kiro-agent-team 1.0.0

package/.kiro/documentation/docs_cli_enterprise_concepts.md

@@ -0,0 +1,34 @@
+# Concepts
+## AWS IAM Identity Center[](https://kiro.dev/docs/cli/enterprise/concepts/#aws-iam-identity-center)
+An AWS service that provides a central place to manage user identities of Kiro subscribers.
+## AWS region[](https://kiro.dev/docs/cli/enterprise/concepts/#aws-region)
+A physical location around the world where AWS clusters its data centers. There are two AWS Regions relevant to Kiro administrators:
+  * The Region where your IAM Identity Center instance is enabled. This is where user identities are managed, and where subscriptions are stored.
+  * The Region where your Kiro profile is created. This is where data is stored, and might be different from your IAM Identity Center instance's Region.
+
+
+For more information about Regions, see [Supported Regions](https://kiro.dev/docs/cli/enterprise/supported-regions).
+## Group[](https://kiro.dev/docs/cli/enterprise/concepts/#group)
+A collection of users within IAM Identity Center. When you subscribe a group to Kiro, the users within it are individually subscribed. (There is no concept of a group subscription.)
+## Kiro console[](https://kiro.dev/docs/cli/enterprise/concepts/#kiro-console)
+A console within the AWS console where you create and manage Kiro subscriptions and control settings. The Kiro console appears as **Kiro** in the drop-down list of AWS services.
+## Kiro credits[](https://kiro.dev/docs/cli/enterprise/concepts/#kiro-credits)
+A unit of consumption that measures usage of Kiro's AI-powered features. Credits are spent when you interact with AI capabilities and are replenished based on your subscription tier.
+## Kiro enterprise user[](https://kiro.dev/docs/cli/enterprise/concepts/#kiro-enterprise-user)
+A user that you have added and subscribed to a Kiro subscription tier through the AWS console, capable of accessing Kiro through IAM Identity Center.
+## Kiro profile[](https://kiro.dev/docs/cli/enterprise/concepts/#kiro-profile)
+The management abstraction that defines and enforces administrative settings and subscriptions to enterprise users in a given AWS account and Region. A Kiro profile corresponds to a combination of an AWS account (management or member) and the Region for that account. This implies that you can only have one profile for each AWS account in a given Region. You set up Kiro profiles through the Kiro console.
+## Kiro subscription tier[](https://kiro.dev/docs/cli/enterprise/concepts/#kiro-subscription-tier)
+A distinctive pricing plan with a predetermined number of Kiro credits.
+Page updated: November 16, 2025
+[IAM](https://kiro.dev/docs/cli/enterprise/iam/)
+[Privacy and security](https://kiro.dev/docs/cli/privacy-and-security/)
+On this page
+  * [AWS IAM Identity Center](https://kiro.dev/docs/cli/enterprise/concepts/#aws-iam-identity-center)
+  * [AWS region](https://kiro.dev/docs/cli/enterprise/concepts/#aws-region)
+  * [Group](https://kiro.dev/docs/cli/enterprise/concepts/#group)
+  * [Kiro console](https://kiro.dev/docs/cli/enterprise/concepts/#kiro-console)
+  * [Kiro credits](https://kiro.dev/docs/cli/enterprise/concepts/#kiro-credits)
+  * [Kiro enterprise user](https://kiro.dev/docs/cli/enterprise/concepts/#kiro-enterprise-user)
+  * [Kiro profile](https://kiro.dev/docs/cli/enterprise/concepts/#kiro-profile)
+  * [Kiro subscription tier](https://kiro.dev/docs/cli/enterprise/concepts/#kiro-subscription-tier)

package/.kiro/documentation/docs_cli_enterprise_getting-started.md

@@ -0,0 +1,19 @@
+# Onboarding quickstart
+## Audience[](https://kiro.dev/docs/cli/enterprise/getting-started/#audience)
+Read this page, and the **Enterprise** section, if you're an administrator who wants to onboard your team to Kiro and manage their subscriptions.
+**Info**
+For detailed onboarding instructions, see [Subscribe your team to Kiro](https://kiro.dev/docs/cli/enterprise/subscribe).
+## To onboard your team to Kiro[](https://kiro.dev/docs/cli/enterprise/getting-started/#to-onboard-your-team-to-kiro)
+  1. **Create an AWS account** if you don't have one already (see [Create an AWS account](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-creating.html)).
+  2. **Sign in to your AWS account**. You can sign in as an AWS root user or as a user with a privileged role. Alternatively, [allow adminitrators to use Kiro with minimum permissions](https://kiro.dev/docs/cli/enterprise/iam/#policy-allow-administrators-to-configure-kiro-and-subscribe-users).
+  3. **Enable AWS IAM Identity Center** in your AWS account. Add users to its directory, or connect it to an external identity provider (IdP). If this is your first time setting up an IAM Identity Center instance, see [Getting started with IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/getting-started.html).
+  4. **Create a Kiro profile and subscribe users**. Within the AWS console, navigate to the Kiro console and use the available UI to create a profile and subscribe users. The profile is the glue that ties your user identities with their Kiro subscriptions and settings. Once your Kiro profile is created and connected, you can import your users and groups and [subscribe your team to Kiro](https://kiro.dev/docs/cli/enterprise/subscribe).
+  5. **Have users check their email**. Within 24 hours of being subscribed, users should receive an email that contains download instructions for the Kiro IDE and Kiro CLI, as well as sign-in instructions.
+
+
+Page updated: November 18, 2025
+[Contacting billing support](https://kiro.dev/docs/cli/billing/contact-support/)
+[Subscribe your team](https://kiro.dev/docs/cli/enterprise/subscribe/)
+On this page
+  * [Audience](https://kiro.dev/docs/cli/enterprise/getting-started/#audience)
+  * [To onboard your team to Kiro](https://kiro.dev/docs/cli/enterprise/getting-started/#to-onboard-your-team-to-kiro)

package/.kiro/documentation/docs_cli_enterprise_iam.md

@@ -0,0 +1,251 @@
+# How Kiro works with identity and access management (IAM)
+To access the Kiro console and perform tasks related to your Kiro subscription, you need permissions provisioned through AWS Identity and Access Management (IAM). AWS IAM is an AWS service that helps an administrator securely control access to AWS resources and is available at no additional charge.
+To enable access, you can create an identity-based policy with the necessary permissions and attach it to the IAM identity that is configuring Kiro subscriptions. For more information, see [Identity-based policies for Kiro](https://kiro.dev/docs/cli/enterprise/iam/#identity-based-policies-for-kiro).
+In addition, Kiro uses AWS IAM service-linked roles. A service-linked role is a unique type of IAM role that is linked directly to Kiro, rather than to an identity, and they are automatically created for you when you subscribe. For more information, see [Service-linked roles for Kiro](https://kiro.dev/docs/cli/enterprise/iam/#service-linked-roles-for-kiro).
+## Identity-based policies for Kiro[](https://kiro.dev/docs/cli/enterprise/iam/#identity-based-policies-for-kiro)
+Identity-based policies are JSON permissions policy documents that you can attach to an identity, such as an IAM user, group of users, or role. These policies control what actions users and roles can perform, on which resources, and under what conditions.
+To subscribe users and configure your subscription, you need the permissions defined in Allow administrators to configure and subscribe to Kiro in the console.
+To learn how to create an identity-based policy, see [Define custom IAM permissions with customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the _AWS IAM User Guide_.
+### Policy: allow administrators to configure Kiro and subscribe users[](https://kiro.dev/docs/cli/enterprise/iam/#policy-allow-administrators-to-configure-kiro-and-subscribe-users)
+The following example policy grants permissions to perform actions in the Kiro console. The Kiro console is where you subscribe users to Kiro, configure Kiro’s integration with AWS IAM Identity Center and AWS Organizations, and manage subscription settings. This policy also includes permissions to create and configure customer managed KMS keys.
+Show policy
+json
+```
+
+{
+  "Version":"2012-10-17",                   
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "sso:ListInstances",
+        "sso:CreateInstance",
+        "sso:CreateApplication",
+        "sso:PutApplicationAuthenticationMethod",
+        "sso:PutApplicationGrant",
+        "sso:PutApplicationAssignmentConfiguration",
+        "sso:ListApplications",
+        "sso:GetSharedSsoConfiguration",
+        "sso:DescribeInstance",
+        "sso:PutApplicationAccessScope",
+        "sso:DescribeApplication",
+        "sso:DeleteApplication",
+        "sso:CreateApplicationAssignment",
+        "sso:DeleteApplicationAssignment",
+        "sso:UpdateApplication",
+        "sso:DescribeRegisteredRegions",
+        "sso:GetSSOStatus"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "iam:ListRoles"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "identitystore:DescribeUser"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "sso-directory:GetUserPoolInfo",
+        "sso-directory:DescribeUser",
+        "sso-directory:DescribeUsers",
+        "sso-directory:DescribeGroups",
+        "sso-directory:SearchGroups",
+        "sso-directory:SearchUsers",
+        "sso-directory:DescribeDirectory"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "signin:ListTrustedIdentityPropagationApplicationsForConsole",
+        "signin:CreateTrustedIdentityPropagationApplicationForConsole"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "user-subscriptions:ListClaims",
+        "user-subscriptions:ListApplicationClaims",
+        "user-subscriptions:ListUserSubscriptions",
+        "user-subscriptions:CreateClaim",
+        "user-subscriptions:DeleteClaim",
+        "user-subscriptions:UpdateClaim",
+        "user-subscriptions:SetOverageConfig"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "organizations:DescribeAccount",
+        "organizations:DescribeOrganization",
+        "organizations:ListAWSServiceAccessForOrganization",
+        "organizations:DisableAWSServiceAccess",
+        "organizations:EnableAWSServiceAccess"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "kms:ListAliases",
+        "kms:CreateGrant",
+        "kms:Encrypt",
+        "kms:Decrypt",
+        "kms:GenerateDataKey*",
+        "kms:RetireGrant",
+        "kms:DescribeKey"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "codeguru-security:UpdateAccountConfiguration"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "iam:CreateServiceLinkedRole"
+      ],
+      "Resource": [
+        "arn:aws:iam::*:role/aws-service-role/q.amazonaws.com/AWSServiceRoleForAmazonQDeveloper"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "codewhisperer:UpdateProfile",
+        "codewhisperer:ListProfiles",
+        "codewhisperer:TagResource",
+        "codewhisperer:UnTagResource",
+        "codewhisperer:ListTagsForResource",
+        "codewhisperer:CreateProfile"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "q:ListDashboardMetrics", 
+        "q:CreateAssignment", 
+        "q:DeleteAssignment",
+        "q:UpdateAssignment"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "cloudwatch:GetMetricData", 
+        "cloudwatch:ListMetrics"
+      ],
+      "Resource": [
+        "*"
+      ]
+    }
+  ]
+}
+
+
+```
+
+## Service-linked roles for Kiro[](https://kiro.dev/docs/cli/enterprise/iam/#service-linked-roles-for-kiro)
+A service-linked role is a unique type of IAM role that is linked directly to Kiro. Service-linked roles are predefined by AWS and include all the permissions that Kiro requires to call other AWS services on your behalf.
+A service-linked role makes setting up Kiro easier because you don’t have to manually add the necessary permissions. Kiro defines the permissions of its service-linked roles, and unless defined otherwise, only Kiro can assume its roles. The defined permissions include the trust policy and the permissions policy, and that permissions policy cannot be attached to any other IAM entity.
+You can delete a service-linked role only after first deleting their related resources. This protects your Kiro resources because you can't inadvertently remove permission to access the resources. For more information about service-linked roles, see the [AWS IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html#id_roles_terms-and-concepts).
+There are two service-linked roles that will be created for you when you subscribe with Kiro enterprise:
+  * [AWSServiceRoleForUserSubscriptions](https://kiro.dev/docs/cli/enterprise/iam/#service-linked-role-awsserviceroleforusersubscriptions)
+  * [AWSServiceRoleForAmazonQDeveloper](https://kiro.dev/docs/cli/enterprise/iam/#service-linked-role-awsserviceroleforamazonqdeveloper)
+
+
+### Service-linked role: AWSServiceRoleForUserSubscriptions[](https://kiro.dev/docs/cli/enterprise/iam/#service-linked-role-awsserviceroleforusersubscriptions)
+Kiro uses the service-linked role named **AWSServiceRoleForUserSubscriptions**. This role grants permissions for Kiro to access your IAM Identity Center resources in order to automatically update your subscriptions.
+The AWSServiceRoleForUserSubscriptions service-linked role trusts the following services to assume the role:
+  * `user-subscriptions.amazonaws.com`
+
+
+The role permissions policy named AWSServiceRoleForUserSubscriptions allows Kiro to complete the following actions on the specified resources:
+  * Action: `identitystore:DescribeGroup` on `*`
+  * Action: `identitystore:DescribeUser` on `*`
+  * Action: `identitystore:IsMemberInGroups` on `*`
+  * Action: `identitystore:ListGroupMemberships` on `*`
+  * Action: `organizations:DescribeOrganization` on `*`
+  * Action: `sso:DescribeApplication` on `*`
+  * Action: `sso:DescribeInstance` on `*`
+  * Action: `sso:ListInstances` on `*`
+  * Action: `sso-directory:DescribeUser` on `*`
+
+
+You must configure permissions to allow your users, groups, or roles to create, edit, or delete a service-linked role. For more information, see [Service-linked role permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create-service-linked-role.html#service-linked-role-permissions) in the _AWS IAM User Guide_.
+### Service-linked role: AWSServiceRoleForAmazonQDeveloper[](https://kiro.dev/docs/cli/enterprise/iam/#service-linked-role-awsserviceroleforamazonqdeveloper)
+Kiro uses the service-linked role named **AWSServiceRoleForAmazonQDeveloper**. This role grants permissions for Kiro to access data in your account to calculate billing, provides access to create and access security reports in Amazon CodeGuru, and emit data to CloudWatch.
+The AWSServiceRoleForAmazonQDeveloper service-linked role trusts the following services to assume the role:
+  * `q.amazonaws.com`
+
+
+The role permissions policy named AWSServiceRoleForAmazonQDeveloper allows Kiro to complete the following actions on the specified resources:
+  * Action: `cloudwatch:PutMetricData` on `AWS/Q CloudWatch namespace`
+
+
+You must configure permissions to allow your users, groups, or roles to create, edit, or delete a service-linked role. For more information, see [Service-linked role permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create-service-linked-role.html#service-linked-role-permissions) in the _AWS IAM User Guide_.
+### Managing service-linked roles[](https://kiro.dev/docs/cli/enterprise/iam/#managing-service-linked-roles)
+You don't need to manually create a service-linked role. When you create a profile for Kiro in the AWS Management Console, Kiro creates the service-linked role for you. If you delete this service-linked role, and then need to create it again, you can use the same process to recreate the role in your account.
+You can also use the IAM console or AWS CLI to create a service-linked role with the `q.amazonaws.com` service name. For more information, see [Creating a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role) in the _AWS IAM User Guide_. If you delete this service-linked role, you can use the same process to create the role again.
+Kiro does not allow you to edit the AWSServiceRoleForUserSubscriptions or AWSServiceRoleForAmazonQDeveloper service-linked roles. After you create a service-linked role, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the _AWS IAM User Guide_.
+If you no longer need to use a feature or service that requires a service-linked role, we recommend that you delete that role. That way you don’t have an unused entity that is not actively monitored or maintained. However, you must clean up the resources for your service-linked role before you can manually delete it. Use the IAM console, the AWS CLI, or the AWS API to delete the service-linked roles. For more information, see [Deleting a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the _AWS IAM User Guide_.
+**Info**
+Note: If Kiro is using the role when you try to delete the resources, then the deletion might fail. If that happens, wait for a few minutes and try the operation again.
+### Supported regions for Kiro service-linked roles[](https://kiro.dev/docs/cli/enterprise/iam/#supported-regions-for-kiro-service-linked-roles)
+You can use the AWSServiceRoleForUserSubscriptions and AWSServiceRoleForAmazonQDeveloper roles in the following AWS Regions. For more information on Regions, see [AWS Regions and endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the _AWS General Reference_.
+Region name | Region identity  
+---|---  
+US East (N. Virginia) | us-east-1  
+Europe (Frankfurt) | eu-central-1  
+Page updated: December 11, 2025
+[Billing](https://kiro.dev/docs/cli/enterprise/billing/)
+[Concepts](https://kiro.dev/docs/cli/enterprise/concepts/)
+On this page
+  * [Identity-based policies for Kiro](https://kiro.dev/docs/cli/enterprise/iam/#identity-based-policies-for-kiro)
+  * [Policy: allow administrators to configure Kiro and subscribe users](https://kiro.dev/docs/cli/enterprise/iam/#policy-allow-administrators-to-configure-kiro-and-subscribe-users)
+  * [Service-linked roles for Kiro](https://kiro.dev/docs/cli/enterprise/iam/#service-linked-roles-for-kiro)
+  * [Service-linked role: AWSServiceRoleForUserSubscriptions](https://kiro.dev/docs/cli/enterprise/iam/#service-linked-role-awsserviceroleforusersubscriptions)
+  * [Service-linked role: AWSServiceRoleForAmazonQDeveloper](https://kiro.dev/docs/cli/enterprise/iam/#service-linked-role-awsserviceroleforamazonqdeveloper)
+  * [Managing service-linked roles](https://kiro.dev/docs/cli/enterprise/iam/#managing-service-linked-roles)
+  * [Supported regions for Kiro service-linked roles](https://kiro.dev/docs/cli/enterprise/iam/#supported-regions-for-kiro-service-linked-roles)

package/.kiro/documentation/docs_cli_enterprise_monitor-and-track.md

@@ -0,0 +1,15 @@
+# Monitoring and tracking
+Monitoring is an important part of maintaining the reliability, availability, and performance of Kiro and your other AWS solutions. Kiro includes the following features to help you track and record user activity:
+  * _A dashboard_ shows you aggregate user activity metrics of Kiro subscribers. For more information, see [Viewing Kiro usage on the dashboard](https://kiro.dev/docs/cli/enterprise/monitor-and-track/dashboard).
+  * _User activity reports_ show you what individual users are up to in Kiro. For more information, see [Viewing per-user activity](https://kiro.dev/docs/cli/enterprise/monitor-and-track/user-activity).
+  * _Prompt logs_ provide you with a record of all the prompts that users enter into the Kiro chat in their integrated development environment (IDE). For more information, see [Logging users' prompts](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging).
+
+
+AWS also provides the following tools and features to monitor and record Kiro activity:
+  * _AWS CloudTrail_ captures API calls and related events made by or on behalf of your AWS account and delivers the log files to an Amazon Simple Storage Service (Amazon S3) bucket that you specify. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred.
+  * _Amazon CloudWatch_ monitors your AWS resources and the applications you run on AWS in real time. You can collect and track metrics, create customized dashboards, and set alarms that notify you or take actions when a specified metric reaches a threshold that you specify. For example, you can have CloudWatch track the number of times that Kiro has been invoked on your account, or the number of daily active users.
+
+
+Page updated: November 14, 2025
+[Supported regions](https://kiro.dev/docs/cli/enterprise/supported-regions/)
+[View usage (dashboard)](https://kiro.dev/docs/cli/enterprise/monitor-and-track/dashboard/)

package/.kiro/documentation/docs_cli_enterprise_monitor-and-track_dashboard.md

@@ -0,0 +1,62 @@
+# Viewing Kiro usage on the dashboard
+Available only for Kiro admins, the Kiro dashboard summarizes useful data about how your subscribers use the Kiro IDE and Kiro CLI.
+Kiro generates and displays new metrics on an hourly basis for the most part. The only section that is not updated hourly is the **Active users** widget, which is updated daily according to the coordinated universal time (UTC) clock.
+## View the dashboard[](https://kiro.dev/docs/cli/enterprise/monitor-and-track/dashboard/#view-the-dashboard)
+  1. Sign in to the AWS Management Console.
+  2. Switch to the Kiro console.
+  3. From the navigation pane, choose **Dashboard**.
+  4. (Optional) Filter the information by date range or programming language.
+
+
+**Info**
+  * If the **Dashboard** link is not available in the navigation pane, see [Troubleshoot the dashboard](https://kiro.dev/docs/cli/enterprise/monitor-and-track/dashboard/#troubleshoot-the-dashboard).
+  * If you'd like to send user metrics to a daily report with a per-user breakdown of their Kiro usage, see [View per-user activity in Kiro](https://kiro.dev/docs/cli/enterprise/monitor-and-track/user-activity).
+  * For information about specific metrics, see [Dashboard metrics](https://kiro.dev/docs/cli/enterprise/monitor-and-track/dashboard/#dashboard-metrics) or choose the help link at the top-right of the dashboard page.
+
+
+## Disable the dashboard[](https://kiro.dev/docs/cli/enterprise/monitor-and-track/dashboard/#disable-the-dashboard)
+You might want to disable the Kiro dashboard if you have concerns about data privacy, page load times, or other potential issues. When you disable the dashboard, the dashboard page (and any links to it) will no longer be available in the Kiro console.
+For more information about the dashboard, see [viewing usage metrics (dashboard)](https://kiro.dev/docs/enterprise/monitor-and-track/dashboard/#dashboard-metrics).
+#### To disable the dashboard[](https://kiro.dev/docs/cli/enterprise/monitor-and-track/dashboard/#to-disable-the-dashboard)
+  1. Sign in to the AWS Management Console.
+  2. Switch to the Kiro console.
+  3. Choose **Settings** , and in the **Kiro Settings** section, disable **Kiro usage dashboard**.
+
+
+## Troubleshoot the dashboard[](https://kiro.dev/docs/cli/enterprise/monitor-and-track/dashboard/#troubleshoot-the-dashboard)
+If the Kiro dashboard page is not available, do the following:
+  * **Verify your permissions**. To view the dashboard, you need the following permissions:
+    * `q:ListDashboardMetrics`
+    * `codewhisperer:ListProfiles`
+    * `sso:ListInstances`
+    * `user-subscriptions:ListUserSubscriptions`
+For more information about permissions, see [Policy: Allow administrators to configure Kiro and subscribe users](https://kiro.dev/docs/cli/enterprise/iam/#policy-allow-administrators-to-configure-kiro-and-subscribe-users).
+  * **Verify your settings**. In the Kiro console, choose **Settings** and make sure that the **Kiro usage dashboard** toggle is enabled.
+
+
+## Dashboard metrics[](https://kiro.dev/docs/cli/enterprise/monitor-and-track/dashboard/#dashboard-metrics)
+The following table describes the metrics shown in the Kiro dashboard.
+Metric name | Description  
+---|---  
+**Total subscriptions per tier** | Shows the total subscriptions broken down by subscription tier (Pro, Pro+, Power). Displays both per-group breakdown and total counts across all groups in the current AWS account, as well as subscriptions in member accounts if you're signed in to a management account for which organization-wide visibility of subscriptions has been enabled.  
+**Active subscriptions per tier** | Shows the total active subscriptions broken down by subscription tier (Pro, Pro+, Power).  
+  
+_Active subscriptions_ are those belonging to users who have started using Kiro in their integrated development environment (IDE) or CLI. You are being charged for these subscriptions. For more information about active subscriptions, see [Subscription statuses](https://kiro.dev/docs/cli/enterprise/subscription-management#subscription-statuses).  
+**Pending subscriptions per tier** | Shows the total pending subscriptions broken down by subscription tier (Pro, Pro+, Power).  
+  
+_Pending subscriptions_ are those belonging to users who have not yet started using Kiro. You are not being charged for these subscriptions. For more information about pending subscriptions, see [Subscription statuses](https://kiro.dev/docs/cli/enterprise/subscription-management#subscription-statuses).  
+**Active users** | Shows the number of unique users actively utilizing Kiro on a daily, weekly, and monthly basis. Includes breakdowns by:  
+- **Client type** (IDE vs. CLI)  
+- **Subscription tier** (Pro, Pro+, Power)  
+**Credits consumed** | Shows total Kiro credits consumed with time-based views (daily, weekly, monthly). Includes breakdowns by:  
+- **Subscription tier** (Pro, Pro+, Power)  
+- **Client type** (IDE vs. CLI)  
+Page updated: November 26, 2025
+[Monitor and track](https://kiro.dev/docs/cli/enterprise/monitor-and-track/)
+[View per-user activity](https://kiro.dev/docs/cli/enterprise/monitor-and-track/user-activity/)
+On this page
+  * [View the dashboard](https://kiro.dev/docs/cli/enterprise/monitor-and-track/dashboard/#view-the-dashboard)
+  * [Disable the dashboard](https://kiro.dev/docs/cli/enterprise/monitor-and-track/dashboard/#disable-the-dashboard)
+  * [To disable the dashboard](https://kiro.dev/docs/cli/enterprise/monitor-and-track/dashboard/#to-disable-the-dashboard)
+  * [Troubleshoot the dashboard](https://kiro.dev/docs/cli/enterprise/monitor-and-track/dashboard/#troubleshoot-the-dashboard)
+  * [Dashboard metrics](https://kiro.dev/docs/cli/enterprise/monitor-and-track/dashboard/#dashboard-metrics)

package/.kiro/documentation/docs_cli_enterprise_monitor-and-track_prompt-logging.md

@@ -0,0 +1,165 @@
+# Logging user prompts
+Kiro admins can enable the logging of all inline suggestions and chat conversations that users have in the Kiro IDE. These logs can help with auditing, debugging, analytics, and ensuring compliance.
+## About prompt logs[](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#about-prompt-logs)
+With prompt logging enabled, Kiro will log both the user prompts and Kiro's responses. Kiro stores the logs in an Amazon S3 bucket of your choice in your own account. For examples and explanations of log file contents, see [prompt log examples](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#prompt-log-examples).
+There is no charge for the prompt logging feature other than the storage cost of the Amazon S3 bucket used to hold the logs, and a small fee for the optional KMS key used to encrypt the bucket.
+## Enabling prompt logging[](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#enabling-prompt-logging)
+### Prerequisites[](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#prerequisites)
+  * Create an Amazon S3 bucket to hold the prompt logs. The bucket must:
+    * Be in the AWS Region where the Kiro profile was installed. This profile was installed when you subscribed users to Kiro Pro for the first time. For more information about this profile and the Regions where it's supported, see [Concepts](https://kiro.dev/docs/cli/enterprise/concepts) and [Supported Regions](https://kiro.dev/docs/cli/enterprise/subscription-management/supported-regions).
+    * Be in the AWS account where users are subscribed.
+    * Have a bucket policy like the one that follows. Replace `bucketName`, `Region`, `accountId`, and `prefix` with your own information.
+
+
+json
+```
+
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "KiroLogsWrite",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "q.amazonaws.com"
+      },
+      "Action": [
+        "s3:PutObject"
+      ],
+      "Resource": [
+        "arn:aws:s3:::bucketName/prefix/*"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "aws:SourceAccount": "111122223333"
+        },
+        "ArnLike": {
+          "aws:SourceArn": "arn:aws:codewhisperer:us-east-1:111122223333:*"
+        }
+      }
+    }
+  ]
+}
+
+
+```
+
+To learn about protecting the data in your Amazon S3 bucket, see [Protecting data with encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingEncryption.html) in the _Amazon Simple Storage Service User Guide_.
+### To enable prompt logging[](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#to-enable-prompt-logging)
+  1. Open the Kiro console.
+  2. Choose **Settings**.
+  3. Look for **Kiro Settings > Logging**.
+  4. Toggle the switch for **Log Kiro prompts with metadata**.
+  5. Under Amazon S3 location, enter the Amazon S3 URI that you will use to receive the logs. Example: `s3://amzn-s3-demo-bucket/kiro-prompt-logs/`
+
+
+## Prompt log examples[](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#prompt-log-examples)
+This section provides examples of prompt logs generated by Kiro.
+Following each example is a table that describes the log file's fields.
+### Inline suggestions log example[](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#inline-suggestions-log-example)
+The following example shows a log file that is generated when a user accepts an inline suggestion.
+json
+```
+
+{
+  "records": [
+    {
+      "generateCompletionsEventRequest": {
+        "leftContext": "import * cdk from 'aws-cdk-lib';\r\nimport * s3 from 'aws-cdk-lib/aws-s3';\r\nimport { Stack, StackProps } from 'constructs';\r\nexport class MyStack extends Stack {\r\n  constructor(scope: cdk.App, id: string, props?: StackProps) {\r\n    super(scope, id, props);\r\n\r\n    new s3.Bucket(this, 'XXXXXXXX', {\r\n      versioned: true\r\n    });\r\n  }\r\n ",
+        "rightContext": "",
+        "fileName": "cdk-modified.ts",
+        "customizationArn": null,
+        "userId": "d-92675051d5.b8f1f340-9081-70ad-5fc5-0f37151937a6",
+        "timeStamp": "2025-01-06T15:09:16.412719Z"
+      },
+      "generateCompletionsEventResponse": {
+        "completions": ["synth() {\n    return cdk.App.prototype.synth.apply(this, arguments);\n  }"],
+        "requestId": "797c70ee-abc9-4cc7-a148-b9df17f6ce48"
+      }
+    }
+  ]
+}
+
+
+```
+
+The following table describes the fields in the log file for inline suggestions.
+Field name | Description  
+---|---  
+`records` | Top-level field that contains a set of inline suggestions, also known as inline completions.  
+`generateCompletionsEventRequest` | Describes the request for an inline code suggestion. The request is made by Kiro, on behalf of the user.  
+`leftContext` | Indicates the code before the cursor that Kiro is using for context to generate an inline suggestion.  
+`rightContext` | Indicates the code after the cursor that Kiro is using for context to generate an inline suggestion.  
+`fileName` | Indicates the name of the file in which an inline suggestion was requested.  
+`userId` | Indicates the user ID of the user who requested an inline suggestion.  
+`timeStamp` | Indicates the date and time that the inline suggestion was requested. The timestamp is in Coordinated Universal Time (UTC).  
+`generateCompletionsEventResponse` | Describes the inline suggestion generated by Kiro.  
+`completions` | Indicates the inline suggestion that Kiro provided and that the user accepted.  
+`requestId` | The ID of the inline request that uniquely identifies the event.  
+### Chat log example[](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#chat-log-example)
+The following example shows a log file that is generated when a user chats using Kiro in their IDE.
+json
+```
+
+{
+  "records": [
+    {
+      "generateAssistantResponseEventRequest": {
+        "prompt": "Can you explain how to set up object-level access control in an S3 bucket using AWS CDK?",
+        "chatTriggerType": "MANUAL",
+        "customizationArn": null,
+        "userId": "d-92675051d5.b8f1f340-9081-70ad-5fc5-0f37151937a6",
+        "timeStamp": "2025-01-06T15:05:56.313070Z"
+      },
+      "generateAssistantResponseEventResponse": {
+        "assistantResponse": "I'll explain how to set up object-level access control for an S3 bucket using AWS CDK...",
+        "followupPrompts": "How can you implement multi-factor authentication for S3 bucket access using AWS CDK?",
+        "messageMetadata": {
+          "conversationId": "491bd3cd-d70d-40c0-a452-5ef3f0878422",
+          "utteranceId": null
+        },
+        "codeReferenceEvents": [],
+        "supplementaryWebLinksEvent": [
+          {
+            "uri": "https://docs.aws.amazon.com/AmazonS3/latest/API/s3_example_s3_Scenario_ManageACLs_section.html",
+            "title": "[1] Manage access control lists (ACLs) for Amazon S3 buckets using an AWS SDK",
+            "snippet": "The following code example shows how to manage access control lists (ACLs) for Amazon S3 buckets..."
+          }
+        ],
+        "requestId": "dad38fc0-815c-45f7-970a-db916cb7f131"
+      }
+    }
+  ]
+}
+
+
+```
+
+Field name | Description  
+---|---  
+`records` | Top-level field that contains a set of prompts and responses.  
+`generateAssistantResponseEventRequest` | Describes the prompt entered by the user in the chat window in their IDE.  
+`prompt` | Indicates the prompt the user entered into the chat window.  
+`chatTriggerType` |  `MANUAL` indicates that the user entered a prompt into the chat window, or clicked on one of the suggested questions in the chat window. `INLINE_CHAT` indicates that the user entered a prompt into the small input screen in the main coding window.  
+`userId` | Indicates the user ID of the user who entered the prompt.  
+`timeStamp` | Indicates the date and time that the user entered the prompt. The timestamp is in universal time (UTC).  
+`generateAssistantResponseEventResponse` | Describes the response generated by Kiro.  
+`assistantResponse` | Indicates the response that Kiro provided to the user's prompt.  
+`followupPrompts` | Indicates the follow-up example prompts that were displayed to the user at the end of the response.  
+`messageMetadata` | Describes metadata associated with the response.  
+`conversationId` | Indicates the conversation ID of the response. The conversation ID groups together messages in a chat session.  
+`utteranceId` | Indicates the utterance ID of the response. An utterance ID is a label that distinguishes one prompt from another within a dialogue or data set.  
+`codeReferenceEvents` | Describes links to code references included in the response.  
+`supplementaryWebLinksEvent` | Indicates the links that were displayed to the user at the end of the response.  
+`requestId` | The ID of the response that uniquely identifies the event.  
+Page updated: December 16, 2025
+[View per-user activity](https://kiro.dev/docs/cli/enterprise/monitor-and-track/user-activity/)
+[Settings](https://kiro.dev/docs/cli/enterprise/settings/)
+On this page
+  * [About prompt logs](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#about-prompt-logs)
+  * [Enabling prompt logging](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#enabling-prompt-logging)
+  * [Prerequisites](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#prerequisites)
+  * [To enable prompt logging](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#to-enable-prompt-logging)
+  * [Prompt log examples](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#prompt-log-examples)
+  * [Inline suggestions log example](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#inline-suggestions-log-example)
+  * [Chat log example](https://kiro.dev/docs/cli/enterprise/monitor-and-track/prompt-logging/#chat-log-example)