Repository navigation
fix(kiro): preserve IDC region across ARN discovery - #2314
Open
lukmanc405 wants to merge 1 commit into
Open
lukmanc405 wants to merge 1 commit into
lukmanc405 wants to merge 1 commit into
Conversation
Kiro IDC connections issued outside us-east-1 (eu-west-1, ap-southeast-1, etc.) were silently pinned to us-east-1 in two places, which caused downstream CodeWhisperer calls (generateAssistantResponse, GetUsageLimits, ListAvailableProfiles) to 403 for any non-US IDC user: 1. fetchKiroProfileArn() hard-coded https://codewhisperer.us-east-1.amazonaws.com/ListAvailableProfiles with Content-Type: application/json. It now accepts the token's region, validates it via assertValidAwsRegion() (SSRF-safe), hits the matching regional CodeWhisperer endpoint, and dispatches via x-amz-target: AmazonCodeWhispererService.ListAvailableProfiles with Content-Type: application/x-amz-json-1.0. When the response returns multiple profiles, it now prefers the one whose ARN region matches the caller region instead of blindly taking the first entry. 2. src/lib/oauth/providers.js now forwards the region resolved during token exchange to fetchKiroProfileArn() so IDC accounts hit their own regional endpoint rather than us-east-1. 3. src/app/api/oauth/kiro/auto-import/route.js previously rewrote the ARN's region segment to us-east-1 on the assumption that the runtime gateway required it. That assumption held only for Builder ID and social accounts; IDC ARNs must keep the region issued by Kiro IDE. The route now preserves the ARN unchanged. Regression tests: - tests/unit/kiro-profile-arn-regional.test.js pins the regional endpoint, dispatch shape, region-preferring profile selection, invalid/missing region fallback, and error-safe behavior. - tests/unit/kiro-auto-import-arn.test.js pins ARN preservation for both IDC (non-us-east-1) and Builder ID (us-east-1) accounts. Test run: 13/13 pass (kiro-profile-arn + regional + auto-import).
bloodf
pushed a commit
to bloodf/9router
that referenced
this pull request
Jul 3, 2026
# Conflicts: # src/app/api/oauth/kiro/auto-import/route.js # src/lib/oauth/providerHelpers.js # src/lib/oauth/providers.js
diegosouzapw
added a commit
to cheaper-inference/OmniRoute
that referenced
this pull request
Jul 5, 2026
The auto-import fallback route (tryAwsSsoCache) unconditionally rewrote the Kiro-IDE profile.json ARN's region segment to us-east-1, 403ing non-us-east-1 Identity Center (IDC) accounts. The OAuth device-code path (src/lib/oauth/providers/kiro.ts) already discovers the correct region-matched ARN, so forcing us-east-1 only in this fallback was inconsistent. Removes the forced rewrite and preserves the profile's ARN region verbatim, mirroring the already-correct OAuth path. This reverses the forced normalization pinned by the #2059 regression test (tests/unit/kiro-auto-import-idc-2059.test.ts) — that test is updated to assert preservation instead, with added coverage for the us-east-1 no-op case and the missing-profile.json case. Co-authored-by: lukmanc405 <lukmanc405@users.noreply.github.com> Inspired-by: decolua/9router#2314
philau2512
added a commit
to philau2512/9router-better
that referenced
this pull request
Jul 7, 2026
…2298 orphaned tool results, PR#2355+decolua#2314 IDC cross-region ARN discovery
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix Kiro IDC profile ARN discovery and auto-import for accounts issued outside
us-east-1.This patch preserves regional topology end-to-end:
fetchKiroProfileArn(accessToken, region)now validates the caller region, hitshttps://codewhisperer.<region>.amazonaws.com, and uses AWS JSON RPC dispatch (x-amz-target: AmazonCodeWhispererService.ListAvailableProfiles,Content-Type: application/x-amz-json-1.0).fetchKiroProfileArn()instead of defaulting all profile discovery tous-east-1.us-east-1.Why
IDC users in regions like
eu-west-1/ap-southeast-1can receive regional CodeWhisperer profile ARNs. Rewriting or discovering those profiles throughus-east-1silently causes downstream CodeWhisperer calls such asListAvailableProfiles,GetUsageLimits, andgenerateAssistantResponseto 403 for non-US IDC accounts.Testing
Also ran syntax checks:
Note: local Vitest needed a temporary non-committed config to bypass root PostCSS discovery in this environment because
@tailwindcss/postcsswas not installed in the hoisted/tmp/node_modulestest setup. The committed source and tests are independent of that temp config.