Amazon Q Developer and Kiro Security Guide: Identity Center, MCP governance and credential hardening

AWS coding agents run next to the most powerful credentials a developer holds, their AWS sessions, and two public incidents have already shown how a repository file or a poisoned release can reach them. Amazon Q Developer (in the IDE plugins and the AWS console) and Kiro (AWS's agentic IDE and CLI, which has absorbed the Q Developer CLI) both tie organisational access to AWS IAM Identity Center and both let the agent run commands and MCP servers with the developer's environment. This guide covers how identity and subscriptions work, which IAM policies and service-linked roles are involved, how MCP and trusted commands are governed, what CloudTrail and the Kiro console record, and a hardening baseline. It complements the cross-product AI IDE and Coding Agent Security Guide. Facts are from AWS and Kiro documentation checked on 27 October 2026.

Key takeaways

• Use Pro or Kiro enterprise through IAM Identity Center. Free tier content may be used for service improvement; AWS states it does not use Amazon Q Developer Pro content for that purpose. Builder ID personal sign-in sits outside your directory.
• The Q Developer CLI is now the Kiro CLI. AWS's documentation says so directly; plan controls and policies against Kiro, not legacy Q CLI flags.
• Repository MCP files are an execution path. CVE-2026-12957 let a workspace .amazonq/mcp.json start MCP server commands that inherited the developer's AWS keys. Keep plugins and language servers current and govern MCP centrally.
• Kiro's Supervised mode is not a control. Kiro's own documentation says it is a code review workflow. Trusted Commands use prefix matching without analysing command chains, so keep the list short.
• Short-lived AWS credentials are the real mitigation. Whatever the agent can reach in the developer's environment, an injected prompt can reach too.

How identity and access work in Amazon Q Developer and Kiro

Both products have a personal and an organisational sign-in route. The organisational route is what makes central control possible.

Subscriptions are assigned to IAM Identity Center users or groups. In Kiro, subscribing a group subscribes each member individually, and administrative settings are enforced through a Kiro profile, of which each AWS account can have one per Region. Two Regions matter: the IAM Identity Center Region, where identities and subscriptions live, and the profile Region, where Kiro stores data. Record both for data residency reviews.

Signing in to the product is separate from the AWS credentials the agent uses to act. When a developer asks the agent to deploy or query resources, it runs AWS CLI or SDK calls with whatever profile is in the environment. That is the identity to control. Use IAM Identity Center permission sets and aws sso login sessions instead of IAM user access keys on developer machines, and scope the permission set used for development work away from production. See the AWS IAM Policies and Roles Guide.

Admin roles and privileged access

The privileged surfaces are the IAM Identity Center administrators (who decide who gets a subscription and can change identity sources), the identities holding AmazonQFullAccess, and the Kiro console administrators who set governance policy. In Kiro, governance can be set at organisation level and overridden per account, so an account-level administrator can loosen policy for that account. Use service control policies to stop member accounts changing Kiro or Q settings where your organisation structure allows it, and require phishing-resistant MFA in IAM Identity Center for all of these roles. See the AWS IAM Identity Center Guide.

Integrations, API tokens and service accounts

Kiro governance controls

MCP configuration

• Kiro files: workspace .kiro/settings/mcp.json and user ~/.kiro/settings/mcp.json; the files merge and workspace settings take precedence. An agent definition can carry its own mcpServers and decide with includeMcpJson whether to inherit the others.
• Auto-approval: autoApprove accepts "*" to approve every tool on a server. Avoid it; list specific read-only tools and use disabledTools to hide dangerous ones.
• Secrets: reference secrets as ${VARIABLE_NAME}. Kiro expands only variables listed in the "Mcp Approved Env Vars" setting, which stops a repository file from quietly reading arbitrary environment variables into a server's headers. Keep that list short.
• OAuth: remote servers support an oauth block and Dynamic Client Registration; the IDE supports public clients only, while a clientSecret (confidential client) is CLI only. Prefer OAuth over static bearer tokens in headers.
• Amazon Q plugins: the Amazon Q Developer IDE plugins read .amazonq/mcp.json from the workspace. Before the fixes in the Language Servers for AWS (1.65.0 for the MCP issue, 1.69.0 for both CVEs per the AWS bulletin), opening a malicious repository could start MCP commands with the developer's AWS keys. See the Amazon Q MCP Config Vulnerability 2026 analysis.

Release pipeline and extension integrity

In July 2025, version 1.84.0 of the Amazon Q Developer extension for VS Code shipped with an injected prompt instructing the agent to delete local and cloud resources, after an over-scoped GitHub token in the project's AWS CodeBuild configuration was used to commit it (AWS-2025-015, CVE-2025-8217, fixed in 1.85.0). AWS said the prompt failed to run and no customer resources were affected. The lesson for customers is that the agent's instructions are part of the supply chain: pin and manage extension versions centrally, and limit what the agent's AWS session could delete. See the Amazon Q Developer Extension Compromise 2025 analysis.

Logging and detection

Because local agent calls look like the developer in CloudTrail, the practical control is to make destructive actions impossible from the development permission set rather than to detect them afterwards. See the AWS CloudTrail Guide.

Metrics

• Managed sign-in share: percentage of Q and Kiro users on IAM Identity Center subscriptions rather than Builder ID.
• Static key exposure: number of developer machines with long-lived IAM access keys; target zero.
• MCP policy coverage: accounts with an MCP registry allow-list or MCP disabled.
• Version compliance: percentage of installs on language server and plugin versions at or above the latest security bulletin fix.
• Destructive call denials: denied delete or IAM-modifying calls from development permission sets, reviewed weekly.

Hardening baseline

1. Move users to Pro or Kiro enterprise subscriptions through IAM Identity Center and, for any remaining Free tier use, apply an AWS Organizations AI services opt-out policy.
2. Control sign-in on managed devices with Kiro's managed-settings.json, limiting methods to IAM Identity Center or your connected IdP.
3. Replace IAM user keys with IAM Identity Center sessions; give development permission sets no delete rights on production and no IAM write rights.
4. Restrict models and MCP in the Kiro console: approved models only, an MCP registry allow-list, and web tools off where not needed.
5. Review Trusted Commands: the setting "Kiro Agent: Trusted Commands" uses string-prefix matching and does not analyse command chains or special characters. Never use a bare *; limit entries to read-only commands.
6. Keep protected path confirmation: in the Kiro IDE, writes to .vscode/, .git/, .code-workspace, mcp.json and .kiroignore require confirmation in both modes. In the CLI these protections do not apply in the same way, so isolate CLI work in containers or dedicated accounts.
7. Treat repository agent files as code: require code owner review for .kiro/ (including steering files and MCP settings) and .amazonq/ directories.
8. Manage updates: use Kiro managed updates and central extension deployment so security fixes land quickly and pinned versions cannot drift to a compromised release.
9. Open unknown repositories safely: use workspace trust or a disposable dev container without AWS credentials mounted.

Pilot and rollback: apply the governance policy to one AWS account first using Kiro's account-level override, measure friction (blocked MCP servers, denied commands) for two weeks, then move it to organisation level. Rolling back means relaxing a specific control in the console, never handing developers broader AWS permissions. Small teams without AWS Organizations can still use Pro subscriptions through IAM Identity Center, Identity Center sessions and a reviewed workspace mcp.json with no autoApprove wildcards.

Common misconfigurations

• Builder ID on corporate code: personal sign-in bypasses your directory, offboarding and governance policy, and Free tier content may be used for service improvement.
• Long-lived IAM keys in ~/.aws/credentials: every MCP server and command the agent starts inherits them, which is exactly what made the 2026 MCP configuration flaw serious.
• autoApprove: "*" on remote servers: any tool the server adds later runs without a prompt.
• Trusted Commands with broad prefixes: entries such as npm * or aws * permit chained or destructive variants.
• Relying on Supervised mode: it reviews file edits, not commands or tool calls, and Kiro says it is not a security control.
• Unpinned extensions: automatic updates without central control delivered the compromised 1.84.0 release directly to developers.

Framework mapping

Practitioner checklist

• Inventory Q Developer and Kiro use and move corporate users to IAM Identity Center subscriptions.
• Apply an AI services opt-out policy for any Free tier use in AWS Organizations.
• Limit AmazonQFullAccess and Kiro console administration to a named few with phishing-resistant MFA.
• Remove IAM user access keys from developer machines and use Identity Center sessions with non-production permission sets.
• Set Kiro governance: approved models, MCP registry allow-list, web tools reviewed, API keys off.
• Ban autoApprove: "*" and broad Trusted Commands; keep "Mcp Approved Env Vars" minimal.
• Require code owner review on .kiro/ and .amazonq/ directories.
• Track plugin and language server versions against AWS security bulletins.
• Alert on destructive AWS calls from development permission sets and on invokedBy: q.amazonaws.com activity in sensitive accounts.

Standards and references

• AWS: Amazon Q Developer tiers
• AWS: AWS managed policies for Amazon Q Developer
• AWS: Amazon Q Developer service improvement
• AWS: Logging Amazon Q Developer API calls with CloudTrail
• Kiro: Privacy and security
• Kiro: Enterprise governance
• Kiro: MCP configuration

Related NHI Mgmt Group resources: AI IDE and Coding Agent Security Guide · Coding Agent Configuration File Attacks · Cursor Security Guide · Developer Workstation and IDE Security Guide