Kiro achieves FedRAMP High and DoD IL-4/5 authorization in AWS GovCloud (US)
Federal agencies and DoD programs can now use Kiro's agentic AI coding platform for sensitive workloads—compliantly, inside GovCloud.
View original announcement →Visual Summary
graph TD
A{{Kiro in AWS GovCloud}}:::announced
B((Federal Developers)):::external
C(Amazon Bedrock):::compute
D([Spec-Driven Development]):::feature
E([FedRAMP High / DoD IL-4/5]):::feature
F(Claude Sonnet 4.5):::compute
G([MCP Integration]):::feature
H([Data Isolation]):::feature
I(AWS IAM / SSO):::compute
B ==>|"authenticates"| I
I ==>|"grants access"| A
A -->|"generates specs"| D
A -->|"invokes inference"| C
C -->|"runs model"| F
A -.->|"connects resources"| G
A -->|"enforces"| E
A -->|"ensures"| H
classDef announced fill:#ff9900,stroke:#ec7211,color:#fff,font-weight:bold
classDef compute fill:#e3f2fd,stroke:#1565c0,color:#1565c0
classDef storage fill:#e8f5e9,stroke:#2e7d32,color:#2e7d32
classDef feature fill:#fff3e0,stroke:#e65100,color:#e65100
classDef external fill:#f5f5f5,stroke:#616161,color:#616161
What's New
Kiro, AWS's agentic AI development platform combining an IDE and CLI, has achieved FedRAMP High and DoD Cloud Computing Security Requirements Guide (CC SRG) Impact Level 4 and 5 authorization within AWS GovCloud (US) Regions. This makes Kiro available to federal agencies, defense organizations, and public sector enterprises that handle sensitive and classified workloads requiring the highest levels of cloud security compliance. Organizations can now leverage Kiro's spec-driven, agentic engineering capabilities for mission-critical software development without compromising their regulatory obligations.
How It Works
- Spec-driven development: Kiro transforms natural language prompts into structured requirements, architectural designs, and sequenced implementation tasks, then generates working code, documentation, and tests from those specs.
- Agentic IDE and CLI: Developers interact through a standalone IDE or command-line interface; in GovCloud, VS Code plugin and inline suggestions are disabled, and the Autonomous Agent mode is not available.
- Foundation model: Claude Sonnet 4.5 is the default (and currently only) foundation model in AWS GovCloud (US); automated model selection (Auto mode) is disabled at launch.
- Cross-Region Inference (CRIS): Customers in AWS GovCloud (US-East) have inference requests processed via Amazon Bedrock in AWS GovCloud (US-West), while content remains stored in the region where the Kiro profile was created; all cross-region traffic is encrypted with TLS 1.2+.
- MCP integration: Native Model Context Protocol support allows Kiro to connect to documentation, databases, APIs, and other enterprise resources to support complex development workflows.
- Data isolation: Content collection for service improvement (prompts, responses, generated code) is disabled in GovCloud; user activity metrics and S3 reporting are also unavailable, and enterprise admins cannot enable telemetry.
- Authentication: Social provider and AWS Builder ID logins are not available; authentication relies on IAM and SSO mechanisms appropriate for GovCloud environments.
- Hooks and automation: Developers can automate repetitive workflows via event-triggered hooks that generate documentation and unit tests in the background.
Why It's Important
- Unlocks AI-assisted development for the most sensitive workloads: FedRAMP High and DoD IL-4/5 are the highest civilian and defense compliance tiers, meaning agencies handling Controlled Unclassified Information (CUI) and even some classified data can now use agentic AI coding tools legally and safely.
- Reduces the compliance barrier for AI adoption in government: Previously, federal developers had limited access to modern AI coding assistants due to data residency and authorization requirements; Kiro's authorization removes that blocker.
- Accelerates mission-critical software delivery: Government development teams can leverage spec-driven automation to move faster from requirements to production-ready code, directly impacting program timelines.
- Maintains data sovereignty: All content stays within AWS GovCloud (US) boundaries, with telemetry and data-sharing features disabled, giving agencies full control over sensitive information.
- Signals broader AWS commitment to GovCloud AI parity: Kiro's rapid authorization demonstrates AWS's intent to bring cutting-edge AI/ML developer tooling to regulated sectors at pace with commercial availability.
How It's Different
- Spec-driven vs. prompt-driven: Unlike most AI coding assistants that respond to ad hoc prompts, Kiro produces structured specifications, architectural plans, and task sequences before writing code, reducing ambiguity and rework.
- Property-based testing: Kiro uses automated reasoning and property-based (fuzz-style) tests to validate code correctness beyond what unit tests cover, catching edge cases that pass standard test suites but fail in production.
- Parallel agents: Kiro can deploy multiple agents working concurrently across a large codebase, enabling faster implementation of complex features compared to single-threaded AI assistants.
- GovCloud-native with deliberate feature scoping: Rather than a simple lift-and-shift, Kiro's GovCloud variant explicitly disables features (telemetry, social login, inline suggestions) that could create data leakage risks, making the compliance posture transparent and auditable.
- Enterprise governance built-in: IAM/SSO authentication, usage dashboards, cost controls, IP indemnity, and administration controls are first-class features, not afterthoughts, distinguishing it from developer-focused tools that lack enterprise governance.
- Open standards compatibility: Kiro supports Agent Client Protocol (ACP), MCP, AGENTS.md, Open VSX extensions, and standard shells, avoiding vendor lock-in compared to proprietary AI IDE ecosystems.
When to Prefer It
- Federal civilian agencies handling CUI or high-impact systems: Any agency operating under FedRAMP High requirements for systems processing sensitive but unclassified data should consider Kiro as their compliant AI development platform.
- DoD programs at IL-4 or IL-5: Defense contractors and military program offices developing software for systems that process Controlled Unclassified Information or mission-critical DoD data can use Kiro without additional authorization overhead.
- Large-scale government software modernization projects: When migrating legacy systems or building new platforms with complex requirements, Kiro's spec-driven approach helps ensure requirements traceability and architectural consistency.
- Teams requiring strict data residency and no telemetry: Organizations that cannot allow any code, prompts, or responses to leave their authorized boundary will benefit from Kiro's disabled data-collection posture in GovCloud.
- CI/CD pipelines in classified or sensitive environments: The CLI mode enables headless, automated use in pipelines where an interactive IDE is impractical, such as automated code review or bug-fix workflows in secure build environments.
- Development teams needing MCP-connected enterprise context: When developers need to pull context from internal documentation, databases, or APIs during code generation, Kiro's native MCP support provides that integration within the GovCloud boundary.
Availability
- Authorization status: Generally Available (GA) with FedRAMP High and DoD CC SRG IL-4 and IL-5 authorizations as of June 25, 2026.
- Supported regions: AWS GovCloud (US-West) (us-gov-west-1) and AWS GovCloud (US-East) (us-gov-east-1); inference for US-East customers is processed in US-West via CRIS.
- Default model: Claude Sonnet 4.5; automated model selection (Auto) is disabled at launch in GovCloud.
- Pricing: Not explicitly stated in the announcement; contact your AWS account team for GovCloud-specific pricing details.
- Feature limitations in GovCloud: VS Code plugin, inline suggestions, Autonomous Agent mode, social/Builder ID login, telemetry, user activity metrics, S3 reporting, and automated model selection are all unavailable.
- Access method: Standalone IDE or CLI only; no VS Code plugin integration in GovCloud.
- Documentation: Available at the AWS GovCloud User Guide (https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-kiro.html) and the Kiro product page (https://kiro.dev/).
