Enterprise Management API reference

The Enterprise Management APIs create, edit, publish, and assign Kiro policies. The console uses the same APIs. This page is for administrators and platform engineers who automate policy changes with the AWS CLI or an SDK. Kiro Enterprise Management is in preview for new Kiro profiles created in US East (N. Virginia) (us-east-1). It is on for all newly created profiles there; existing profiles are not affected by this change. To take a policy from nothing to live with the AWS CLI, start at Common tasks. To learn the policy format the files carry, see the KGL reference.

Protocol

Item	Value
Endpoint	`https://management.us-east-1.kiro.dev`
Protocol	`awsJson1_0`: `POST /` with the JSON body
Target header	`X-Amz-Target: KiroControlPlaneQDeveloperService.<Operation>`
Content type	`application/x-amz-json-1.0`
Signing	SigV4, service name `q`, region `us-east-1`
IAM action	`q:<Operation>`, for example `q:PublishEnterpriseManagementResource`
API version	`2025-01-12`
AWS CLI	`aws kiro-em <command>`

The kiro-em commands need the Enterprise Management service model for the AWS CLI. Every command on this page runs in us-east-1; the examples pass --region us-east-1 on the first command and omit it afterwards. The examples use the placeholders abc123 for a resource ID, <profile-id> for a Kiro profile ID, and d-1234567890 for an IAM Identity Center identity store ID.

Common tasks

These seven commands take a policy from nothing to live on a Kiro profile, then remove it. Each command links to its operation for the full list of fields and errors.

Step 1: Create the resource. The response holds the resourceId; use it in every later call. See CreateEnterpriseManagementResource.

bash

aws kiro-em create-enterprise-management-resource \
  --region us-east-1 \
  --name "Engineering policy"

Step 2: Write the policy into the draft. Describe the policy file in a JSON list such as files.json: path, type set to kgl, and content holding the KGL text with newlines escaped. The example below shows one rule to keep it short. It allows only model_use; API keys and Kiro Crew messaging and network access stay denied, and the built-in tools and Kiro Crew scheduled jobs keep Kiro's own default. Before Step 4, replace content with a complete policy: the defaults from Get started or a policy from KGL examples. The call opens a draft if none is open. See PutEnterpriseManagementResourceFiles.

json

[
  {
    "path": "policy.yaml",
    "type": "kgl",
    "content": "rules:\n  - id: model-use-allow\n    capability: model_use\n    effect: allow\n"
  }
]

bash

aws kiro-em put-enterprise-management-resource-files \
  --resource-id abc123 \
  --files file://files.json

Step 3: Check the draft. isValid is true when there is no error, and diagnostics lists errors first. Nothing is published. See ValidateEnterpriseManagementResource.

bash

aws kiro-em validate-enterprise-management-resource \
  --target byResource=abc123

Step 4: Publish. The draft becomes a numbered revision and goes live. Send --idc-config whenever any rule is conditioned on a group or user; omit it otherwise. See PublishEnterpriseManagementResource.

bash

aws kiro-em publish-enterprise-management-resource \
  --resource-id abc123 \
  --idc-config identityStoreId=d-1234567890,region=us-east-1,profileArn=arn:aws:codewhisperer:us-east-1:123456789012:profile/<profile-id>

Step 5: Assign the policy to the profile. The resource must have been published at least once. Rules and settings reach every user of the profile within about five minutes; files arrive when their next session starts. See AssociateEnterpriseManagementResource.

bash

aws kiro-em associate-enterprise-management-resource \
  --resource-id abc123 \
  --scope-type PROFILE \
  --scope-id <profile-id>

Step 6: Confirm. The list shows each resource, the scopes it governs, and its live revision. See ListEnterpriseManagementResources.

bash

aws kiro-em list-enterprise-management-resources

Step 7: Remove the assignment when you are done. The policy stays in the account. This command is the path for it. See DisassociateEnterpriseManagementResource.

bash

aws kiro-em disassociate-enterprise-management-resource \
  --resource-id abc123 \
  --scope-type PROFILE \
  --scope-id <profile-id>

To change a live policy, repeat steps 2 to 4. The assignment stays. Changed rules and settings reach developers within about five minutes; changed files arrive at their next session.

Operations

Operation	AWS CLI command	Purpose
AssociateEnterpriseManagementResource	`associate-enterprise-management-resource`	Associates a resource with a scope so it governs everyone under that scope.
CreateEnterpriseManagementResource	`create-enterprise-management-resource`	Creates a new Enterprise Management resource and opens an empty draft.
DeleteEnterpriseManagementResource	`delete-enterprise-management-resource`	Soft-deletes a resource by marking it deleted.
DeleteEnterpriseManagementResourceDraft	`delete-enterprise-management-resource-draft`	Discards the open draft without publishing it, leaving the enforcing revision unchanged.
DeleteEnterpriseManagementResourceFile	`delete-enterprise-management-resource-file`	Removes one file from a resource's working draft.
DisassociateEnterpriseManagementResource	`disassociate-enterprise-management-resource`	Removes an association so the resource no longer governs that scope.
GetEnterpriseManagementResource	`get-enterprise-management-resource`	Retrieves one revision of a resource for display or editing.
GetEnterpriseManagementResourceFile	`get-enterprise-management-resource-file`	Returns one file's bytes from one revision of a resource.
ListEnterpriseManagementResourceFiles	`list-enterprise-management-resource-files`	Lists the files one revision of a resource holds, without their content.
ListEnterpriseManagementResourceRevisions	`list-enterprise-management-resource-revisions`	Lists a resource's revision history for the audit and restore views.
ListEnterpriseManagementResources	`list-enterprise-management-resources`	Lists the caller tenant's resources and, for each, the scopes it governs and its live revision.
PublishEnterpriseManagementResource	`publish-enterprise-management-resource`	Publishes the open draft: validates it, compiles it, seals it into an immutable revision, and makes that revision enforcing (live), in one synchronous call.
PutEnterpriseManagementResourceFiles	`put-enterprise-management-resource-files`	Writes one or more files into a resource's working draft, opening a draft if none is open.
RestoreEnterpriseManagementResource	`restore-enterprise-management-resource`	Restores a resource to a previously published revision.
UpdateEnterpriseManagementResource	`update-enterprise-management-resource`	Updates a resource's metadata, such as its display name.
ValidateEnterpriseManagementResource	`validate-enterprise-management-resource`	Validates and compiles a document set as a dry run, returning diagnostics without publishing or changing any state.

Every operation can return AccessDeniedException (403), InternalServerException (500), ThrottlingException (429), and ValidationException (400). Operations on an existing resource also return ResourceNotFoundException (404). The service returns every client error as HTTP 400; see Errors.

AssociateEnterpriseManagementResource

Associates a resource with a scope so it governs everyone under that scope.

Action IAM: q:AssociateEnterpriseManagementResource

Requête3 champs

resourceIdstringObligatoire: The resource to associate. Must have an enforcing revision (published at least once). Length 1–64; pattern ^[a-z0-9]+$.
scopeTypeEnterpriseManagementScopeTypeObligatoire: The kind of scope to bind. PROFILE.
scopeIdstringObligatoire: The identifier of the scope to bind. For PROFILE, the Kiro profile ID. Length 1–128.

Réponse3 champs

resourceIdstringObligatoire: The associated resource.
scopeTypeEnterpriseManagementScopeTypeObligatoire: The scope kind.
scopeIdstringObligatoire: The scope identifier.

Erreurs6

AccessDeniedException403
ConflictException409
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

The service accepts a profile ID that does not exist without an error. Copy the profile ID from the Kiro console, then check that the Profile Controls page names the profile. If a profile is still bound to a deleted resource, associating another fails with ConflictException ("already associated with resource …"); disassociate the deleted resource by its ID first.

AWS CLI

bash

aws kiro-em associate-enterprise-management-resource \
  --region us-east-1 \
  --resource-id abc123 \
  --scope-type PROFILE \
  --scope-id <profile-id>

CreateEnterpriseManagementResource

Creates a new Enterprise Management resource and opens an empty draft.

Action IAM: q:CreateEnterpriseManagementResource

Requête2 champs

namestringObligatoire: Human-readable display name. A label, not an identifier; not unique. Length 1–256.
clientTokenstring: Unique caller token for idempotency; a retry with the same token returns the original result. The AWS CLI sets it if omitted. Length 1–128; pattern ^[!-~]+$.

Réponse4 champs

resourceIdstringObligatoire: Server-assigned; use it in all later calls. Length 1–64; pattern ^[a-z0-9]+$.
arnstringObligatoire: The resource ARN. Length 1–256; pattern ^arn:[a-z0-9-]+:.+$.
namestringObligatoire: The display name as created.
createdAttimestampObligatoire: When the resource was created.

Erreurs5

AccessDeniedException403
ConflictException409
InternalServerException500
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em create-enterprise-management-resource \
  --name "Engineering policy"

DeleteEnterpriseManagementResource

Soft-deletes a resource by marking it deleted.

Action IAM: q:DeleteEnterpriseManagementResource

Requête1 champ

resourceIdstringObligatoire: The resource to delete.

Réponse

Aucun champ.

Erreurs5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

Disassociate the resource from every scope before you delete it. If you delete a resource while it is associated, the profile stays bound to it and associating another resource fails.

AWS CLI

bash

aws kiro-em delete-enterprise-management-resource \
  --resource-id abc123

DeleteEnterpriseManagementResourceDraft

Discards the open draft without publishing it, leaving the enforcing revision unchanged.

Action IAM: q:DeleteEnterpriseManagementResourceDraft

Requête2 champs

resourceIdstringObligatoire: The resource whose draft to discard.
ifMatchstring: The draft's eTag from the last read or write. When supplied, the discard is rejected with ConflictException if the draft changed since, so one administrator cannot throw away another's work. Length 1–256.

Réponse

Aucun champ.

Erreurs6

AccessDeniedException403
ConflictException409
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em delete-enterprise-management-resource-draft \
  --resource-id abc123

DeleteEnterpriseManagementResourceFile

Removes one file from a resource's working draft.

Action IAM: q:DeleteEnterpriseManagementResourceFile

Requête5 champs

resourceIdstringObligatoire: The resource whose draft holds the file.
typeEnterpriseManagementFileType: kgl, steering, skill, or power. A file is named by type and path together.
pathstringObligatoire: The file path, matched case-folded and Unicode normalized. Length 1–200.
ifMatchstring: The draft's eTag; the delete is rejected with ConflictException if the draft changed since.
clientTokenstring: Idempotency token. Length 1–128; pattern ^[!-~]+$.

Réponse1 champ

eTagstringObligatoire: The draft's new eTag. Pass it as ifMatch on the next write.

Erreurs6

AccessDeniedException403
ConflictException409
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em delete-enterprise-management-resource-file \
  --resource-id abc123 \
  --type steering \
  --path coding-standard.md

DisassociateEnterpriseManagementResource

Removes an association so the resource no longer governs that scope.

Action IAM: q:DisassociateEnterpriseManagementResource

Requête3 champs

resourceIdstringObligatoire: The resource to disassociate.
scopeTypeEnterpriseManagementScopeTypeObligatoire: PROFILE.
scopeIdstringObligatoire: The scope identifier. For PROFILE, the Kiro profile ID. Length 1–128.

Réponse

Aucun champ.

Erreurs5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

This operation removes an assignment. It also unbinds a profile from a resource that was deleted while associated.

AWS CLI

bash

aws kiro-em disassociate-enterprise-management-resource \
  --resource-id abc123 \
  --scope-type PROFILE \
  --scope-id <profile-id>

GetEnterpriseManagementResource

Retrieves one revision of a resource for display or editing.

Action IAM: q:GetEnterpriseManagementResource

Requête2 champs

resourceIdstringObligatoire: The resource to read.
revisionstring: A published revision number, or DRAFT or ENFORCING. Default enforcing. Length 1–16.

Réponse12 champs

resourceIdstringObligatoire: The resource ID.
arnstringObligatoire: The resource ARN.
namestringObligatoire: The display name; the same whichever revision you read.
revisioninteger: The revision number. Absent when DRAFT.
stateEnterpriseManagementRevisionStateObligatoire: DRAFT or PUBLISHED.
parentinteger: For a draft, the revision it was opened from, which must still be enforcing when the draft is published. For a published revision, the one it superseded.
fileCountintegerObligatoire: Files the revision holds.
createdAttimestampObligatoire: When the revision was created.
createdBystringObligatoire: Who created it. This shows a service role, not the caller.
updatedAttimestamp: Last write to the draft. Absent for a published or untouched draft.
updatedBystring: Who last wrote to the draft. This shows a service role, not the caller.
eTagstring: The draft's concurrency token. Send it as ifMatch on write, delete, and publish. Length 1–256.

Erreurs5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em get-enterprise-management-resource \
  --resource-id abc123 \
  --revision DRAFT

GetEnterpriseManagementResourceFile

Returns one file's bytes from one revision of a resource.

Action IAM: q:GetEnterpriseManagementResourceFile

Requête4 champs

resourceIdstringObligatoire: The resource to read.
typeEnterpriseManagementFileType: kgl, steering, skill, or power.
pathstringObligatoire: The file path. Length 1–200.
revisionstring: DRAFT, ENFORCING, or a revision number. Default enforcing.

Réponse1 champ

contentstringObligatoire: The file's text exactly as written, UTF-8.

Erreurs5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em get-enterprise-management-resource-file \
  --resource-id abc123 \
  --type kgl \
  --path policy.yaml

ListEnterpriseManagementResourceFiles

Lists the files one revision of a resource holds, without their content.

Action IAM: q:ListEnterpriseManagementResourceFiles

Requête4 champs

resourceIdstringObligatoire: The resource to list.
revisionstring: DRAFT, ENFORCING, or a revision number.
maxResultsinteger: 1–100. Default 100.
nextTokenstring: The token from the previous page. Length 1–2048.

Réponse5 champs

resourceIdstringObligatoire: The resource ID.
revisioninteger: The revision number. Absent for DRAFT.
filesEnterpriseManagementResourceFile[]Obligatoire: In the order written. 0–500 entries.
nextTokenstring: Present when more pages follow.
compositionmap of EnterpriseManagementFileType to EnterpriseManagementFileComposeBehaviorObligatoire: How this revision's files compose with a developer's own, by type.

Erreurs5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em list-enterprise-management-resource-files \
  --resource-id abc123 \
  --revision ENFORCING

ListEnterpriseManagementResourceRevisions

Lists a resource's revision history for the audit and restore views.

Action IAM: q:ListEnterpriseManagementResourceRevisions

Requête3 champs

resourceIdstringObligatoire: The resource to list.
maxResultsinteger: 1–100. Default 20.
nextTokenstring: The token from the previous page.

Réponse2 champs

revisionsEnterpriseManagementRevisionSummary[]Obligatoire: Newest first. Empty when the resource was never published. 0–100 entries.
nextTokenstring: Present when more pages follow.

Erreurs5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em list-enterprise-management-resource-revisions \
  --resource-id abc123

ListEnterpriseManagementResources

Lists the caller tenant's resources and, for each, the scopes it governs and its live revision.

Action IAM: q:ListEnterpriseManagementResources

Requête2 champs

maxResultsinteger: 1–100. Default 20.
nextTokenstring: The token from the previous page.

Réponse2 champs

resourcesEnterpriseManagementResourceSummary[]Obligatoire: 0–100 entries.
nextTokenstring: Absent only when the listing has ended. Keep following it even after a short or empty page.

Erreurs4

AccessDeniedException403
InternalServerException500
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em list-enterprise-management-resources

PublishEnterpriseManagementResource

Publishes the open draft: validates it, compiles it, seals it into an immutable revision, and makes that revision enforcing (live), in one synchronous call.

Action IAM: q:PublishEnterpriseManagementResource

Requête4 champs

resourceIdstringObligatoire: The resource whose draft to publish.
ifMatchstring: The draft's eTag. The publish is rejected with ConflictException if the draft changed since, so a caller cannot publish a draft it has not seen.
idcConfigEnterpriseManagementIdcConfig: The IAM Identity Center instance to resolve the draft's group and user IDs against. Send it whenever any rule is conditioned on a group or user.
clientTokenstring: Idempotency token.

Réponse4 champs

revisionintegerObligatoire: The revision the draft was sealed into, now enforcing.
parentinteger: The revision that was enforcing before. Absent on the first publish.
publishedAttimestampObligatoire: When the revision became enforcing.
warningsEnterpriseManagementDiagnostic[]: WARNING-severity advisories. 0–100 entries.

Erreurs7

AccessDeniedException403
ConflictException409
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400
EnterpriseManagementResourceValidationException400

AWS CLI

bash

aws kiro-em publish-enterprise-management-resource \
  --resource-id abc123 \
  --idc-config identityStoreId=d-1234567890,region=us-east-1,profileArn=arn:aws:codewhisperer:us-east-1:123456789012:profile/<profile-id>

PutEnterpriseManagementResourceFiles

Writes one or more files into a resource's working draft, opening a draft if none is open.

Action IAM: q:PutEnterpriseManagementResourceFiles

Requête5 champs

resourceIdstringObligatoire: The resource whose draft to write.
filesEnterpriseManagementInlineFile[]: Each file is written, or replaced if one with the same type and path exists. At most 500 entries and at most 5 MiB of content in total.
compositionmap of EnterpriseManagementFileType to EnterpriseManagementFileComposeBehavior: Replaces the whole map when supplied. Omit it to leave the map as it was.
ifMatchstring: The draft's eTag; the write is rejected with ConflictException if the draft changed since.
clientTokenstring: Idempotency token.

Réponse5 champs

resourceIdstringObligatoire: The resource ID.
fileCountintegerObligatoire: Files the draft holds after this call.
filesEnterpriseManagementStoredFile[]Obligatoire: In the order sent.
eTagstringObligatoire: The draft's new eTag.
compositionmap of EnterpriseManagementFileType to EnterpriseManagementFileComposeBehaviorObligatoire: The compose behavior for every distributed type.

Erreurs7

AccessDeniedException403
ConflictException409
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400
EnterpriseManagementResourceValidationException400

AWS CLI

bash

aws kiro-em put-enterprise-management-resource-files \
  --resource-id abc123 \
  --files file://files.json

RestoreEnterpriseManagementResource

Restores a resource to a previously published revision.

Action IAM: q:RestoreEnterpriseManagementResource

Requête3 champs

resourceIdstringObligatoire: The resource to restore.
targetRevisionintegerObligatoire: The published revision to restore. Its content is copied into a new revision, which becomes enforcing; the target is left as it was. Minimum 1.
clientTokenstring: Idempotency token.

Réponse3 champs

revisionintegerObligatoire: The new revision: one above the highest revision number used, never the target's own.
restoredFromintegerObligatoire: Equals targetRevision.
publishedAttimestampObligatoire: When the new revision became enforcing.

Erreurs6

AccessDeniedException403
ConflictException409
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em restore-enterprise-management-resource \
  --resource-id abc123 \
  --target-revision 2

UpdateEnterpriseManagementResource

Updates a resource's metadata, such as its display name.

Action IAM: q:UpdateEnterpriseManagementResource

Requête2 champs

resourceIdstringObligatoire: The resource to update.
namestring: The new display name. Omitted leaves it unchanged. Length 1–256.

Réponse3 champs

resourceIdstringObligatoire: The resource ID.
namestringObligatoire: The display name after the update.
updatedAttimestampObligatoire: When the metadata changed.

Erreurs5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

AWS CLI

bash

aws kiro-em update-enterprise-management-resource \
  --resource-id abc123 \
  --name "Engineering policy v2"

ValidateEnterpriseManagementResource

Validates and compiles a document set as a dry run, returning diagnostics without publishing or changing any state.

Action IAM: q:ValidateEnterpriseManagementResource

Requête2 champs

targetEnterpriseManagementValidateTargetObligatoire: byResource (an existing resource's open draft) or files (an inline set). Exactly one.
idcConfigEnterpriseManagementIdcConfig: Send it whenever the target conditions a rule on a group or user.

Réponse2 champs

isValidbooleanObligatoire: true when compilation produced no ERROR finding.
diagnosticsEnterpriseManagementDiagnostic[]: Errors first, up to 100. Empty when clean.

Erreurs5

AccessDeniedException403
InternalServerException500
ResourceNotFoundException404
ThrottlingException429
ValidationException400

A request with an empty target returns HTTP 500. Send either byResource or files.

AWS CLI

bash

aws kiro-em validate-enterprise-management-resource \
  --target byResource=abc123

Types

EnterpriseManagementAssociatedScope

Champs2 champs

scopeTypeEnterpriseManagementScopeTypeObligatoire: PROFILE.
scopeIdstringObligatoire: The Kiro profile ID. Length 1–128.

EnterpriseManagementDiagnostic

Champs7 champs

severityEnterpriseManagementDiagnosticSeverityObligatoire: ERROR blocks publishing; WARNING is advisory.
codestringObligatoire: Stable, machine-readable code, for example YAML_PARSE_ERROR, UNKNOWN_SETTING, POLICY_BOUNDARY_VIOLATION. Treat the set as open. Length 1–128. See Common errors.
messagestringObligatoire: Human-readable explanation.
pathstring: The file the finding refers to. Length 1–200.
elementstring: The setting key or rule name.
lineinteger: 1-based line.
columninteger: 1-based column.

EnterpriseManagementDiagnosticSeverity

Enum: ERROR, WARNING.

EnterpriseManagementFileComposeBehavior

Enum: append, replace, locked.

EnterpriseManagementFileStorageOutcome

Enum: STORED, DEDUPLICATED.

EnterpriseManagementFileType

Enum: kgl, steering, skill, power.

EnterpriseManagementIdcConfig

Champs3 champs

identityStoreIdstringObligatoire: The IAM Identity Center identity store ID, for example d-1234567890. Not the instance ID (ssoins-…). Pattern ^d-[a-z0-9]{10}$.
regionstringObligatoire: The directory's home Region. Length 1–64.
profileArnstringObligatoire: The Kiro (Amazon Q Developer) profile ARN the directory read runs under. Pattern ^arn:(aws\|aws-cn\|aws-us-gov):codewhisperer:[a-z0-9\-]+:[0-9]{12}:profile/.+$.

EnterpriseManagementInlineFile

Champs3 champs

pathstringObligatoire: The file path. Length 1–200.
typeEnterpriseManagementFileTypeObligatoire: kgl, steering, skill, or power.
contentstringObligatoire: The file text. Never empty. Length 1–524288.

EnterpriseManagementResourceFile

Champs4 champs

pathstringObligatoire: The file path.
typeEnterpriseManagementFileTypeObligatoire: The file type.
sha256stringObligatoire: Lowercase hex, 64 characters.
sizeByteslongObligatoire: 1–524288.

EnterpriseManagementResourceSummary

Champs7 champs

resourceIdstringObligatoire: The resource ID.
arnstringObligatoire: The resource ARN.
namestringObligatoire: The display name.
latestRevisioninteger: The newest published revision. Absent when never published.
enforcingRevisioninteger: The oldest revision any scope in this Region is still serving. Absent when the resource is associated with no scope here.
associatedScopesEnterpriseManagementAssociatedScope[]: 0–100 entries.
updatedAttimestamp: The last rename or publish.

EnterpriseManagementResourceValidationException

Returned by PublishEnterpriseManagementResource and PutEnterpriseManagementResourceFiles when the documents fail validation or compilation. It carries every blocking finding as one list. ValidateEnterpriseManagementResource reports the same findings without failing. HTTP 400.

Champs2 champs

messagestringObligatoire: For example "3 errors prevented publishing".
diagnosticsEnterpriseManagementDiagnostic[]Obligatoire: At least one ERROR. 0–100 entries.

EnterpriseManagementRevisionSelector

Set exactly one of:

Champs3 champs

numberinteger: A published revision number. Minimum 1.
draftunit: The open draft.
enforcingunit: The enforcing revision.

EnterpriseManagementRevisionState

Enum: DRAFT, PUBLISHED.

EnterpriseManagementRevisionSummary

Champs9 champs

revisionintegerObligatoire: Revision numbers start at 1, count up, and are never reused.
stateEnterpriseManagementRevisionStateObligatoire: Always PUBLISHED in this listing.
parentinteger: The revision this one superseded.
createdBystringObligatoire: The identity that opened the draft. This shows a service role, not the caller.
createdAttimestampObligatoire: When the draft was opened.
publishedAttimestamp: When the revision was published.
publishedBystring: Who published it. This shows a service role, not the caller.
restoredFrominteger: Present only on a revision made by RestoreEnterpriseManagementResource.
isEnforcingbooleanObligatoire: Whether this revision is live.

EnterpriseManagementScopeType

Enum: PROFILE.

EnterpriseManagementStoredFile

Champs5 champs

pathstringObligatoire: The path as sent.
typeEnterpriseManagementFileTypeObligatoire: The file type.
sha256stringObligatoire: Lowercase hex, 64 characters.
sizeByteslongObligatoire: 1–524288.
storageEnterpriseManagementFileStorageOutcomeObligatoire: STORED or DEDUPLICATED.

EnterpriseManagementValidateTarget

Set exactly one of:

Champs2 champs

byResourcestring: Validate an existing resource's open draft, reading exactly the files a publish would. No open draft returns ResourceNotFoundException. Length 1–64.
filesEnterpriseManagementInlineFile[]: Validate the files as sent. Nothing is stored. 0–500 entries.

Errors

Exception	HTTP status	Fields
`AccessDeniedException`	403	`message`, `reason`
`ConflictException`	409	`message`, `reason`
`EnterpriseManagementResourceValidationException`	400	`message`, `diagnostics`
`InternalServerException`	500	`message`
`ResourceNotFoundException`	404	`message`
`ThrottlingException`	429	`message`
`ValidationException`	400	`message`, `reason`, `missingPermissions` (a list of `action` and `resource`)

The service returns every client error as HTTP 400, including not-found, access-denied, and conflict conditions, and the message holds internal text such as "(Service: KiroEnterpriseManagement, Status Code: 404, …)". Match on the exception name, such as ResourceNotFoundException, rather than the status code. The AWS CLI and the SDKs show the right exception.

Page mise à jour : 11 novembre 2026

Enterprise Management enforcement and limits

Surveillance et suivi