Kiro is a GenAI-assisted developer experience designed to help teams build faster with features like vibe coding and automation hooks. Before you can start building, your organization needs a reliable way to manage access, identities, and billing. For companies that want centralized control, the best approach is a Kiro Team (Organization) subscription using AWS IAM Identity Center for Single Sign-On (SSO).

Login Options in Kiro: Individual vs Team

Kiro supports multiple sign-in and subscription paths:

The first three methods are individual subscriptions where each user signs up and pays independently based on the plan selected. The SSO method is a team or enterprise model where accounts are provisioned by an administrator and users sign in via a dedicated, company-specific URL.

What Is a Kiro Organization (Team or Enterprise) Subscription?

A Kiro organization subscription is designed for companies that need centralized governance. In this model:

Subscriptions are managed at the organization level rather than per individual
Users and groups are provisioned in advance by administrators
Access is controlled through a company SSO URL, reducing unmanaged sign-ups
Billing can be consolidated under organizational purchasing

What Is AWS IAM Identity Center and Why It Matters for Kiro

AWS IAM Identity Center (formerly AWS Single Sign-On) is AWS’s centralized workforce identity and access management solution. It helps organizations manage authentication and authorization for AWS accounts and supported cloud applications.

With IAM Identity Center, administrators can:

Create users directly or connect an external identity provider
Organize users into groups aligned to teams and roles
Assign permissions across one or many AWS accounts
Enable SSO for supported applications using standards like SAML, and in many enterprise setups, automate user lifecycle using SCIM

For Kiro specifically, IAM Identity Center enables secure, centralized login and controlled subscription assignment for team members.

High-Level Architecture: How Kiro Team SSO Works

In a typical team setup:

Your organization configures AWS IAM Identity Center as the identity source for Kiro.
An administrator creates users and groups and assigns eligible groups to the Kiro subscription.
Users sign in to Kiro using a company-specific SSO URL provided by the organization.
Access is granted based on group membership, allowing IT to manage onboarding and offboarding centrally.

Step-by-Step: Set Up a Kiro Team Subscription with AWS IAM Identity Center

The exact screens can vary by AWS Console updates and Kiro plan type, but the flow below is consistent for most organizations.

1) Enable AWS IAM Identity Center

In the AWS Management Console, locate IAM Identity Center and enable it for your AWS environment. This establishes your organization’s SSO environment and the identity directory used for team access.

Tip: If your organization already uses IAM Identity Center for AWS account access, you typically reuse the existing setup.

2) Create or Connect Your Identity Source

Decide how you will manage identities:

Built-in directory: Create users directly in IAM Identity Center for quick starts.
External identity provider: Integrate with your corporate identity provider (for example, via SAML) and optionally automate provisioning with SCIM if supported.

3) Create Users and Groups for Kiro

Define groups that map cleanly to how you want to allocate licenses and access. Common examples:

Kiro-Developers: Standard engineering access
Kiro-Platform: Admins and platform engineers
Kiro-Contractors: Time-bound access with stricter controls

Add users to the appropriate group(s). Group-driven access is simpler to maintain than user-by-user assignments.

4) Subscribe or Enable Kiro for Your Organization

From your organization’s subscription management experience (often tied to an organizational dashboard), enable the Kiro team plan and connect it to IAM Identity Center. This is where you establish that Kiro will rely on your SSO identities for access.

In many enterprise workflows, this step also aligns with organizational billing and may involve contacting sales for enterprise tiers.

5) Assign Kiro Access to Groups (Recommended)

Once Kiro is enabled, assign application access to IAM Identity Center groups rather than individual users. This ensures:

Fast onboarding by simply adding a user to a group
Clean offboarding by removing a user from the group
Consistent access across teams

6) Distribute the Dedicated SSO Login URL

Users must sign in using the organization-specific Kiro SSO URL. This is a key difference from individual subscriptions, where users might sign in directly with Google, GitHub, or AWS Builder ID.

7) User Sign-In and First-Time Access Checks

When users sign in for the first time:

They authenticate via IAM Identity Center using the corporate login flow.
Kiro validates membership in the entitled group(s).
Access is granted based on the organization’s subscription and assigned permissions.

Troubleshooting: Common Causes of Kiro SSO Sign-In Errors

If you see errors like “There was an error signing you in. Please try again.”, the most common root causes in team setups include:

User not assigned to the correct IAM Identity Center group entitled for Kiro
Group assignment not completed in the subscription or application access configuration
Identity source mismatch (user exists in a different directory than expected)
SSO misconfiguration (SAML settings, redirect URLs, or certificate issues in enterprise configurations)

Start troubleshooting by confirming group membership and verifying that the group is actually linked to the Kiro subscription entitlement.

Why Teams Prefer IAM Identity Center for Kiro

Using IAM Identity Center for Kiro team subscriptions delivers practical benefits:

Centralized access control with auditable onboarding and offboarding
Reduced risk from unmanaged individual subscriptions
Scalable operations using groups and automated provisioning (where available)
Consistent user experience through SSO and a single corporate identity

Frequently Asked Questions (FAQ)

Is a Kiro Team subscription different from an individual Kiro subscription?
Yes. Individual subscriptions are user-managed and typically billed per user directly, while team subscriptions are admin-provisioned, use SSO, and support centralized management and billing.

Do users need a special URL to sign in with SSO?
Yes. In the organization model, users sign in using a company-specific SSO login URL provided by your administrator.

Can we manage Kiro access using IAM Identity Center groups?
Yes. Group-based assignment is the recommended approach for scalable access control and easier lifecycle management.

Conclusion

Setting up a Kiro Team subscription with AWS IAM Identity Center is the most effective path for organizations that want secure SSO, centralized user management, and controlled subscription assignment. By structuring users into well-defined groups, assigning Kiro access at the group level, and distributing the correct SSO login URL, teams can onboard quickly and keep access governance clean as they scale.

How to Set Up a Kiro Team Subscription Using AWS IAM Identity Center (SSO) for Centralized Access