Approve Kiro only on enterprise sign-ins, and approve each model by where it runs inference and what it retains. Decide on cloud sessions separately, because the admin model and MCP settings do not reach them. The checklist also covers storage by sign-in type, encryption, and the controls for MCP, web tools and API keys, from Kiro's documentation and the AWS Service Terms.
When you need this
- Security or compliance must approve Kiro before a team rollout.
- Engineers want to connect MCP servers or run Kiro in CI with API keys.
- Your data must stay in a Region or geography, or in AWS GovCloud (US).
- Repositories hold secrets or regulated data the agent must not read.
Evaluation criteria
Sign-in type
Whose content can AWS use for service improvement?
Look forEnterprise users sign in through IAM Identity Center, Okta, or Entra ID. AWS does not use their content for service improvement and opts them out of telemetry automatically. AWS can use content from Free users and individual subscribers on GitHub, Google, or Builder ID sign-ins, including for model training, unless each user opts out in each client. Q Developer Pro users keep Pro protection when they sign in with the same credentials.
Storage and inference location
Where is content stored, and where do models process it?
Look forCheck storage and inference separately. Free and individual content stays in US East (N. Virginia), and enterprise content stays in the profile's Region. Inference can run elsewhere in the same geography. GPT-5.6 routes globally across commercial AWS Regions even with a Frankfurt profile. Verify each approved model's inference scope.
Retention for abuse detection
Which models retain prompts?
Look forApprove models against their retention rules. Amazon Bedrock abuse detection applies to every user. For OpenAI GPT, Amazon Bedrock retains classifier-flagged traffic for up to 30 days. For Claude Fable 5.1, it retains all traffic for up to 30 days and permits human review of flagged traffic. AWS can retain Free inputs for up to 60 days.
Model and MCP governance
Which models and tools can engineers use?
Look forSet the approved models and default for all clients. Disable MCP or restrict it to an allow-list from an MCP registry. Set web search and fetch permissions. Enable API key generation only for approved headless CLI use. Apply settings per organization or account.
Kiro Web and cloud sessions
What changes when work runs in the cloud?
Look forApprove Kiro Web separately. Cloud sessions default to off for Identity Center organizations and run only in the us-east-1 Region (N. Virginia). They ignore the approved model list, MCP settings, code references, and customer managed keys. Kiro clones repositories into a server-side isolated sandbox.
Files the agent can see
What is excluded from agent reads?
Look forExclude sensitive files with workspace .kiroignore and the IDE's global ignore file. Matching files disappear from reads and search. CLI V3 honors the workspace file. Kiro Web ignores it, so keep repositories that hold secrets out of Kiro Web.
Encryption, compliance, and terms
What evidence will procurement ask for?
Look forVerify TLS 1.2 or higher in transit and AWS owned keys at rest. Use customer managed KMS keys on enterprise profiles where required. Kiro IDE and CLI are HIPAA eligible. Kiro Web is not. Kiro is in scope for FedRAMP Class C in the N. Virginia Region (us-east-1) since October 12, 2026. FedRAMP High and DoD Impact Levels 4 and 5 apply only in AWS GovCloud (US). Kiro falls under AWS's ISO/IEC 27001:2022 certificate, with reports in AWS Artifact for Builder ID and Identity Center users. Paid subscribers receive output indemnity under Service Terms section 50.10.
Questions to ask vendors
- Which engineers still use personal sign-ins, and have they opted out of content collection?
- Which approved models route inference outside our geography?
- Do we allow Claude Fable 5.1 or GPT models, given their retention rules?
- Is MCP limited to a registry, and who maintains it?
- Will we enable cloud sessions, knowing our model and MCP settings do not apply there?
Red flags
- A rollout on social or Builder ID sign-ins in a codebase with regulated data.
- MCP enabled with no allow-list or registry.
- Global-inference models approved for a team with an EU data requirement.
- No .kiroignore for secrets in repositories the agent can reach.
Products in this piece
Sources
- Official documentation
- 12
- Kiro docs: Data protection
- Kiro changelog: General
- Kiro docs: Models
- Kiro docs: Enterprise governance
- Kiro docs: Enterprise settings
- Kiro docs: Kiro Web with AWS Identity Center
- Kiro docs: Cloud sessions
- Kiro docs: Kiroignore
- Kiro docs: Compliance validation
- Kiro FAQs
- AWS Service Terms, sections 50.3, 50.10, and 50.14
- AWS GovCloud (US) User Guide: Kiro