Configuring a firewall, proxy server, or data perimeter for Kiro

If your network uses a firewall, proxy server, or

, you need to allowlist specific URLs so Kiro can reach its backend services. This page lists every domain Kiro contacts, grouped by function.

Kiro makes two types of outbound connections:

• IDE traffic — Requests from the Kiro IDE process (chat, completions, telemetry, updates, extensions). This traffic respects your proxy settings.
• Browser traffic — Sign-in opens your default browser. This traffic uses your OS network stack and bypasses IDE proxy settings.

Your firewall must allow both at the network level.

The following URLs are required by all Kiro products (IDE, CLI, and Web):

Every Kiro installation also needs the following URLs. These cover chat and code assistance, telemetry, and auto-updates.

If your network policy allows wildcard rules, you can allowlist *.kiro.dev and *.app.kiro.dev instead of the individual kiro.dev domains above. Note that some firewalls only match a single subdomain level, so *.kiro.dev would cover app.kiro.dev but not assets.app.kiro.dev. If your firewall behaves this way, also add *.app.kiro.dev or list multi-level subdomains explicitly. See Wildcard rules for a complete summary.

If you sign in with Google or GitHub, allowlist this additional endpoint for the Cognito identity federation flow.

If your organization uses AWS IAM Identity Center for authentication, allowlist these additional endpoints.

Replace idc-directory-id-or-alias with your IAM Identity Center instance's directory ID or alias, and sso-region with the AWS Region where your instance is enabled. For more information, see

in the IAM Identity Center User Guide.

If your organization uses an external identity provider (IdP) with IAM Identity Center, the sign-in flow redirects through your IdP's domain. You need to allowlist that domain too.

Check with your identity team for the exact domain if you are unsure which IdP is configured.

If you use AWS GovCloud (US), allowlist these FIPS-compliant endpoints instead of the commercial Kiro service endpoints in the Core URLs table:

• q-fips.us-gov-east-1.amazonaws.com
• q-fips.us-gov-west-1.amazonaws.com

If you sign in with Google, GitHub, or AWS Builder ID, Kiro uses Stripe for subscription billing. Allowlist these domains to access the billing portal and upgrade plans.

Enterprise customers using IAM Identity Center don't need these domains.

You only need these if you use the corresponding Kiro feature. Skip any that don't apply to your environment.

Kiro respects standard proxy environment variables for all IDE traffic:

• HTTP_PROXY
• HTTPS_PROXY
• NO_PROXY

You can also configure proxy settings in Settings > Proxy inside Kiro.

If some users can connect to Kiro but others cannot, see Network connectivity issues in the troubleshooting guide.

If you use

to restrict access to trusted identities and resources, make sure your policies allow Kiro's service principals to reach the endpoints listed on this page. For VPC-level controls, see VPC endpoints (AWS PrivateLink).