Kiro for Your Whole Team: Setting It Up with AWS IAM Identity Center

Your developers want Kiro. Your finance team wants one bill. Your security team wants one place to control who gets in. Good news: AWS IAM Identity Center gives all three of them what they want, and the setup takes less time than your next stand-up.

I recently set this up end to end in a fresh AWS account and took screenshots at every step. This post walks you through the same path, from the admin console to the first sign-in inside the Kiro IDE.

The short version

1. The admin enables Kiro in the AWS console and picks a plan for each user or group.
2. Each user accepts an email invite, sets a password, and registers MFA.
3. Each user installs Kiro, chooses “Your organization” at sign-in, and they are in.

Why go through the IAM Identity Center?

Kiro also lets people sign in on their own with Google, GitHub or an AWS Builder ID. That works well for individuals, and in that case, the user handles payment through Stripe. For a team, though, the organization route is much cleaner:

1. One bill. Kiro charges land on your AWS bill, and you can see them in AWS Billing and Cost Management.
2. One identity. People use the same login they already use for AWS. When someone leaves, you remove access in one place.
3. One control panel. Admins add users, change plans, and cancel plans from the Kiro console.

Before you start

Tick these off first. It saves a lot of back and forth later.

• An AWS account. If you do not have one yet, create it first.
• Admin permissions for Kiro. The person doing the setup needs permission to create a Kiro profile and subscribe users. Kiro publishes the exact IAM policy in its docs (link at the end).
• An identity provider. Kiro works with AWS IAM Identity Center, Okta or Microsoft Entra ID. This guide uses IAM Identity Center.
• Your users or groups. They should already exist in your directory, or you should be ready to create them.
• A supported Region. At the time of writing, the Kiro console runs in US East (N. Virginia) and Europe (Frankfurt), plus the two AWS GovCloud (US) Regions. Your AWS IAM Identity Center can live in a different Region, as long as it is one Kiro supports.

A tip from experience: if your company uses AWS Organizations, set up AWS IAM Identity Center as an organization instance before you touch Kiro. The Kiro docs are clear that an account instance cannot be upgraded to an organization instance later. You would have to delete it and start over, and nobody enjoys that.

Part 1: The admin side (about 10 minutes)

You do this part once. After that, adding a new person is just a few clicks.

Step 1: Open the Kiro console

Sign in to the AWS Management Console and search for Kiro. Check the Region selector at the top right. Pick a supported Region, because this is where your Kiro profile will live.

You may also see a Sign up in Kiro.dev button with a small external-link icon. That one opens kiro.dev in a new tab and is meant for individual sign-ups. For a team setup, stay inside the AWS console.

Step 2: Enable Kiro

Start the sign-up from the Kiro console. The official docs call this button Sign up for Kiro, though console labels do change from time to time. You know you are in the right place when a dialog opens inside the AWS console and says Kiro will be enabled in this AWS account. It also tells you that Kiro collects aggregated usage metrics for your dashboard, which you can turn off later from the Kiro Settings page. Choose Enable.

One small note: if your account has no AWS IAM Identity Center yet, the console may first ask you to create a user, and it also offers a link to connect your own identity provider. In my test account, this created a standalone Identity Center instance. That is fine for a quick trial, but see the tip above if you run AWS Organizations.

Step 3: Meet your new Kiro profile

You land on Users & Groups, under “Add your team to Kiro”. On the right side, note two things:

• IAM Identity Center region. Your users will need this when they sign in to the IDE.
• Sign in URL. This is your AWS access portal URL. It looks like https://d-xxxxxxxxxx.awsapps.com/start. Your users will need this too.

Step 4: Add a user and pick a plan

Choose Add user (or switch to the Groups tab and choose Add group).

Pick a plan:

Every paid plan includes everything in Kiro Free. If someone runs out of credits, overage is opt-in and costs $0.04 per credit. Prices do not include taxes such as VAT or sales tax.
 

Not sure which plan to pick? One simple approach is to start on Pro, watch the usage dashboard for a few weeks, then upgrade the heavy users. Upgrades take effect right away.

Step 5: Choose the person and confirm

Search for the user or group in your AWS Identity Center directory, or create a new user if they are not there yet. Confirm, and you will see a green banner that says the subscription was created.
 

Read that banner carefully. If you subscribed a group, it can take up to 24 hours before the members can use Kiro.

That is it for the admin. Time for a coffee.

Part 2: The team member side (about 5 minutes)

Now the fun part moves to your developers. Share this section with them.

Step 1: Accept the invite

New Identity Center users get an email called Invitation to join AWS IAM Identity Center. It comes from no-reply@login.awsapps.com or no-reply@signin.aws. It includes your access portal URL and your username. Choose Accept invitation.

The invite expires in 7 days, so do not leave it sitting in your inbox.
 

Step 2: Set your password

You land on a “New user sign up” page. Type a new password twice and choose Set new password.

Step 3: Register MFA

If your organization requires MFA (and it should), you are asked to register a device right away. You can pick an authenticator app, a security key like a YubiKey, or a built-in authenticator like Touch ID or Windows Hello.

On new AWS IAM Identity Center setups, the default is to ask users to register MFA at their first sign-in, so most people will see this screen.

Step 4: Verify your email (if asked)

You may also get a separate Verify your email message from the same sender. Click the link, and you will see a short “Your email has been verified” page. This link also expires in 7 days.

Step 5: Peek at the access portal

Sign in at your access portal URL with your username, password and MFA code. Open the Applications tab. You should see a Kiro tile with a name like KiroProfile-us-east-1. If the tile is there, your subscription has reached you.
 

Part 3: Install Kiro and sign in

Almost there. This is the part where the ghost logo finally shows up.

Step 1: Download the IDE

Go to kiro.dev/downloads and pick your operating system. There are builds for macOS (Apple Silicon and Intel), Windows and Linux. The CLI and web versions are on the same page if you prefer those.

Step 2: Install it

On macOS and Windows, run the installer like any other app. On Debian or Ubuntu, open a terminal in the folder where the file was saved and run:

sudo apt install ./kiro-ide-*-stable-linux-x64.deb

The version number in the file name changes with every release, which is why the command uses a *.

Step 3: Choose “Your organization”

Open Kiro and choose Sign in. A browser page asks how you want to sign in. Ignore Google, GitHub and Builder ID. Choose Your organization.

Step 4: Enter the Start URL and Region

Kiro asks for two things, and your admin already has both from Part 1, Step 3:

• Start URL: your access portal URL, for example https://d-xxxxxxxxxx.awsapps.com/start
• Region: the Region where your IAM Identity Center lives (not always the Kiro Region)

If sign-in fails here, check the Region first. It is the easiest value to mix up.

Step 5: Sign in and allow access

You are sent to the familiar AWS sign-in page. Enter your username, password and MFA code.

Finally, AWS asks Allow Kiro IDE to access your data? Choose Allow access. Switch back to the IDE, and you are signed in on the plan your admin picked.
 

Things that can trip you up

Changing or cancelling plans later

Everything lives on the Users & Groups page in the Kiro console:

• Upgrade: choose Change plan. A higher plan applies right away.
• Downgrade: also Change plan. A lower plan starts at the beginning of the next month.
• Cancel: choose Deactivate plan. You can end access right away or at the end of the month. Either way, that month is billed in full.

Billing is monthly per user. When you add someone in the middle of a month, the charge is prorated. You can see the costs in AWS Billing and Cost Management, next to the rest of your AWS spend.

Wrapping up

That is the whole journey: enable Kiro, pick plans, send people through one invite, and they sign in with the same identity they already use for AWS. No shared cards, one bill, and one place to switch access off when someone moves on.

If you get stuck, the official docs below are the best place to look. They change more often than blog posts do.

Plans, prices, Regions and screens are as of October 2026. AWS updates Kiro often, so please check the official pages before you plan a budget or a rollout.