This documentation is a copy of the public Kiro documentation. For supplemental information that is specific to this region, such as feature and service availability, see the AWS Classified Regions User Guide. Published: October 14, 2026.
To create a Kiro profile and manage subscriptions, you need to ensure that the role managing it has the following IAM permissions in the AWS account.
These are IAM permissions required to manage Kiro profile and users subscriptions regardless of the identity store you use. Here are the supported identity stores.
- codewhisperer:ListProfiles - codewhisperer:CreateProfile - codewhisperer:DeleteProfile - codewhisperer:UpdateProfile - codewhisperer:TagResource - codewhisperer:UntagResource - codewhisperer:ListTagsForResource - codewhisperer:AllowVendedLogDeliveryForResource - q:ListDashboardMetrics
If you are connecting an external identity provider, you will also need the following permissions
- q:ListLoginDomains - q:AssociateLoginDomain - q:DisassociateLoginDomain - q:ListScimAccessTokens - q:CreateScimAccessToken - q:DeleteScimAccessToken - q:ListGroups - q:ListUsers - q:BatchDescribeUsers - q:BatchDescribeGroups
For more information about IAM and security best practices:
IAM permissions