How do I resolve IAM Identity Center authentication issues with Kiro?

Resolution

Prerequisites:

• The latest version of Kiro.
• The AWS access portal Start URL that's similar to d-xxxxxxxxxx.awsapps.com/start or your_subdomain.awsapps.com/start.
• The AWS Region that Kiro is in.

Resolve the "There was an error signing you in" error

You receive the "There was an error signing you in" error message because your Kiro subscription isn't active or isn't assigned to your identity.

To check whether your subscription is active, complete the following steps:

1. Sign in to your AWS access portal.
   Note: Use the Start URL and Region that you use for Kiro.
2. Choose Applications. If Kiro is listed as an application, then you have been assigned a subscription. If Kiro isn't listed, then ask your administrator to subscribe you to Kiro.

If Kiro prompts you to sign out and sign in again after your subscription is active, then run the following commands.

To sign out, run the following kiro-cli logout command:

kiro-cli logout

To sign in, run the following kiro-cli login command:

kiro-cli login

To confirm that your sign-in was successful, run the following kiro-cli whoami command:

kiro-cli whoami

The following is an example of a successful output:

Logged in with IAM Identity Center (https://example.awsapps.com/start)
Email: user@example.com
Profile:
  your-profile-name
  arn:aws:codewhisperer:us-east-1:123456789012:profile/EXAMPLEPROFILEID

Note: The profile name, Amazon Resource Name (ARN), and IAM Identity Center Start URL vary based on your setup.

Resolve "No profiles available" or "Failed to retrieve profiles" errors

You receive the "No profiles available" or "Failed to retrieve profiles" error message because a network issue, incorrectly configured proxy, or PAC file doesn't allow Kiro to load your profile after you signed in.

To resolve this issue, check your proxy settings in either the Kiro IDE or Kiro CLI.

Kiro IDE

Complete the following steps:

1. Open the Kiro IDE.
2. Choose the Command Palette icon, and then choose Settings.
3. On the Settings tab, in the search box, enter proxy and review all your proxy configurations. Confirm that the Http:Proxy value is correct for your network and the system-wide proxy or PAC files don't conflict with your Kiro settings.
   Note: If you don't use a proxy, then clear the proxy settings.

Kiro CLI

Complete the following steps:

1. Confirm that the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables point to the correct proxy.
   Note: If you don't use a proxy, then make sure that environment variables aren't set. For more information, see Proxy configuration.
2. To test connectivity to Kiro's endpoints, run the following commands in the Kiro CLI or the terminal that's on the same machine as the IDE:

   curl -v https://runtime.us-east-1.kiro.dev
   curl -v https://management.us-east-1.kiro.dev

In the output, check for one of the following issues:

• If the TLS handshake is successful but you receive an HTTP 4xx or 5xx error, then the network path is open. To troubleshoot this issue, review your proxy authentication credentials and your Kiro IDE proxy settings.
• If there's a timeout or TLS error, then a firewall or proxy is blocking traffic. To resolve this issue, contact your network IT team to allowlist all required domains that are listed in the Kiro firewall allowlist.
• If there's a TLS certificate error, then your organization's TLS inspection might intercept the connection. To resolve this issue, request an exception for the endpoints or configure Kiro to trust the corporate root certificate authority (CA).
  Note: For more information, see Configuring a firewall, proxy server, or data perimeter for Kiro.

Resolve the "profileArn is required but could not be resolved" error

A Kiro profile links your user identity to your subscription and settings. If you receive the "profileArn is required but could not be resolved" error message, then Kiro can't determine what profile to use for your AWS account.

To resolve this issue, use the Kiro IDE or CLI to sign out and then sign back in. Then, confirm that Kiro appears on your list of applications. If Kiro doesn't appear on the list, then contact your IAM Identity Center administrator to have them assign a Kiro profile to you.

Kiro IDE

Complete the following steps:

1. Open the Kiro IDE.
2. Choose the Accounts icon.
3. Choose Sign Out.
4. Sign back in to Kiro when prompted.
5. Sign in to your AWS access portal.
   Note: Use the Start URL and Region that you use for Kiro.
6. Choose Applications. If Kiro is listed as an application, then you have been assigned a subscription. If Kiro isn't listed, then ask your administrator to subscribe you to Kiro.

Kiro CLI

Run the following commands.

Sign out:

kiro-cli logout

Sign in:

kiro-cli login

Check your list of applications in the AWS access portal to confirm that Kiro is listed.

Resolve an expired session

Your session expires because IAM Identity Center sessions have a default time limit of 8 hours. After 8 hours, you must authenticate again. To sign in again, run the kiro-cli login command.

To make sessions last longer, extend the session duration.

Resolve the federated sign-in error

You receive a federated sign-in error message because your external identity provider and IAM Identity Center are configured incorrectly. Expired certificates, incorrect NameID formats, expired credentials, or clock sync issues can cause this error.

To resolve this issue, contact your administrator. For more information, see How do I troubleshoot IAM Identity Center SSO login failures?

Note: The Kiro CLI doesn't support external identity provider login with device flow authentication. If you sign in on a remote machine, then use Builder ID or IAM Identity Center, or locally sign in from your web browser.

Resolve sign-in failures on a remote machine

You receive sign-in failure errors because the Kiro CLI can't open a browser on a remote machine, such as an SSH session, SSM session, or container.

To resolve this issue, complete the following steps:

1. Run the kiro-cli login command.
2. Choose either the Builder ID, IAM Identity Center, Google, or GitHub sign-in method. The CLI displays a URL and a one-time code.
   Note: To force device flow, run the kiro-cli login --use-device-flow command.
3. Open the URL in your browser.
4. Enter the code and complete authentication.

Note: The CLI automatically detects the successful login. You don't need port forwarding or a tunnel setup.

Device flow doesn't support external identity provider login, such as Entra ID or Okta. For more information, see Remote machine authentication (CLI).

Resolve authentication failures in CI/CD pipelines

You get authentication failures because CI/CD pipelines and automation scripts can't use browser-based sign-in. If an administrator manages your subscription, then confirm that the administrator activated user-provided API keys before you proceed.

To resolve this issue, complete the following steps to authenticate with an API key:

1. Set KIRO_API_KEY to a valid key that starts with ksk_ and isn't revoked. For more information, see API key authentication (CLI).
2. To use the Kiro CLI in non-interactive mode, run the following command:

   kiro-cli chat --no-interactive YOUR_PROMPT

   Note: Replace YOUR_PROMPT with your prompt. The CLI checks for an active browser session first, and then KIRO_API_KEY. Run the kiro-cli whoami command to view the active identity. For more information, see Headless mode.

Troubleshoot other errors

To use the Kiro IDE to troubleshoot other errors, complete the following steps:

1. Open the Kiro IDE.
2. Choose Help, and then choose Toggle Developer Tools.
3. Choose Console.
4. Reproduce the sign-in error and review the console output for error messages.

For more information, see Browser redirect failures during authentication.

To use the Kiro CLI to troubleshoot other errors, take the following actions:

• To check your environment for configuration issues, run the kiro-cli doctor command.
• To check your authentication state, run the kiro-cli whoami command.

Related information

Troubleshooting IAM Identity Center issues

Understanding authentication sessions in IAM Identity Center

Configure the session duration in IAM Identity Center