To create a Kiro profile and manage subscriptions, you need to ensure that the role managing it has the following IAM permissions in the AWS account.
These are IAM permissions required to manage Kiro profile and users subscriptions regardless of the identity store you use. Here are the supported identity stores.
- codewhisperer:ListProfiles - codewhisperer:CreateProfile - codewhisperer:DeleteProfile - codewhisperer:UpdateProfile - codewhisperer:TagResource - codewhisperer:UntagResource - codewhisperer:ListTagsForResource - codewhisperer:AllowVendedLogDeliveryForResource - q:ListDashboardMetrics
If you are connecting an external identity provider, you will also need the following permissions
- q:ListLoginDomains - q:AssociateLoginDomain - q:DisassociateLoginDomain - q:ListScimAccessTokens - q:CreateScimAccessToken - q:DeleteScimAccessToken - q:ListGroups - q:ListUsers - q:BatchDescribeUsers - q:BatchDescribeGroups
For more information about IAM and security best practices:
IAM permissions