How do I set up AWS Kiro Enterprise subscription when using a cross-account IAM AssumeRole architecture?

Understanding the Architecture

In many organizations, engineers authenticate to a central Identity Account and then use AWS STS AssumeRole to switch into Target/Resource Accounts where development and operations occur. This article covers how Kiro Enterprise integrates with this model.

Enterprise Subscription Setup Options

Kiro can be onboarded from either:

1. The Organization Management Account (Recommended) – Set up Kiro from the management (root/payer) account where your AWS IAM Identity Center (IdC) instance resides.
2. A Member Account – If you prefer to onboard from a specific member account, you must first enable IAM Identity Center access for member accounts.

Option 1: Onboarding from the Management Account (Recommended)

1. Sign in to the AWS Management Console using your organization's management account.
2. Navigate to AWS IAM Identity Center (IdC).
3. Ensure your IdC instance is configured and users/groups are provisioned.
4. Enable the Kiro Enterprise subscription from this account.
5. Assign access to the appropriate users or groups within IdC.

Option 2: Onboarding from a Member Account

If your organization requires Kiro to be set up from a member account:

1. Sign in to the AWS Management Console using your management account.
2. Navigate to IAM Identity Center > Settings.
3. Enable IAM Identity Center access for member accounts (this allows member accounts to detect the organizational IdC instance residing in the management account).
4. Sign in to the desired member account.
5. Enable the Kiro Enterprise subscription from the member account.

For detailed steps on enabling member account access, see: Enable IAM Identity Center for member accounts

How Kiro Authentication Works with Cross-Account AssumeRole

Important: Your existing cross-account AssumeRole workflow is not impacted by Kiro. Here's why:

• Kiro authentication is managed directly by the IAM Identity Center instance.
• When users log in to Kiro IDE or CLI, they provide the IdC instance sign-in URL.
• Authentication occurs via a web browser redirect flow, which then redirects users back to Kiro IDE/CLI.
• Your existing console access workflow via STS AssumeRole for accessing target accounts remains completely unaffected.

Summary

Related Information

• AWS IAM Identity Center Documentation
• Enable IAM Identity Center for member accounts
• AWS Kiro Documentation