes live. Send --idc-config whenever any rule is conditioned on a group or user; omit it otherwise. See PublishEnterpriseManagementResource.

bash

aws kiro-em publish-enterprise-management-resource \
  --resource-id abc123 \
  --idc-config identityStoreId=d-1234567890,region=us-east-1,profileArn=arn:aws:codewhisperer:us-east-1:123456789012:profile/<profile-id>

Step 5: Assign the policy to the profile. The resource must have been published at least once. Rules and settings reach every user of the profile within about five minutes; files arrive when their next session starts. See AssociateEnterpriseManagementResource.

bash

aws kiro-em associate-enterprise-management-resource \
  --resource-id abc123 \
  --scope-type PROFILE \
  --scope-id <profile-id>

Step 6: Confirm. The list shows each resource, the scopes it governs, and its live revision. See ListEnterpriseManagementResources.

bash

aws kiro-em list-enterprise-management-resources

Step 7: Remove the assignment when you are done. The policy stays in the account. This command is the path for it. See DisassociateEnterpriseManagementResource.

bash

aws kiro-em disassociate-enterprise-management-resource \
  --resource-id abc123 \
  --scope-type PROFILE \
  --scope-id <profile-id>

To change a live policy, repeat steps 2 to 4. The assignment stays. Changed rules and settings reach developers within about five minutes; changed files arrive at their next session.

Operations

Operation	AWS CLI command	Purpose
AssociateEnterpriseManagementResource	`associate-enterprise-management-resource`	Associates a resource with a scope so it governs everyone under that scope.
CreateEnterpriseManagementResource	`create-enterprise-management-resource`	Creates a new Enterprise Management resource and opens an empty draft.
DeleteEnterpriseManagementResource	`delete-enterprise-management-resource`	Soft-deletes a resource by marking it deleted.
DeleteEnterpriseManagementResourceDraft	`delete-enterprise-management-resource-draft`	Discards the open draft without publishing it, leaving the enforcing revision unchanged.
DeleteEnterpriseManagementResourceFile	`delete-enterprise-management-resource-file`	Removes one file from a resource's working draft.
DisassociateEnterpriseManagementResource	`disassociate-enterprise-management-resource`	Removes an association so the resource no longer governs that scope.
GetEnterpriseManagementResource	`get-enterprise-management-resource`	Retrieves one revision of a resource for display or editing.
GetEnterpriseManagementResourceFile	`get-enterprise-management-resource-file`	Returns one file's bytes from one revision of a resource.
ListEnterpriseManagementResourceFiles	`list-enterprise-management-resource-files`	Lists the files one revision of a resource holds, without their content.
ListEnterpriseManagementResourceRevisions	`list-enterprise-management-resource-revisions`	Lists a resource's revision history for the audit and restore views.
ListEnterpriseManagementResources	`list-enterprise-management-resources`	Lists the caller tenant's resources and, for each, the scopes it governs and its live revision.
PublishEnterpriseManagementResource	`publish-enterprise-management-resource`	Publishes the open draft: validates it, compiles it, seals it into an immutable revision, and makes that revision enforcing (live), in one synchronous call.
PutEnterpriseManagementResourceFiles	`put-enterprise-management-resource-files`	Writes one or more files into a resource's working draft, opening a draft if none is open.
RestoreEnterpriseManagementResource	`restore-enterprise-management-resource`	Restores a resource to a previously published revision.
UpdateEnterpriseManagementResource	`update-enterprise-management-resource`	Updates a resource's metadata, such as its display name.
ValidateEnterpriseManagementResource	`validate-enterprise-management-resource`	Validates and compiles a document set as a dry run, returning diagnostics without publishing or changing any state.

Every operation can return AccessDeniedException (403), InternalServerException (500), ThrottlingException (429), and ValidationException (400). Operations on an existing resource also return ResourceNotFoundException (404). The service returns every client error as HTTP 400; see Errors.

AssociateEnterpriseManagementResource

Associates a resource with a scope so it governs everyone under that scope.

IAM action: q:AssociateEnterpriseManagementResource

Request3 fields

resourceIdstringRequired: The resource to associate. Must have an enforcing revision (published at least once). Length 1–64; pattern ^[a-z0-9]+$.
scopeTypeEnterpriseManagementScopeTypeRequired: The kind of scope to bind. PROFILE.
scopeIdstringRequired: The identifier of the scope to bind. For PROFILE, the Kiro profile ID. Length 1–128.

Response3 fields

resourceIdstringRequired: The associated resource.
scopeTypeEnterpriseManagementScopeTypeRequired: The scope kind.
scopeIdstringRequired: The scope identifier.

Errors6

AccessDeniedException403
ConflictException409
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

The service accepts a profile ID that does not exist without an error. Copy the profile ID from the Kiro console, then check that the Profile Controls page names the profile. If a profile is still bound to a deleted resource, associating another fails with ConflictException ("already associated with resource …"); disassociate the deleted resource by its ID first.

AWS CLI

bash

aws kiro-em associate-enterprise-management-resource \
  --region us-east-1 \
  --resource-id abc123 \
  --scope-type PROFILE \
  --scope-id <profile-id>

CreateEnterpriseManagementResource

Creates a new Enterprise Management resource and opens an empty draft.

IAM action: q:CreateEnterpriseManagementResource

Request2 fields

namestringRequired: Human-readable display name. A label, not an identifier; not unique. Length 1–256.
clientTokenstring: Unique caller token for idempotency; a retry with the same token returns the original result. The AWS CLI sets it if omitted. Length 1–128; pattern ^[!-~]+$.

Response4 fields

resourceIdstringRequired: Server-assigned; use it in all later calls. Length 1–64; pattern ^[a-z0-9]+$.
arnstringRequired: The resource ARN. Length 1–256; pattern ^arn:[a-z0-9-]+:.+$.
namestringRequired: The display name as created.
createdAttimestampRequired: When the resource was created.

Errors5

AccessDeniedException403
ConflictException409
InternalServerException500
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em create-enterprise-management-resource \
  --name "Engineering policy"

DeleteEnterpriseManagementResource

Soft-deletes a resource by marking it deleted.

IAM action: q:DeleteEnterpriseManagementResource

Request1 field

resourceIdstringRequired: The resource to delete.

Response

No fields.

Errors5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

Disassociate the resource from every scope before you delete it. If you delete a resource while it is associated, the profile stays bound to it and associating another resource fails.

AWS CLI

bash

aws kiro-em delete-enterprise-management-resource \
  --resource-id abc123

DeleteEnterpriseManagementResourceDraft

Discards the open draft without publishing it, leaving the enforcing revision unchanged.

IAM action: q:DeleteEnterpriseManagementResourceDraft

Request2 fields

resourceIdstringRequired: The resource whose draft to discard.
ifMatchstring: The draft's eTag from the last read or write. When supplied, the discard is rejected with ConflictException if the draft changed since, so one administrator cannot throw away another's work. Length 1–256.

Response

No fields.

Errors6

AccessDeniedException403
ConflictException409
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em delete-enterprise-management-resource-draft \
  --resource-id abc123

DeleteEnterpriseManagementResourceFile

Removes one file from a resource's working draft.

IAM action: q:DeleteEnterpriseManagementResourceFile

Request5 fields

resourceIdstringRequired: The resource whose draft holds the file.
typeEnterpriseManagementFileType: kgl, steering, skill, or power. A file is named by type and path together.
pathstringRequired: The file path, matched case-folded and Unicode normalized. Length 1–200.
ifMatchstring: The draft's eTag; the delete is rejected with ConflictException if the draft changed since.
clientTokenstring: Idempotency token. Length 1–128; pattern ^[!-~]+$.

Response1 field

eTagstringRequired: The draft's new eTag. Pass it as ifMatch on the next write.

Errors6

AccessDeniedException403
ConflictException409
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em delete-enterprise-management-resource-file \
  --resource-id abc123 \
  --type steering \
  --path coding-standard.md

DisassociateEnterpriseManagementResource

Removes an association so the resource no longer governs that scope.

IAM action: q:DisassociateEnterpriseManagementResource

Request3 fields

resourceIdstringRequired: The resource to disassociate.
scopeTypeEnterpriseManagementScopeTypeRequired: PROFILE.
scopeIdstringRequired: The scope identifier. For PROFILE, the Kiro profile ID. Length 1–128.

Response

No fields.

Errors5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

This operation removes an assignment. It also unbinds a profile from a resource that was deleted while associated.

AWS CLI

bash

aws kiro-em disassociate-enterprise-management-resource \
  --resource-id abc123 \
  --scope-type PROFILE \
  --scope-id <profile-id>

GetEnterpriseManagementResource

Retrieves one revision of a resource for display or editing.

IAM action: q:GetEnterpriseManagementResource

Request2 fields

resourceIdstringRequired: The resource to read.
revisionstring: A published revision number, or DRAFT or ENFORCING. Default enforcing. Length 1–16.

Response12 fields

resourceIdstringRequired: The resource ID.
arnstringRequired: The resource ARN.
namestringRequired: The display name; the same whichever revision you read.
revisioninteger: The revision number. Absent when DRAFT.
stateEnterpriseManagementRevisionStateRequired: DRAFT or PUBLISHED.
parentinteger: For a draft, the revision it was opened from, which must still be enforcing when the draft is published. For a published revision, the one it superseded.
fileCountintegerRequired: Files the revision holds.
createdAttimestampRequired: When the revision was created.
createdBystringRequired: Who created it. This shows a service role, not the caller.
updatedAttimestamp: Last write to the draft. Absent for a published or untouched draft.
updatedBystring: Who last wrote to the draft. This shows a service role, not the caller.
eTagstring: The draft's concurrency token. Send it as ifMatch on write, delete, and publish. Length 1–256.

Errors5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em get-enterprise-management-resource \
  --resource-id abc123 \
  --revision DRAFT

GetEnterpriseManagementResourceFile

Returns one file's bytes from one revision of a resource.

IAM action: q:GetEnterpriseManagementResourceFile

Request4 fields

resourceIdstringRequired: The resource to read.
typeEnterpriseManagementFileType: kgl, steering, skill, or power.
pathstringRequired: The file path. Length 1–200.
revisionstring: DRAFT, ENFORCING, or a revision number. Default enforcing.

Response1 field

contentstringRequired: The file's text exactly as written, UTF-8.

Errors5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em get-enterprise-management-resource-file \
  --resource-id abc123 \
  --type kgl \
  --path policy.yaml

ListEnterpriseManagementResourceFiles

Lists the files one revision of a resource holds, without their content.

IAM action: q:ListEnterpriseManagementResourceFiles

Request4 fields

resourceIdstringRequired: The resource to list.
revisionstring: DRAFT, ENFORCING, or a revision number.
maxResultsinteger: 1–100. Default 100.
nextTokenstring: The token from the previous page. Length 1–2048.

Response5 fields

resourceIdstringRequired: The resource ID.
revisioninteger: The revision number. Absent for DRAFT.
filesEnterpriseManagementResourceFile[]Required: In the order written. 0–500 entries.
nextTokenstring: Present when more pages follow.
compositionmap of EnterpriseManagementFileType to EnterpriseManagementFileComposeBehaviorRequired: How this revision's files compose with a developer's own, by type.

Errors5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em list-enterprise-management-resource-files \
  --resource-id abc123 \
  --revision ENFORCING

ListEnterpriseManagementResourceRevisions

Lists a resource's revision history for the audit and restore views.

IAM action: q:ListEnterpriseManagementResourceRevisions

Request3 fields

resourceIdstringRequired: The resource to list.
maxResultsinteger: 1–100. Default 20.
nextTokenstring: The token from the previous page.

Response2 fields

revisionsEnterpriseManagementRevisionSummary[]Required: Newest first. Empty when the resource was never published. 0–100 entries.
nextTokenstring: Present when more pages follow.

Errors5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em list-enterprise-management-resource-revisions \
  --resource-id abc123

ListEnterpriseManagementResources

Lists the caller tenant's resources and, for each, the scopes it governs and its live revision.

IAM action: q:ListEnterpriseManagementResources

Request2 fields

maxResultsinteger: 1–100. Default 20.
nextTokenstring: The token from the previous page.

Response2 fields

resourcesEnterpriseManagementResourceSummary[]Required: 0–100 entries.
nextTokenstring: Absent only when the listing has ended. Keep following it even after a short or empty page.

Errors4

AccessDeniedException403
InternalServerException500
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em list-enterprise-management-resources

PublishEnterpriseManagementResource

Publishes the open draft: validates it, compiles it, seals it into an immutable revision, and makes that revision enforcing (live), in one synchronous call.

IAM action: q:PublishEnterpriseManagementResource

Request4 fields

resourceIdstringRequired: The resource whose draft to publish.
ifMatchstring: The draft's eTag. The publish is rejected with ConflictException if the draft changed since, so a caller cannot publish a draft it has not seen.
idcConfigEnterpriseManagementIdcConfig: The IAM Identity Center instance to resolve the draft's group and user IDs against. Send it whenever any rule is conditioned on a group or user.
clientTokenstring: Idempotency token.

Response4 fields

revisionintegerRequired: The revision the draft was sealed into, now enforcing.
parentinteger: The revision that was enforcing before. Absent on the first publish.
publishedAttimestampRequired: When the revision became enforcing.
warningsEnterpriseManagementDiagnostic[]: WARNING-severity advisories. 0–100 entries.

Errors7

AccessDeniedException403
ConflictException409
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400
EnterpriseManagementResourceValidationException400

AWS CLI

bash

aws kiro-em publish-enterprise-management-resource \
  --resource-id abc123 \
  --idc-config identityStoreId=d-1234567890,region=us-east-1,profileArn=arn:aws:codewhisperer:us-east-1:123456789012:profile/<profile-id>

PutEnterpriseManagementResourceFiles

Writes one or more files into a resource's working draft, opening a draft if none is open.

IAM action: q:PutEnterpriseManagementResourceFiles

Request5 fields

resourceIdstringRequired: The resource whose draft to write.
filesEnterpriseManagementInlineFile[]: Each file is written, or replaced if one with the same type and path exists. At most 500 entries and at most 5 MiB of content in total.
compositionmap of EnterpriseManagementFileType to EnterpriseManagementFileComposeBehavior: Replaces the whole map when supplied. Omit it to leave the map as it was.
ifMatchstring: The draft's eTag; the write is rejected with ConflictException if the draft changed since.
clientTokenstring: Idempotency token.

Response5 fields

resourceIdstringRequired: The resource ID.
fileCountintegerRequired: Files the draft holds after this call.
filesEnterpriseManagementStoredFile[]Required: In the order sent.
eTagstringRequired: The draft's new eTag.
compositionmap of EnterpriseManagementFileType to EnterpriseManagementFileComposeBehaviorRequired: The compose behavior for every distributed type.

Errors7

AccessDeniedException403
ConflictException409
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400
EnterpriseManagementResourceValidationException400

AWS CLI

bash

aws kiro-em put-enterprise-management-resource-files \
  --resource-id abc123 \
  --files file://files.json

RestoreEnterpriseManagementResource

Restores a resource to a previously published revision.

IAM action: q:RestoreEnterpriseManagementResource

Request3 fields

resourceIdstringRequired: The resource to restore.
targetRevisionintegerRequired: The published revision to restore. Its content is copied into a new revision, which becomes enforcing; the target is left as it was. Minimum 1.
clientTokenstring: Idempotency token.

Response3 fields

revisionintegerRequired: The new revision: one above the highest revision number used, never the target's own.
restoredFromintegerRequired: Equals targetRevision.
publishedAttimestampRequired: When the new revision became enforcing.

Errors6

AccessDeniedException403
ConflictException409
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em restore-enterprise-management-resource \
  --resource-id abc123 \
  --target-revision 2

UpdateEnterpriseManagementResource

Updates a resource's metadata, such as its display name.

IAM action: q:UpdateEnterpriseManagementResource

Request2 fields

resourceIdstringRequired: The resource to update.
namestring: The new display name. Omitted leaves it unchanged. Length 1–256.

Response3 fields

resourceIdstringRequired: The resource ID.
namestringRequired: The display name after the update.
updatedAttimestampRequired: When the metadata changed.

Errors5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em update-enterprise-management-resource \
  --resource-id abc123 \
  --name "Engineering policy v2"

ValidateEnterpriseManagementResource

Validates and compiles a document set as a dry run, returning diagnostics without publishing or changing any state.

IAM action: q:ValidateEnterpriseManagementResource

Request2 fields

targetEnterpriseManagementValidateTargetRequired: byResource (an existing resource's open draft) or files (an inline set). Exactly one.
idcConfigEnterpriseManagementIdcConfig: Send it whenever the target conditions a rule on a group or user.

Response2 fields

isValidbooleanRequired: true when compilation produced no ERROR finding.
diagnosticsEnterpriseManagementDiagnostic[]: Errors first, up to 100. Empty when clean.

Errors5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

A request with an empty target returns HTTP 500. Send either byResource or files.

AWS CLI

bash

aws kiro-em validate-enterprise-management-resource \
  --target byResource=abc123

Types

EnterpriseManagementAssociatedScope

Fields2 fields

scopeTypeEnterpriseManagementScopeTypeRequired: PROFILE.
scopeIdstringRequired: The Kiro profile ID. Length 1–128.

EnterpriseManagementDiagnostic

Fields7 fields

severityEnterpriseManagementDiagnosticSeverityRequired: ERROR blocks publishing; WARNING is advisory.
codestringRequired: Stable, machine-readable code, for example YAML_PARSE_ERROR, UNKNOWN_SETTING, POLICY_BOUNDARY_VIOLATION. Treat the set as open. Length 1–128. See Common errors.
messagestringRequired: Human-readable explanation.
pathstring: The file the finding refers to. Length 1–200.
elementstring: The setting key or rule name.
lineinteger: 1-based line.
columninteger: 1-based column.

EnterpriseManagementDiagnosticSeverity

Enum: ERROR, WARNING.

EnterpriseManagementFileComposeBehavior

Enum: append, replace, locked.

EnterpriseManagementFileStorageOutcome

Enum: STORED, DEDUPLICATED.

EnterpriseManagementFileType

Enum: kgl, steering, skill, power.

EnterpriseManagementIdcConfig

Fields3 fields

identityStoreIdstringRequired: The IAM Identity Center identity store ID, for example d-1234567890. Not the instance ID (ssoins-…). Pattern ^d-[a-z0-9]{10}$.
regionstringRequired: The directory's home Region. Length 1–64.
profileArnstringRequired: The Kiro (Amazon Q Developer) profile ARN the directory read runs under. Pattern ^arn:(aws\|aws-cn\|aws-us-gov):codewhisperer:[a-z0-9\-]+:[0-9]{12}:profile/.+$.

EnterpriseManagementInlineFile

Fields3 fields

pathstringRequired: The file path. Length 1–200.
typeEnterpriseManagementFileTypeRequired: kgl, steering, skill, or power.
contentstringRequired: The file text. Never empty. Length 1–524288.

EnterpriseManagementResourceFile

Fields4 fields

pathstringRequired: The file path.
typeEnterpriseManagementFileTypeRequired: The file type.
sha256stringRequired: Lowercase hex, 64 characters.
sizeByteslongRequired: 1–524288.

EnterpriseManagementResourceSummary

Fields7 fields

resourceIdstringRequired: The resource ID.
arnstringRequired: The resource ARN.
namestringRequired: The display name.
latestRevisioninteger: The newest published revision. Absent when never published.
enforcingRevisioninteger: The oldest revision any scope in this Region is still serving. Absent when the resource is associated with no scope here.
associatedScopesEnterpriseManagementAssociatedScope[]: 0–100 entries.
updatedAttimestamp: The last rename or publish.

EnterpriseManagementResourceValidationException

Returned by PublishEnterpriseManagementResource and PutEnterpriseManagementResourceFiles when the documents fail validation or compilation. It carries every blocking finding as one list. ValidateEnterpriseManagementResource reports the same findings without failing. HTTP 400.

Fields2 fields

messagestringRequired: For example "3 errors prevented publishing".
diagnosticsEnterpriseManagementDiagnostic[]Required: At least one ERROR. 0–100 entries.

EnterpriseManagementRevisionSelector

Set exactly one of:

Fields3 fields

numberinteger: A published revision number. Minimum 1.
draftunit: The open draft.
enforcingunit: The enforcing revision.

EnterpriseManagementRevisionState

Enum: DRAFT, PUBLISHED.

EnterpriseManagementRevisionSummary

Fields9 fields

revisionintegerRequired: Revision numbers start at 1, count up, and are never reused.
stateEnterpriseManagementRevisionStateRequired: Always PUBLISHED in this listing.
parentinteger: The revision this one superseded.
createdBystringRequired: The identity that opened the draft. This shows a service role, not the caller.
createdAttimestampRequired: When the draft was opened.
publishedAttimestamp: When the revision was published.
publishedBystring: Who published it. This shows a service role, not the caller.
restoredFrominteger: Present only on a revision made by RestoreEnterpriseManagementResource.
isEnforcingbooleanRequired: Whether this revision is live.

EnterpriseManagementScopeType

Enum: PROFILE.

EnterpriseManagementStoredFile

Fields5 fields

pathstringRequired: The path as sent.
typeEnterpriseManagementFileTypeRequired: The file type.
sha256stringRequired: Lowercase hex, 64 characters.
sizeByteslongRequired: 1–524288.
storageEnterpriseManagementFileStorageOutcomeRequired: STORED or DEDUPLICATED.

EnterpriseManagementValidateTarget

Set exactly one of:

Fields2 fields

byResourcestring: Validate an existing resource's open draft, reading exactly the files a publish would. No open draft returns ResourceNotFoundException. Length 1–64.
filesEnterpriseManagementInlineFile[]: Validate the files as sent. Nothing is stored. 0–500 entries.

Errors

Exception	HTTP status	Fields
`AccessDeniedException`	403	`message`, `reason`
`ConflictException`	409	`message`, `reason`
`EnterpriseManagementResourceValidationException`	400	`message`, `diagnostics`
`InternalServerException`	500	`message`
`ResourceNotFoundException`	404	`message`
`ThrottlingException`	429	`message`
`ValidationException`	400	`message`, `reason`, `missingPermissions` (a list of `action` and `resource`)

The service returns every client error as HTTP 400, including not-found, access-denied, and conflict conditions, and the message holds internal text such as "(Service: KiroEnterpriseManagement, Status Code: 404, …)". Match on the exception name, such as ResourceNotFoundException, rather than the status code. The AWS CLI and the SDKs show the right exception.

Page updated: November 11, 2026

Enterprise Management enforcement and limits

Monitor and track