AWS Identity Center

If your organization uses AWS Identity Center, an administrator must enable Cloud Sessions before users can start Kiro Web sessions. This page covers the administrator setup and what users need to get started.

Administrators must enable Cloud Sessions before users in the organization can start Kiro Web sessions:

1. Go to the AWS account that owns the Kiro profile
2. Navigate to Settings > Kiro Settings
3. Toggle on Cloud Sessions

• Kiro Web requires a Kiro Profile — it does not work with Q Developer Profiles
• Cloud Sessions must be enabled in the AWS account that owns each Kiro profile users may select (see Enabling Cloud Sessions)
• Available in US East (N. Virginia) us-east-1 only
• The Kiro Sign-In applications in your IAM Identity Center instance must stay enabled and must not require assignments (see Kiro Sign-In applications in IAM Identity Center)

When an administrator creates a Kiro profile that uses IAM Identity Center, Kiro automatically creates two AWS managed applications in that IAM Identity Center instance:

• The Kiro profile application, for example KiroProfile-us-east-1. Users are assigned to this application through their Kiro subscription.
• A Kiro Sign-In application, whose name starts with Kiro Sign-In -. Kiro Web uses this application to sign users in at app.kiro.dev. It is hidden from the AWS access portal, so users don't see a tile for it.

Each Kiro profile gets its own pair of applications. An organization with several Kiro profiles can have several Kiro Sign-In applications with the same name.

Setting Do not require assignments lets identities reach the sign-in application. It does not give anyone a Kiro subscription. Users still need an active Kiro subscription on a profile.

Keep every Kiro Sign-In application enabled and set to not require assignments. Cloud Sessions must also be enabled in the AWS account that owns each Kiro profile users may select.

The following shared settings configured by your administrator do not apply to the Kiro Web experience:

• Include suggestions with code references
• Model Context Protocol (MCP)
• Member account subscriptions
• MCP registry URL
• Encryption key — Customer Managed Keys (CMK) are not supported with Kiro Web

Model availability settings apply to Kiro Web sessions that use your organization's Kiro profile. Other enterprise governance policies (such as web tool controls) are not currently available for Kiro Web.

Agent settings, including GitHub and GitLab connections, sandbox configuration, and data collection preferences, are managed separately by each user in Kiro Web Settings.

1. Sign in at app.kiro.dev using your Identity Center credentials
2. Connect GitHub or GitLab to give the agent access to your repositories
3. Start working with the agent

If Kiro IDE or Kiro CLI sign-in works for the same user and start URL but Kiro Web shows access_denied, a Kiro Sign-In application is the likely cause. Kiro IDE and Kiro CLI don't use this application, so users can keep working there while an administrator follows the steps below.

A disabled Kiro Sign-In application, or one set to require assignments, can cause Kiro Web to show access_denied after users enter their password and MFA.

An administrator can check and fix the Kiro Sign-In applications:

1. Sign in to the AWS account that manages your IAM Identity Center instance. Open the IAM Identity Center console in the instance's AWS Region.
2. Choose Applications, then choose the AWS managed tab.
3. Find applications whose name starts with Kiro Sign-In -. If several applications have the same name, check each one.
4. If an application's Status is Inactive, select it, then choose Actions > Enable.
5. Open each Kiro Sign-In application and check its user and group assignment method. If it's Require assignments, choose Action > Edit Details, select Do not require assignments, and choose Save changes.
6. If a Kiro Sign-In application has been deleted, contact AWS Support.
7. Ask the user to sign in to app.kiro.dev again in a private browser window.