[artickc]

Problem

Enterprise AWS IAM Identity Center Kiro accounts always fail with 403 "User is not authorized to make this call" even though the same account works in the Kiro IDE.

Kiro/CodeWhisperer is region-bound: the access token, the Q Developer profileArn, and the runtime endpoint must all match the region the IdC instance lives in (e.g. eu-central-1). The backend hardcoded codewhisperer.us-east-1.amazonaws.com everywhere.

Verified live against AWS for an eu-central-1 account:

• A region-bound token sent to codewhisperer.us-east-1 is accepted but the eu-central-1 profileArn yields 400 "Improperly formed request".
• The same token at the correct host q.eu-central-1.amazonaws.com is what the Kiro IDE uses (arn:aws:codewhisperer:eu-central-1:...:profile/...).
• codewhisperer.{region}.amazonaws.com does not resolve for non-us-east-1 regions; the regional host is q.{region}.amazonaws.com.
• The device-code login never captured a profileArn, which enterprise accounts require on every call.

Fix (3 files)

• open-sse/executors/kiro.ts — resolve the region from providerSpecificData.region (or parsed from the profileArn) and POST generateAssistantResponse to the regional host. us-east-1 keeps the legacy codewhisperer.us-east-1 host, so AWS Builder ID accounts are unaffected.
• open-sse/services/usage.ts — GetUsageLimits now targets the same regional host.
• src/lib/oauth/providers/kiro.ts — the device-code login (Builder ID / IDC) now discovers the Q Developer profileArn via ListAvailableProfiles against the regional endpoint and stores it.

Compatibility

us-east-1 behavior is byte-for-byte unchanged (Builder ID), so there is no regression for existing accounts. Profile discovery is best-effort and a no-op for accounts without a profile.

[gemini-code-assist]

Code Review

This pull request introduces region-specific routing and profile discovery for AWS Kiro/CodeWhisperer connections to support region-bound enterprise AWS IAM Identity Center accounts. The review feedback highlights critical issues, including a missing timeout on the profile discovery fetch call that could block the login flow, and a lack of lowercase normalization for region strings across multiple files, which may cause comparison and host resolution failures. Additionally, the reviewer notes that unit tests must be added for the new production code changes in open-sse/ and src/ to comply with the repository style guide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

There are two issues here:

1. The fetch call to ListAvailableProfiles does not have a timeout. If the network hangs or AWS is slow, this fetch will block the device-code polling/login flow indefinitely. Adding a timeout (e.g., 10 seconds) ensures the login flow remains responsive.
2. tokenRegion is not normalized to lowercase. If it contains uppercase characters, the comparison tokenRegion === "us-east-1" will fail, and the profile ARN lookup p.arn.includes(":${tokenRegion}:") might also fail since ARNs typically use lowercase regions. Normalize the region to lowercase before using it.

      try {
        const normalizedRegion = tokenRegion.toLowerCase();
        const runtimeHost =
          normalizedRegion === "us-east-1"
            ? "https://codewhisperer.us-east-1.amazonaws.com"
            : `https://q.${normalizedRegion}.amazonaws.com`;
        const profRes = await fetch(`${runtimeHost}/`, {
          method: "POST",
          headers: {
            "Content-Type": "application/x-amz-json-1.0",
            Accept: "application/json",
            "x-amz-target": "AmazonCodeWhispererService.ListAvailableProfiles",
            Authorization: `Bearer ${data.accessToken}`
          },
          body: JSON.stringify({ maxResults: 10 }),
          signal: AbortSignal.timeout(10000)
        });
        if (profRes.ok) {
          const profData = await profRes.json();
          const profiles = Array.isArray(profData?.profiles) ? profData.profiles : [];
          const matched =
            profiles.find(
              (p: { arn?: string }) =>
                typeof p?.arn === "string" && p.arn.includes(`:${normalizedRegion}:`)
            ) || profiles[0];
          if (matched && typeof matched.arn === "string") profileArn = matched.arn;
        }

[gemini-code-assist]

The region string retrieved from providerSpecificData is trimmed but not normalized to lowercase. If the region is stored in uppercase or mixed case (e.g., EU-CENTRAL-1), comparison checks like region === "us-east-1" will fail, and the regional host will be constructed with uppercase letters (e.g., https://q.EU-CENTRAL-1.amazonaws.com), which can cause issues with host resolution or signature verification. Normalize the region to lowercase.

Suggested change

	const region = typeof psd.region === "string" ? psd.region.trim() : "";
	const region = typeof psd.region === "string" ? psd.region.trim().toLowerCase() : "";

[gemini-code-assist]

According to the Repository Style Guide (Rule 9), tests must be included when changing production code in open-sse/ or src/. Please add unit tests (e.g., in tests/) to cover the new resolveKiroRegion and kiroRuntimeHost functions, verifying correct region resolution and host mapping.

References

1. Always include tests when changing production code (src/, open-sse/, electron/, bin/). ^(link)

[gemini-code-assist]

Similar to the executor, the region retrieved from providerSpecificData here is not normalized to lowercase. If it contains uppercase characters, the comparison region === "us-east-1" will fail, routing us-east-1 requests to https://q.US-EAST-1.amazonaws.com instead of CODEWHISPERER_BASE_URL. Normalize the region to lowercase.

Suggested change

	const region =
	(typeof providerSpecificData?.region === "string" && providerSpecificData.region.trim()) ||
	regionFromArn ||
	"us-east-1";
	const region =
	(typeof providerSpecificData?.region === "string" && providerSpecificData.region.trim().toLowerCase()) ||
	regionFromArn ||
	"us-east-1";

[diegosouzapw]

Merged into release/v3.8.22 — thanks @artickc! 🎉 Region-aware Kiro routing for enterprise IAM Identity Center accounts. I verified the wiring end-to-end: the device-code pollForToken path invokes postExchange(result.data) → mapTokens(result.data, extra) and your _region propagates correctly, so the profileArn discovery lands. Great test coverage (9 cases incl. never-throw on network failure). Shipping in the next release.