Configuring a firewall, proxy server, or data perimeter for Kiro

If your network uses a firewall, proxy server, or data perimeter, you need to allowlist specific URLs so Kiro can reach its backend services. This page lists every domain Kiro contacts, grouped by function.

Kiro makes two types of outbound connections:

• Application traffic — Requests from the Kiro process (chat, completions, telemetry, and updates in IDE/CLI). In the IDE and CLI, this traffic respects your proxy settings. In Kiro Web, it flows through backend services.
• Browser traffic — Sign-in opens your default browser. This traffic uses your OS network stack and bypasses any proxy settings configured in the IDE or CLI.

Your firewall must allow both at the network level.

The following URLs are required by all Kiro products (IDE, CLI, and Web):

If your network policy allows wildcard rules, you can allowlist *.kiro.dev and *.app.kiro.dev instead of the individual kiro.dev domains above. Note that some firewalls only match a single subdomain level, so *.kiro.dev would cover app.kiro.dev but not assets.app.kiro.dev. If your firewall behaves this way, also add *.app.kiro.dev or list multi-level subdomains explicitly. See Wildcard rules for a complete summary.

If you sign in with Google or GitHub, allowlist this additional endpoint for the Cognito identity federation flow.

If your organization uses AWS IAM Identity Center for authentication, allowlist these additional endpoints.

Replace idc-directory-id-or-alias with your IAM Identity Center instance's directory ID or alias, and sso-region with the AWS Region where your instance is enabled. For more information, see What is IAM Identity Center? in the IAM Identity Center User Guide.

If your organization uses an external identity provider (IdP) with IAM Identity Center, the sign-in flow redirects through your IdP's domain. You need to allowlist that domain too.

Check with your identity team for the exact domain if you are unsure which IdP is configured.

If you use AWS GovCloud (US), allowlist these FIPS-compliant endpoints instead of the commercial Kiro service endpoints in the Core URLs table:

• q-fips.us-gov-east-1.amazonaws.com
• q-fips.us-gov-west-1.amazonaws.com

If you sign in with Google, GitHub, or AWS Builder ID, Kiro uses Stripe for subscription billing. Allowlist these domains to access the billing portal and upgrade plans.

Enterprise customers using IAM Identity Center don't need these domains.

You only need these if you use the corresponding Kiro feature. Skip any that don't apply to your environment.

If some users can connect to Kiro but others cannot, see Network connectivity issues in the troubleshooting guide.

If you use data perimeters on AWS to restrict access to trusted identities and resources, make sure your policies allow Kiro's service principals to reach the endpoints listed on this page. For VPC-level controls, see VPC endpoints (AWS PrivateLink).

If your network policy allows wildcard rules, you can simplify the allowlist: