How to resolve Kiro web app redirecting to Q Developer page

Problem

When signing in to Kiro via https://app.kiro.dev/ using IAM Identity Center (SSO), you are redirected to https://aws.amazon.com/q/developer/ instead of reaching the Kiro application dashboard.

Observed behavior:

1. Navigate to https://app.kiro.dev/
2. Click "Sign In using Your organization"
3. Enter IAM Identity Center Start URL and Region
4. Authenticate with username and password
5. Arrive at the AWS Access Portal
6. Select the Kiro Application
7. Result: Redirected to https://aws.amazon.com/q/developer/ instead of the Kiro dashboard

This also occurs when navigating directly to https://app.kiro.dev/settings/api-keys.

Cause

The Kiro Sign-In application in IAM Identity Center (e.g., Kiro Sign-In - KiroProfile-us-east-1) is configured to "Require assignments" but has no users or groups assigned to it.

When the Kiro Sign-In application requires assignments and none are configured, users attempting to sign in are not authorized for the application. This causes the SSO/OAuth flow to fail authorization, resulting in a fallback redirect to https://aws.amazon.com/q/developer/.

Note: This issue may also occur if Customer Managed KMS Keys (CMCMK) are enabled on the IAM Identity Center instance and the KMS key policy does not grant the required permissions to Kiro. If the solution below does not resolve the issue, check Settings → Management tab → "Key for encrypting IAM Identity Center data at rest" and ensure the KMS key policy includes the necessary permissions for Kiro/Q Developer.

Solution

To resolve this issue, navigate to the IAM Identity Center console in the admin account and locate the Kiro Sign-In application. Then choose one of the following options:

Option 1: Assign Users/Groups to the Kiro Sign-In Application

Use this option if you want to control which users or groups can access Kiro.

1. Sign in to the AWS Management Console using the account where your IAM Identity Center instance is enabled.
2. Navigate to IAM Identity Center → Applications.
3. Locate and select Kiro Sign-In - KiroProfile-<region> (e.g., Kiro Sign-In - KiroProfile-us-east-1).
4. Under Assigned users and groups, choose Assign users and groups.
5. Add the appropriate users or groups that need access to Kiro.
6. Save changes.

Option 2: Remove the Assignment Requirement

Use this option if you do not need assignment-based access control for Kiro.

1. Sign in to the AWS Management Console using the account where your IAM Identity Center instance is enabled.
2. Navigate to IAM Identity Center → Applications.
3. Locate and select Kiro Sign-In - KiroProfile-<region> (e.g., Kiro Sign-In - KiroProfile-us-east-1).
4. Choose Edit configuration (or Actions → Edit details).
5. Change the assignment requirement from "Require assignments" to "Do not require assignments".
6. Save changes.

Step 3: Verify the Configuration

After applying either option:

1. Navigate to https://app.kiro.dev/.
2. Sign in using your organization's IAM Identity Center credentials.
3. Confirm you land on the Kiro application dashboard.
4. (Optional) Navigate to https://app.kiro.dev/settings/api-keys to confirm API key generation is accessible.

Important Information

• "Require assignments" vs. "Do not require assignments": When "Require assignments" is enabled, only explicitly assigned users and groups can access the application. When disabled, all users in the Identity Center instance can access the application. Choose based on your organization's access control requirements.
• Customer Managed KMS Keys (CMCMK): If your IAM Identity Center instance uses a customer managed KMS key for encryption at rest, ensure the key policy grants the necessary kms:Decrypt and kms:DescribeKey permissions to the Kiro service. Without these permissions, the SSO flow may fail even with correct user assignments.
• Multiple Kiro Sign-In applications: If you have Kiro profiles in multiple regions, each region will have its own Kiro Sign-In application (e.g., Kiro Sign-In - KiroProfile-us-east-1, Kiro Sign-In - KiroProfile-eu-west-1). Ensure assignments are configured for each relevant application.
• Supported regions: Ensure your IAM Identity Center instance is in a region supported by Kiro.

Related Resources

• IAM Identity Center - Manage Application Assignments
• IAM Identity Center - Customer Managed Keys
• Kiro Supported Regions
• Kiro Authentication Methods
• Run Kiro CLI Programmatically: Introducing Headless Mode