Connect your IAM Identity Center

Prerequisites

You must have an instance of IAM Identity Center (IdC) set up in your AWS account, with the identities of the users you want to subscribe to Kiro.
Your IAM Identity Center instance must be in a supported AWS Region.
Administrator permission in both AWS and the IdP (if you have connected IdC to an external provider).

How to connect IAM Identity Center

Enable AWS IAM Identity Center in your AWS account. Add users to its directory, or connect it to an external identity provider (IdP). If this is your first time setting up an IAM Identity Center instance, see Getting started with IAM Identity Center.

KMS encryption

If your IAM Identity Center instance uses a customer managed KMS key for encryption, you must add the following statements to your key policy to allow Kiro to access Identity Center data.

Allow Kiro to decrypt data via IAM Identity Center:

json

{
    "Sid": "Allow Kiro to use key via IDC",
    "Effect": "Allow",
    "Principal": { "Service": "q.amazonaws.com" },
    "Action": "kms:Decrypt",
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "kms:EncryptionContext:aws:sso:instance-arn": "arn:aws:sso:::instance/<your-idc-instance-id>",
            "kms:ViaService": "sso.<identity-center-region>.amazonaws.com"
        }
    }
}

Allow Kiro to decrypt data via Identity Store:

json

{
    "Sid": "Allow Kiro to use key via IdentityStore",
    "Effect": "Allow",
    "Principal": { "Service": "q.amazonaws.com" },
    "Action": "kms:Decrypt",
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "kms:EncryptionContext:aws:identitystore:identitystore-arn": "arn:aws:identitystore::<identity-center-account-id>:identitystore/<your-identity-store-id>",
            "kms:ViaService": "identitystore.<identity-center-region>.amazonaws.com"
        }
    }
}

Replace the placeholders as follows:

<identity-center-account-id> — the ID of the AWS account that owns your IAM Identity Center instance. To retrieve it, see Find your AWS account ID.
<your-idc-instance-id> — your IAM Identity Center instance ID.
<your-identity-store-id> — your Identity Store ID.
<identity-center-region> — the AWS Region of your IAM Identity Center instance.

These policies can be relaxed by using StringLike with wildcards (*) instead of StringEquals. For more details, see Advanced KMS key policy statements in the IAM Identity Center User Guide.

KMS access for group subscriptions

If you use group-based subscriptions, you must also grant the AWSServiceRoleForUserSubscriptions service-linked role permission to use your key. Kiro uses this role to resolve IAM Identity Center group memberships and keep group subscriptions active. If the role cannot decrypt the key, group memberships cannot be resolved and group subscriptions will not remain active.

Add the following statement to your key policy:

json

{
    "Sid": "Allow User Subscriptions SLR to use key",
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::<kiro-profile-account-id>:role/aws-service-role/user-subscriptions.amazonaws.com/AWSServiceRoleForUserSubscriptions"
    },
    "Action": [
        "kms:Decrypt",
        "kms:DescribeKey"
    ],
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "kms:ViaService": [
                "sso.<identity-center-region>.amazonaws.com",
                "identitystore.<identity-center-region>.amazonaws.com"
            ]
        }
    }
}

The kms:ViaService condition must include both sso.<identity-center-region>.amazonaws.com and identitystore.<identity-center-region>.amazonaws.com.

Replace the placeholders as follows:

<kiro-profile-account-id> — the ID of the AWS account that owns the Kiro profile (the account where the profile was created). This is not necessarily the account that owns the KMS key or the IAM Identity Center instance. To retrieve it, see Find your AWS account ID.
<identity-center-region> — the AWS Region of your IAM Identity Center instance.

Applications that Kiro creates in IAM Identity Center

Kiro creates a Kiro profile application and a separate Kiro Sign-In application for each Kiro profile that uses IAM Identity Center. Keep every Kiro Sign-In application enabled and set to not require assignments. Otherwise, Kiro Web sign-in can fail with access_denied.

See Kiro Sign-In applications in IAM Identity Center for the safety rules and recovery steps.

Page updated: October 14, 2026

Connecting your identity provider

Okta