security
May 5, 2026
By Teun
AWS blog outlines five security uses for Kiro and Amazon Q
AWS says Kiro and Amazon Q Developer can help security teams scan resources, draft policies, and research CVEs faster. The blog post walks through five workflows based on the AWS Well-Architected Framework Security Pillar, including persistent context, finding triage, infrastructure remediation, security reviews, and service control policies.
AWS has published a guide showing five ways security teams can use Kiro and Amazon Q Developer to improve their AWS security posture. The Monday-morning use case is simple: when alerts pile up for unauthorized access attempts, security group mistakes, or IAM policy violations, teams need answers quickly. According to AWS, these tools can take on repetitive work such as scanning resources, drafting policies, and looking up Common Vulnerabilities and Exposures, or CVEs, so engineers can spend more time on risk decisions and complex cases that still require human judgment.
The post says the techniques are based on the AWS Well-Architected Framework Security Pillar. AWS also frames Kiro and Amazon Q Developer as complementary tools: Kiro is its agentic IDE for specification-driven development, while Amazon Q Developer is the assistant built into AWS development and cloud environments.
The first technique is persistent context. AWS says teams can store their security standards in rules files for Amazon Q Developer or steering files for Kiro so the assistant applies the same requirements in every interaction. That means developers do not have to repeat basics like encryption, least-privilege IAM, and logging in each prompt.
AWS says this makes generated infrastructure more consistent. In its example, a Lambda function prompt that might otherwise produce a basic deployment could instead include KMS-encrypted environment variables, CloudWatch log retention, a dead-letter queue, AWS X-Ray tracing, and private subnet placement when the assistant has the right context.
The second technique is finding triage and investigation. AWS Security Hub already centralizes findings from services such as GuardDuty, AWS Config, Amazon Inspector, and third-party tools. According to AWS, Kiro can then help teams query findings across multiple accounts and Regions, understand CVEs, generate investigation queries for CloudTrail and VPC Flow Logs, and correlate events across time and services.
AWS says this works through Model Context Protocol, or MCP, which is a standard for connecting AI assistants to outside tools and data sources. The company recommends setting up security-focused MCP servers such as AWS API, CloudTrail, AWS IAM, and AWS Knowledge so Kiro can interact with live AWS security data. AWS also notes that valid credentials for the target account are required before querying Security Hub.
The third technique is remediation of infrastructure as code. AWS says Kiro or Amazon Q Developer can scan CloudFormation, Terraform, or AWS CDK files and suggest fixes for security gaps. Examples from the post include encryption at rest, encryption in transit, public access blocks, and least-privilege IAM updates.
AWS is explicit that human review is still required. The company says AI-generated remediation should be reviewed by a qualified security engineer, tested in non-production, and validated with services such as IAM Access Analyzer, AWS Config, and Security Hub before production rollout.
The fourth technique is deeper security review. AWS says both tools can examine infrastructure code and flag problems across identity and access management, detective controls, infrastructure protection, data protection, and incident response. In Amazon Q Developer, users can select code and choose security-focused review options. In Kiro, users can ask for a comprehensive review in natural language, with steering files applied automatically.
AWS says these reviews can catch issues earlier in the development cycle, before code reaches CI/CD checks. The post also recommends keeping steering files and rules documents up to date as security standards change.
The fifth technique is service control policy, or SCP, development. AWS Organizations SCPs set preventive rules across accounts, and AWS says Kiro can draft initial policies from natural language requirements. Because SCPs can block actions at the organization level, AWS says expert review, sandbox testing, and staged rollout are essential before production use.
The post also points to IAM Policy Autopilot, available as a Kiro Power and as an MCP server, plus IAM Policy Simulator as validation tools. AWS says these can help draft permissions, test policy behavior, and confirm that legitimate operations are not blocked before broader deployment.
