Connect a custom OIDC provider in AWS GovCloud (US)

In AWS GovCloud (US), a Kiro profile that uses just-in-time (JIT) subscriptions can connect a custom OpenID Connect (OIDC) identity provider in addition to the predefined Okta and Microsoft Entra ID options. This lets you use a provider that Kiro does not list by name, such as Keycloak. Custom OIDC providers are not available in commercial AWS Regions.

With just-in-time subscriptions, you do not add users or groups in the Kiro console. Any user who is assigned to the Kiro application in your identity provider receives a Kiro subscription at first sign-in.

Your identity provider must meet these requirements:

• You have an application (client) in your identity provider that uses OIDC for authentication.
• The application issues tokens with an aud claim that holds the application's client ID.
• The application issues tokens with an scp claim that holds the values codewhisperer:completions and codewhisperer:conversations.
• The application issues tokens with a claim that holds a unique user ID. The value must not change when the user's other details change, such as their name or email address.
• The application issues tokens with a claim that holds a unique token ID.
• The application allows the following redirect URIs:

kiro://kiro.oauth/callback
http://localhost:3128/oauth/callback
http://localhost:4649/oauth/callback
http://localhost:6588/oauth/callback
http://localhost:8008/oauth/callback
http://localhost:9091/oauth/callback
http://localhost:49153/oauth/callback
http://localhost:50153/oauth/callback
http://localhost:51153/oauth/callback
http://localhost:52153/oauth/callback
http://localhost:53153/oauth/callback

1. Sign in to the AWS Management Console for AWS GovCloud (US) and open the Kiro console.

2. Create a Kiro profile that uses just-in-time subscriptions, and choose Custom OIDC provider as the identity provider type.

3. Enter the following five values.

   Field	Value
   Issuer URL	The issuer URL of your identity provider. The format differs by provider. To check the value, open <issuer-url>/.well-known/openid-configuration and confirm that the issuer field exactly matches the Issuer URL that you enter.
   Client ID	The ID of the application (client) that you created for Kiro.
   User ID claim key	The claim that holds each user's unique identifier. Make sure this claim is correct, unique, and immutable. A common value is sub.
   Token ID claim key	The claim that holds each token's unique identifier. Kiro uses this value in AWS CloudTrail events. A common value is jti.
   IAM role for JIT subscriptions	The IAM role that Kiro uses to create just-in-time subscriptions.

4. Choose Enable.

After you choose Enable, the profile is ready. Share the download and sign-in instructions with your team; see Authentication. Any user who is assigned to the Kiro application in your identity provider gets a Kiro subscription at first sign-in.

To change a user's tier or unsubscribe a user later, see Manage subscriptions.

• Billing for how per-user charges work.
• Manage subscriptions to change tiers or unsubscribe users.
• IAM permissions for the permissions administrators need in the Kiro console.