Kiro Pricing by Tier: Credits, Security Controls and What Enterprise Adds

Kiro pricing runs from a free tier to 200 US dollars per user per month, but the tier that matters for security is Enterprise, because it is the only one where AWS does not use your content to improve its service. Every paid Kiro tier below Enterprise buys the same thing: more credits and access to premium models. The data handling is identical to the free tier, and the opt-out is a checkbox inside each developer's own settings. If your compliance position is that proprietary source code is never used for model training, individual subscriptions cannot evidence that position no matter how carefully each engineer configures their editor.

This matters more than usual right now because the choice is not really optional. AWS stopped new Amazon Q Developer signups on May 15, 2026 and set end of support for the IDE plugins and paid subscriptions at April 30, 2027, so a large number of US engineering organizations are picking a Kiro tier this year whether or not they planned to.

How much does Kiro cost?

Kiro is credit-based rather than request-based. Each tier includes a monthly credit allowance, and paid tiers can buy more at a published add-on rate. Prices below are from Kiro's own pricing page, verified August 2026. Treat any pricing you read as a snapshot and confirm before you sign, because this product line has changed names and terms twice in eighteen months.

Two things stand out. First, the credit ladder is linear: every paid tier below Enterprise costs 0.02 US dollars per included credit, and add-on credits cost 0.04, exactly double. So the tiers are not really discounts, they are prepayment. Buying a higher tier only saves money if you reliably consume the allowance, and buying a lower tier and topping up costs twice as much per credit at the margin. Teams with spiky usage tend to lose money in both directions.

Second, and more important for anyone reading this for security reasons: nothing in the Free-to-Power ladder changes a single security or governance property. You are buying throughput. The security step change happens once, at Enterprise.

What is the difference between Kiro tiers for security?

This is the table most pricing comparisons leave out. All of it comes from Kiro documentation, verified August 2026.

The third row is the one that causes real audit findings. A per-machine checkbox is not a control you can evidence. When an auditor asks whether proprietary code has been used for model training, the honest answer on an individual subscription is that it depends on the configuration of every laptop in the organization, and that nobody has a report showing which ones are configured correctly. That answer does not survive a SOC 2 or ISO 27001 review, and it is the single strongest argument for the Enterprise tier that has nothing to do with credits.

There is one useful exception worth knowing during a migration. Kiro's documentation treats users with an Amazon Q Developer Pro subscription who access Kiro through an AWS account as also excluded from content sharing. So teams already holding Q Developer Pro are not forced into the individual-tier data posture while they transition, provided access stays inside the AWS account rather than through self-serve signups.

Is Kiro free version safe for business use?

For evaluation on non-proprietary code, yes. For production work on a commercial codebase, the free tier has two properties that make it a poor fit. Content may be used for service improvement unless each developer opts out, and free tier inputs are retained for abuse detection for, in Kiro's words, "up to 60 days". Neither is unusual for a free developer tool, and neither is appropriate for code you would not publish.

The practical failure mode is not a policy violation, it is drift. An engineer installs the free tier to try it during the Amazon Q Developer wind-down, uses it on a real repository because that is the only way to evaluate it properly, and never migrates onto the licensed tier because the free one works. Six months later nobody can say which repositories were touched under which data policy. If you are running a migration, the cheapest control available is to block self-serve signups and route everyone through the enterprise agreement from day one.

Does Kiro Enterprise include the security controls I need?

It covers data handling and identity properly. It does not cover what the agent is permitted to do, and that is a different budget line.

Kiro ships a genuinely good permission layer: allow, ask and deny rules where deny always wins, and compound shell commands split on semicolons, pipes and logical operators so each sub-command is checked independently. It also refuses to let an agent write to its own settings directories, which several competing tools get wrong. What no tier buys you is containment. Kiro documents this itself, and the sentence is worth reading before any purchase decision: "Supervised mode is a code review workflow, not a security control." It is not a sandbox, not an isolation boundary and not an access control mechanism, and Kiro says so rather than letting buyers assume otherwise.

So the tier decision and the security decision are separate. Enterprise answers "will AWS train on our code" with a contractual no. Nothing in the price list answers "what can this agent do to the machine it runs on, and can we prove what it did", because the agent runs with whatever credentials the developer already has. That question is addressed by scoping credentials, by deciding autonomy mode per repository rather than per developer, and by keeping a record of agent activity that does not live on the machine being audited. Our Kiro security guide works through each of those controls with Kiro's own documentation quoted.

Kiro pricing versus other agentic coding tools

Direct price comparison across this category is close to meaningless, because the units differ. Kiro sells credits. Others sell requests, seats or premium-request allowances, and each vendor defines consumption differently. A credit is not a request and a request is not a task, so a per-seat headline of 20 US dollars tells you very little about what a team of thirty will actually spend.

What does compare cleanly is the security posture, and here the pattern across the category is consistent: the training opt-out and centralized administration are gated behind the business or enterprise tier almost everywhere. That is true of GitHub Copilot, and the same split appears in Cursor and Gemini CLI deployments. If you are standardizing across several of these, budget for the business tier of each rather than the headline seat price, because the individual tiers are not comparable products from a compliance standpoint.

The other cost nobody models is the migration itself. Moving an engineering organization off Amazon Q Developer before April 30, 2027 means sequencing dozens of squads, each with its own repositories, credentials and release calendar, and the tool cost is usually the smallest line in it. Programs of that shape fall over on dependency ordering rather than budget, which is why they tend to get run out of a portfolio and program management view rather than a spreadsheet owned by one platform team.

Which Kiro tier should we buy?

A short decision rule that holds for most US teams:

• Evaluating on open source or throwaway code: Free. Turn off data sharing anyway, and do not let the evaluation quietly become production.
• An individual contractor or a solo product: Pro at 20 US dollars, sized up only if you consistently exhaust credits. Remember add-on credits cost double the included rate.
• Any company with proprietary code and a compliance obligation: Enterprise, regardless of headcount. You are buying the training exclusion, the automatic telemetry opt-out and SSO, not the credits.
• Heavy agentic workloads on production repositories: Enterprise plus real deny rules and scoped credentials. The tier handles the data question. It does not handle the blast radius question.

The failure mode to avoid is buying on credits and discovering the data policy afterwards. Credits are a forecasting problem and you can fix a forecast next month. A year of proprietary code processed under an individual-tier data policy is not something you can retroactively fix, and it is the finding that shows up in the next audit rather than the next invoice.

If you are further along and the question is what the agent is allowed to do rather than what it costs, AI agent hardening covers the controls that apply once agents act on their own, and securing coding agents covers the credential and blast-radius work specific to developer machines.