fix(kiro): route Amazon Q runtime by profileArn region for cross-region IAM Identity Center

[artickc]

Problem

Enterprise AWS IAM Identity Center accounts whose IdC instance lives outside the two Amazon Q Developer profile regions (us-east-1 / eu-central-1) — e.g. an IdC in eu-north-1 (Stockholm), start URL https://d-XXXX.awsapps.com/start — show no limits on the quota page and return 502 on every chat request.

Root cause

The backend used the IdC/OIDC token region (providerSpecificData.region, e.g. eu-north-1) for every CodeWhisperer runtime call, hitting q.eu-north-1.amazonaws.com — a host that does not exist as a Q Developer runtime endpoint.

Per AWS docs, Supported Regions for the Q Developer console and Q Developer profile:

The Amazon Q Developer console and Amazon Q Developer profile are supported in the following Regions: US East (N. Virginia), Europe (Frankfurt).
Regardless of the IAM Identity Center Region, data is stored in the Region where you create the Amazon Q Developer profile.

So the Q Developer profile — which produces the profileArn and hosts generateAssistantResponse / GetUsageLimits / ListAvailableModels / ListAvailableProfiles — only exists in us-east-1 / eu-central-1, regardless of the IdC region. An eu-north-1 IdC's profile lives in eu-central-1, and its SSO token must be used cross-region against it.

Fix

New open-sse/services/kiroRegion.ts decouples the two regions:

• providerSpecificData.region remains the IdC/OIDC region — used only for oidc.{region}.amazonaws.com token mint/refresh.
• The runtime region is derived from the profileArn (resolveKiroRuntimeRegion): profileArn region → a valid stored profile region → us-east-1. A stored IdC region that is not a Q profile region (eu-north-1) is ignored for runtime.
• Profile discovery (discoverKiroProfileArnAcrossRegions) probes the Q profile regions (EU IdC → eu-central-1 first) with the cross-region SSO token, instead of q.{idcRegion}.

Wired into:

• open-sse/executors/kiro.ts — generateAssistantResponse targets the profile region (resolveKiroRegion is now profileArn-first; kiroRuntimeHost is re-exported from the shared module).
• open-sse/services/usage/kiro.ts — getKiroUsage uses multi-region discovery + the profileArn runtime region so Limits resolves.
• open-sse/services/kiroModels.ts — ListAvailableModels uses the profileArn runtime region.
• src/lib/oauth/providers/kiro.ts — login-time postExchange discovers the profileArn across the profile regions.

Same-region setups (eu-central-1 IdC, us-east-1 Builder ID) are unchanged, and the SSRF region allowlist (AWS_REGION_PATTERN, GHSA-6mwv-4mrm-5p3m) is preserved.

Testing

• New tests/unit/kiro-idc-cross-region.test.ts (15 cases): runtime-region precedence, profile-region probe order, "never probe q.eu-north-1", login postExchange, and getKiroUsage end-to-end for eu-north-1.
• All Kiro suites pass — 60 tests (region / profilearn-usage / available-models / oauth-idc / ssrf-guard / executor / cross-region).
• Typecheck of the changed files is clean.