Girish Bhatia

Posted on Jun 27

Kiro Did It: Secure AWS Kiro IDE Enterprise Access with Okta SSO!

#kiro #aws

What happens when your development teams want to adopt AI-powered tools like AWS Kiro IDE, but your security team requires centralized authentication, governance, and access controls?

This is a challenge many organizations face as they begin rolling out AI-assisted development platforms across engineering teams.

Since Kiro launched in 2025, I have published several articles exploring capabilities such as vibe coding, spec-driven development, hooks, steering docs, powers, and more. I have also covered enterprise-focused topics, including:

• Securely rolling out AWS Kiro IDE using AWS IAM Identity Center
• Governance approaches for AI models, policies, and MCP controls using Kiro administrative capabilities

There is so much you can do with Kiro. However, before developers can begin building creative, GenAI-assisted solutions, they first need a secure and governed way to access the platform.

Kiro provides multiple ways to log in and set up a subscription:

The first three options are individual subscription models. This means you sign up independently and pay monthly based on the plan you select.

The Organization Single Sign-On option is designed for team-based access. In this model, your account is provisioned by your cloud administrator, and you are provided with a dedicated login URL. This enables centralized access management and consolidated billing.

In this article, we take the next step in enterprise identity integration by implementing Okta-based Single Sign-On (SSO) for AWS Kiro IDE.

We will walk through the end-to-end configuration process, from setting up the Okta OIDC integration to signing in with enterprise credentials and validating access through a Kiro Enterprise Team Subscription.

What Is an Organization (Team / Enterprise) Subscription?

This option is used when your company centrally manages access using AWS IAM Identity Center or Okta-based Single Sign-On . In this model:

Kiro subscriptions are managed at the organizational level
Users and groups are provisioned in advance
You must sign in using a company-specific URL

What is Okta Single Sign on?

Okta is a cloud-based Identity Provider (IdP) that enables organizations to securely manage user authentication and authorization across applications.

It provides the following core capabilities:

Single Sign-On (SSO)
Multi-Factor Authentication (MFA)
User Lifecycle Management
OAuth 2.0 / OpenID Connect (OIDC) Support

In this architecture, Okta serves as the central Identity Provider (IdP) for AWS Kiro IDE, enabling enterprise users to authenticate using their organizational credentials. Once integrated, Kiro delegates user authentication to Okta, ensuring secure and centrally governed access to the IDE.

Individual vs Team / Organization Subscription

The following comparison highlights the key differences between individual Kiro subscriptions and organization-managed access using Okta SSO. While individual subscriptions are ideal for solo developers and learners, enterprise subscriptions introduce centralized authentication, governance, user lifecycle management, and organizational billing.

Architecture/Design

This diagram illustrates how AWS Kiro IDE integrates with Okta to provide secure Single Sign-On (SSO) and centralized identity management for enterprise users. It highlights how authentication and user provisioning are handled in a governed and scalable way.

OIDC Authentication Flow: Secure login between Kiro and Okta using OpenID Connect
SCIM User Provisioning: Automated synchronization of users and groups from Okta to Kiro
Enterprise Governance: Centralized access control, security enforcement, and auditability

Step-by-Step: Integrating Okta SSO with AWS Kiro IDE

Step 1: Create the Okta OIDC Application

First, you need to set up Kiro as an authorized application inside your Okta account.

Step 2: Configure AWS Kiro IDE

Now that you have your Okta credentials, it’s time to hook everything up on the Kiro side.

Log into your AWS Account and look for Kiro Service.

Click on Sign up for Kiro to start the sign up process.

In the next step, select your identity management source from the two options provided:

IAM Identify Center
External Identity Provider

In the next step, you will be prompted to choose an identity provider, with options including Okta and Microsoft Entra ID. For my use case, I will select Okta.

Once Okta is selected, you will need to provide the Issuer URL and Client ID. I already have both of these values ready from Step 1 when I configured the Okta OIDC application.

Once you provide these values and enable the integration, a Kiro profile will be created, and a confirmation message will be displayed on the screen.

Step 3: Add Domain Verification

To secure your integration and ensure that only authorized users can access your environment, you need to verify ownership of your corporate domain. Follow these steps to complete the verification process:

Navigate to Domain Settings: Inside the Kiro administrative console, head over to Domain Settings.
Add Your Domain: Click to add a new domain and enter your custom organization domain (for example, cloudwithgirish.com). Kiro will automatically generate a unique verification token for you.
Update Your DNS Records: Log into your DNS provider (such as Cloudflare) and create a new TXT record using the following values:

Review that status has changed to verified as shown below:

Step 4: Configure SCIM Access Token and App Integration

In this step, I will generate an access token from identity management and use it to configure the SCIM provisioning application.
From the Okta Admin Console, I will add the integration for the AWS IAM Identity Center.

During the provisioning process, I will input the SCIM URL provided by Kiro along with the access token, and then test the API credentials. Once a success message appears, the integration is complete!

At this point, I can successfully sign in to Kiro using my organization's credentials. However, I still won't be able to use the IDE because a subscription has not yet been assigned to my account. Instead, Kiro will display the access error shown below.

Step 5: Configure a Team Subscription for Kiro

Next, I will go back to the Kiro admin console and assign a subscription:

Once the subscription is assigned to my user ID, I should see the available credits reflected as soon as I sign back in.

At this point, the Kiro IDE is fully ready to use! The enterprise subscription has been successfully added, and the Okta SSO integration is up and running perfectly.

Because this is an enterprise subscription, it gives you granular control over the environment. You can easily review and adjust administrative settings, such as managing available Model Context Protocol (MCP) servers or restricting which LLM models your team can use with Kiro.

Step 6: Build a Demo Application in Kiro

With the enterprise SSO fully configured and the subscription active, the Kiro IDE is ready for action. To test its agentic development capabilities, I used Kiro to build a prototype UI for an internship tracking application from scratch.

The Prompt Used Inside Kiro

UI Prototype Generated by Kiro

Conclusion

In this article, I demonstrated how integrating Okta with AWS Kiro IDE enables secure, centralized access management for enterprise teams. By leveraging OpenID Connect (OIDC) authentication and SCIM-based user provisioning, organizations can streamline onboarding, simplify identity management, and provide developers with a seamless sign-in experience using their existing corporate credentials.

Beyond authentication, this integration establishes the foundation for enterprise-scale adoption of AI-assisted development. Combined with Kiro's administrative capabilities, organizations can centrally govern user access, subscriptions, AI models, and MCP servers while maintaining the security, compliance, and operational controls expected in modern development environments.

As more organizations embrace Generative AI and agentic development workflows, identity and governance will become increasingly important. Integrating Kiro with an enterprise identity provider such as Okta enables teams to scale securely while giving developers access to the tools they need to innovate faster.

I believe this is only the beginning of how agentic development platforms will transform software engineering. By combining secure identity management, centralized governance, and AI-powered development experiences, organizations can create an environment where developers spend less time managing access and more time building impactful solutions.

Experiment with these steps in your own environment and see firsthand how Kiro can simplify enterprise onboarding, strengthen governance, and accelerate GenAI-assisted development at scale.

Thanks for reading, and I hope you found this article insightful.

Watch the video here:

Thanks,

𝒢𝒾𝓇𝒾𝓈𝒽 ℬ𝒽𝒶𝓉𝒾𝒶

𝘈𝘞𝘚 𝘊𝘰𝘮𝘮𝘶𝘯𝘪𝘵𝘺 𝘉𝘶𝘪𝘭𝘥𝘦𝘳 | 𝘈𝘐 𝘌𝘯𝘨𝘪𝘯𝘦𝘦𝘳𝘪𝘯𝘨
𝘈𝘞𝘚 𝘊𝘦𝘳𝘵𝘪𝘧𝘪𝘦𝘥 𝘚𝘰𝘭𝘶𝘵𝘪𝘰𝘯 𝘈𝘳𝘤𝘩𝘪𝘵𝘦𝘤𝘵
𝘈𝘞𝘚 𝘊𝘦𝘳𝘵𝘪𝘧𝘪𝘦𝘥 𝘋𝘦𝘷𝘦𝘭𝘰𝘱𝘦𝘳 𝘈𝘴𝘴𝘰𝘤𝘪𝘢𝘵𝘦
𝘈𝘞𝘚 𝘊𝘦𝘳𝘵𝘪𝘧𝘪𝘦𝘥 𝘎𝘦𝘯𝘈𝘐 𝘗𝘳𝘢𝘤𝘵𝘪𝘵𝘪𝘰𝘯𝘦𝘳
𝘈𝘞𝘚 𝘊𝘦𝘳𝘵𝘪𝘧𝘪𝘦𝘥 𝘊𝘭𝘰𝘶𝘥 𝘗𝘳𝘢𝘤𝘵𝘪𝘵𝘪𝘰𝘯𝘦𝘳
𝘈𝘞𝘚 𝘊𝘭𝘰𝘶𝘥 𝘛𝘦𝘤𝘩𝘯𝘰𝘭𝘰𝘨𝘺 𝘌𝘯𝘵𝘩𝘶𝘴𝘪𝘢𝘴𝘵