← Back to workshop links

Amazon Web Services · 23 September 2026

Attendee setup guide

Kiro workshop — LASD Field Support Bureau. Amazon Irvine SNA16, room 01.105 (Arctic), 10:00 AM – 1:30 PM.

Read this first

• The Kiro lab runs on Kiro's free tier. You sign in with an AWS Builder ID — a free personal profile. You do not need an AWS account for it, you create no cloud resources, and there is nothing to pay.
• You need a laptop you can install software on. Windows, macOS and Linux all work. If your laptop blocks installs, tell the instructor now — you can still follow along.
• You also have a paper slip with a username (like lasd07) and a one-time password. That is the fallback — use it only if Builder ID fails or you run out of free credits. See If Builder ID does not work for you.
• Steps 1 and 2 are enough to start. Steps 3–7 are for the Claude Code session at 12:55 PM — do them over lunch if you prefer.

Where to type the commands

Windows	Click Start, type PowerShell, press Enter. A window opens with a prompt starting PS C:\
macOS	Press Command+Space, type Terminal, press Enter.
Linux	Open your usual terminal application.

Type the command exactly, then press Enter. If a command is not recognised right after you install something, close the window and open a new one — that reloads the list of available commands.

Step 1 — Install Kiro

1. Download Kiro from kiro.dev/downloads and install it. On Windows run the installer; on macOS drag Kiro to your Applications folder.
2. Open Kiro once and confirm you reach the welcome screen. Leave it open — you sign in next.

Kiro is a few hundred megabytes. Start the download first and read Step 2 while it runs.

Step 2 — Sign in with an AWS Builder ID

This is the method the workshop itself uses. An AWS Builder ID is a free personal profile, separate from any AWS account. On the free tier Kiro costs nothing.

1. At Kiro's sign-in screen choose AWS Builder ID.
2. Your browser opens. If you already have a Builder ID, sign in with it. If not, create one: enter an email address you can read on this laptop, type the verification code AWS emails you, and set a password.
3. Approve the request for Kiro, then return to Kiro. You should land in the IDE, signed in.

If Builder ID does not work for you — use the paper slip

Three things commonly stop a Builder ID being created in a room like this:

• you cannot receive the verification email on that laptop;
• AWS asks for additional verification because a dozen people are registering from one address at once;
• your laptop filters the AWS sign-in domains.

Any of those — stop and use the slip instead. It needs no email and no verification code, and it carries Kiro Pro Max rather than the free tier, so credits will not run out.

First, set your password

1. Open https://d-90667e4749.awsapps.com/start
2. Type the username from your slip and click Next.
3. Type the one-time password from your slip and click Sign in. Leave “This is a trusted device” unticked.
4. Choose your own password, enter it twice — the page shows Match when they agree — then click Set new password. Write it down; nobody can look it up for you.
5. You land on the AWS access portal. Accounts lists one account with the LASDWorkshopBedrock role; Applications lists Kiro, which confirms the licence is active.

If that address will not load at all, try the alternate portal.

Then point Kiro at it

If you already signed in to Kiro with a Builder ID, sign out first — open the Command Palette and run Kiro: Sign Out.

1. At Kiro's sign-in screen choose AWS IAM Identity Center — not Builder ID, Google or GitHub, because those go back to the free tier.
2. Enter these two values:

   Start URL:  https://d-90667e4749.awsapps.com/start
   Region:     us-east-1

3. Sign in in the browser with your username and new password, approve, and return to Kiro.

On this route your licence is Kiro Pro Max. If Kiro says you have no subscription, tell the instructor rather than signing up personally.

Can't install software? Use the provided Windows desktop

1. Ask the instructor for the DCVUrl, DCVUsername and DCVUserPassword values — Event Outputs on the workshop-windows-desktop stack.
2. Open the DCVUrl in your browser (HTTPS on port 8443).
3. Your browser warns that the certificate is not trusted. That is expected — the desktop uses a self-signed certificate. Choose Advanced, then Proceed to … (unsafe).
4. Sign in with DCVUsername (Administrator) and DCVUserPassword. A Visual Studio Code shortcut opens the workshop folder.
5. Look on the desktop for workshop-setup-OK.txt. Once it appears, Claude Code is configured and signed in — skip to the verify step.

workshop-setup-OK.txt can take up to 15 minutes to appear, because the desktop keeps installing in the background after it becomes reachable. If you get workshop-setup-FAILED.txt, or neither file after ~15 minutes, sign out and back in to retrigger it; if it still does not appear, tell the instructor. Claude Cowork needs its one-time configuration import either way.

Step 3 — Install the AWS CLI

The AWS CLI is what gives Claude Code and the Agent Toolkit permission to talk to AWS. Check whether you already have it:

aws --version

You want version 2.35 or newer. If you see something like aws-cli/2.33.15 it is too old for Step 6 — install the current version over the top. If you see “command not found” or “not recognized”, it is not installed yet.

Windows

1. Download AWSCLIV2.msi
2. Double-click it and click through the installer, accepting the defaults.
3. Close PowerShell, open it again, then run aws --version

macOS

1. Download AWSCLIV2.pkg
2. Double-click it and click through the installer. You will be asked for your Mac password.
3. Open a new Terminal window and run aws --version

If you already use Homebrew, brew install awscli works too.

Linux

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
aws --version

Step 4 — Connect the AWS CLI to the workshop account

Run this and answer the prompts. Same command on every operating system:

aws configure sso

SSO session name	lasd
SSO start URL	https://d-90667e4749.awsapps.com/start
SSO region	us-east-1
SSO registration scopes	sso:account:access
Account	179201403914 (LASD Kiro Workshop Backup)
Role	LASDWorkshopBedrock
CLI default client Region	us-east-1
CLI default output format	json
CLI profile name	lasd

A browser window opens so you can approve the request. Then confirm it worked:

aws sso login --profile lasd
aws sts get-caller-identity --profile lasd

The second command should print account 179201403914 and a role name containing LASDWorkshopBedrock. If it errors about credentials, run the aws sso login line again.

Step 5 — Install Claude Code

Claude Code runs in the terminal. It does not need Node.js — the installer downloads a self-contained program.

Windows (PowerShell)

irm https://claude.ai/install.ps1 | iex

If you get 'irm' is not recognized, you are in the older Command Prompt rather than PowerShell. Either open PowerShell, or run this instead:

curl -fsSL https://claude.ai/install.cmd -o install.cmd && install.cmd && del install.cmd

macOS and Linux

curl -fsSL https://claude.ai/install.sh | bash

Then check it

claude --version

That should print a version number. claude doctor prints a diagnostic report without starting a session.

Step 6 — Install the Agent Toolkit for AWS

The Agent Toolkit gives your coding agent current AWS documentation and tested, step-by-step AWS skills, so it stops guessing at APIs from memory. It is free. One command sets it up and it detects Kiro and Claude Code for you:

aws configure agent-toolkit

This needs AWS CLI 2.35 or newer (Step 3). On an older CLI it fails with:

aws: [ERROR]: argument subcommand: Found invalid choice 'agent-toolkit'

The toolkit also needs a small helper called uv. If the command complains that uv is missing, install it and run the command again:

Windows (PowerShell)

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

macOS and Linux

curl -LsSf https://astral.sh/uv/install.sh | sh

What you can build with it here

Your workshop credentials can create real AWS resources — S3 buckets, Lambda functions, DynamoDB tables, API Gateway APIs, CloudFormation stacks, CloudWatch logs — so the toolkit's skills work end to end, not just its documentation search.

A few things are deliberately blocked so one person cannot disrupt the workshop or run up a large bill. If your agent hits an “explicit deny” on any of these, the guardrail is working:

• Changing sign-in: IAM Identity Center, the identity store, AWS Organizations.
• Creating IAM users or access keys — credentials that would outlive the workshop.
• Large or GPU EC2 instance types, SageMaker endpoints and training jobs, Redshift clusters, EMR clusters, Bedrock provisioned throughput.
• Turning off CloudTrail or GuardDuty.

Roles your agent creates must carry the LASDWorkshopBoundary permissions boundary. The agent normally handles this; if it reports that it cannot create a role, ask it to attach that boundary and try again.

Step 7 — Point Claude Code at Bedrock

Do not set environment variables by hand. The workshop ships a setup script that does the whole job: it reads the workshop's CloudFormation outputs, signs you in to the workshop's Cognito user pool, and writes an AWS profile named workshop, your ~/.claude/settings.json with the right model IDs and telemetry, and a Claude Cowork configuration file for later.

Windows (PowerShell)

irm "https://ws-assets-prod-iad-r-iad-ed304a55c2ca1aee.s3.us-east-1.amazonaws.com/3cc53475-900a-4801-bc5b-21ed15439675/laptop-setup/setup.ps1" -OutFile setup.ps1
powershell -ExecutionPolicy Bypass -File setup.ps1

macOS and Linux

curl -fsSL "https://ws-assets-prod-iad-r-iad-ed304a55c2ca1aee.s3.us-east-1.amazonaws.com/3cc53475-900a-4801-bc5b-21ed15439675/laptop-setup/setup.sh" -o setup.sh
bash setup.sh

The script prints the resources it found, prompts for your Cognito username (an email address) and password, then tells you to restart Claude Code.

What it sets up, and why there is no API key

No long-lived AWS keys ever land on your laptop. The script installs a credential helper; each time Claude Code needs Bedrock it signs in to Cognito, exchanges the token through AWS STS for temporary credentials, and calls Bedrock with those. They refresh on their own. Because they are minted per person, every request is attributed to you rather than to a shared key — which is the whole point of this session.

Primary model	global.anthropic.claude-sonnet-4-6
Small / fast model	global.anthropic.claude-haiku-4-5-20251001-v1:0
Heavy-reasoning model	global.anthropic.claude-opus-4-6-v1
AWS profile created	workshop
Files written	~/.aws/config, ~/.claude/settings.json, ~/claude-cowork-config.json

All three models were tested in a real workshop account on the morning of the session and all three answered.

Check it

claude "What are the benefits of Amazon Bedrock?"

A sensible answer means Claude Code is installed, routed through Bedrock, and your credentials are good. AccessDeniedException usually means the Cognito sign-in failed — re-run the script and retype the password.

Fallback — the prepared account instead

The setup script only works against the workshop's own account, because it looks up that account's CloudFormation stacks. On the prepared account from the paper slip there is no Cognito to sign in to, so configure Claude Code by hand. On macOS or Linux paste these; on Windows PowerShell use $env:NAME = "value" in place of export NAME=value.

export AWS_PROFILE=lasd
export CLAUDE_CODE_USE_BEDROCK=1
export AWS_REGION=us-east-1
export ANTHROPIC_DEFAULT_OPUS_MODEL='us.anthropic.claude-opus-5'
export ANTHROPIC_DEFAULT_SONNET_MODEL='us.anthropic.claude-sonnet-4-5-20250929-v1:0'
claude

Set both model lines. Pin only the Opus one and Claude Code sends its small background tasks to Opus too, which costs far more than it needs to.

Two differences on Bedrock either way: the web-search tool is unavailable, and /logout does nothing because AWS handles sign-in. Reference: Claude Code on Amazon Bedrock.

If something goes wrong

Kiro says “There was an error signing you in”	Sign out (Command Palette → Kiro: Sign Out) and try again. For the Kiro lab choose AWS Builder ID. Only on the paper-slip route do you choose AWS IAM Identity Center, and then the Start URL must be entered exactly as printed.
Builder ID: no verification email arrives	Check spam, and check you can receive mail on this laptop at all. If it will not come through, switch to the paper slip — it needs no email.
Builder ID: “Additional verification required”	AWS asks for this when many people register from one location at once. Follow the prompt if you can; if it wants an authenticator app or security key you do not have, switch to the paper slip.
Builder ID: the sign-up page is blocked	Your laptop may filter the AWS sign-in domains. Nothing you can fix in the room — switch to the paper slip.
Kiro says you are out of credits	The free tier is 50 credits a month. Switch to the paper slip, which carries Kiro Pro Max. Do not buy credits.
Your one-time password is rejected	One-time passwords work once. If you already used it, or mistyped it several times, ask the instructor for a new one.
aws: command not found	Either the AWS CLI is not installed (Step 3), or you need to close the terminal and open a new one.
Found invalid choice 'agent-toolkit'	Your AWS CLI is older than 2.35. Reinstall from Step 3 and check aws --version.
“on-demand throughput isn't supported”	The model was given without its us. prefix. Use us.anthropic.claude-opus-5.
“Session token not found or invalid”	Your session expired — it lasts 12 hours. Run aws sso login --profile lasd
Claude Code cannot find AWS credentials	AWS_PROFILE=lasd must be set in the same terminal you launched claude from.
“The token '&&' is not a valid statement separator”	You ran the Command Prompt version of a command inside PowerShell. Use the PowerShell line.
Your agent reports an explicit deny	Check the blocked list in Step 6 — those denials are deliberate.

Environment reference

AWS account	179201403914 (LASD Kiro Workshop Backup)
Region	us-east-1
Access portal	https://d-90667e4749.awsapps.com/start
Access portal (alternate)	https://ssoins-7223c4f91f99f0d8.portal.us-east-1.app.aws
Permission set / role	LASDWorkshopBedrock
Permissions boundary	LASDWorkshopBoundary
Kiro lab sign-in	AWS Builder ID, free tier (50 credits/month)
Fallback sign-in	AWS IAM Identity Center + paper slip (Kiro Pro Max)
Claude model	us.anthropic.claude-opus-5
Background model	us.anthropic.claude-sonnet-4-5-20250929-v1:0
AWS CLI profile	lasd