Security-first guidance for implementing AWS Kiro in banking SDLC environments while maintaining full compliance with Monetary Authority of Singapore (MAS) Technology Risk Management Guidelines.
- Overview
- Start Here
- Key Features
- Documentation Structure
- Quick Start
- Security Architecture
- Compliance Framework
- Target Audience
- Contributing
- License
This repository provides comprehensive best practices for banking development teams implementing AWS Kiro (AI-powered development assistant) in Software Development Life Cycle (SDLC) environments. All guidance is designed to meet MAS regulatory requirements for financial institutions operating in Singapore.
AWS Kiro is an AI-powered IDE and development assistant that helps developers write, debug, and optimize code. For banking environments, special security controls are required to ensure compliance with financial services regulations.
Financial institutions face unique challenges when adopting AI development tools:
- Regulatory Compliance - Must meet MAS Technology Risk Management Guidelines
- Data Protection - Sensitive code and data must remain within controlled environments
- Access Control - Enterprise identity management and MFA requirements
- Audit Requirements - Complete audit trails for all AI-assisted development activities
- Network Security - Private connectivity without internet exposure
This guide addresses all these challenges with practical, tested implementations.
New here? Use the map below to jump straight to what you need. AI agents: see AGENTS.md for the machine-oriented version (auto-loaded by Kiro's default agent).
| I want to… | Go to |
|---|---|
| Get running in ~15 minutes (Kiro CLI) | Quick Start → First 15 minutes |
| Lock down the Kiro CLI agent (tool permissions, hooks, file lockdown) — enforced config security | kiro-docs/agent-runtime-governance.md |
| Apply enterprise/registry governance (MCP allow-list, models, web tools, subagents) | kiro-docs/security-governance-features.md |
Secure the MCP config file (mcp.json) |
kiro-docs/mcp-security.md |
| Set up auth, network & VDI (Sections 1–4) | Kiro-Agentic-SDLC-Banking-Best-Practices.md |
| Go deeper: MCP, SDLC, PDPA, FEAT (Sections 5–14) | Kiro-Banking-Best-Practices-Part2.md |
| Build a MAS-compliant Kiro Skill | Banking-Skills-Development-Guide.md |
| Use the reference locked-down agent + hooks | agent-hooks/ |
| Deploy the AWS infrastructure | cdk/ |
| Check MAS TRM coverage | Compliance Framework |
Enforced config-level security lives mainly in
agent-runtime-governance.md(CLI agent runtime); add the enterprise/registry layer fromsecurity-governance-features.md. Everything under.kiro/steering/and.kiro/skills/is guidance, not an enforced boundary.
- Two architecture options: via AWS IAM Identity Center or direct IdP federation (Okta, Entra ID)
- SAML 2.0 / OIDC authentication with MFA enforcement
- SCIM provisioning for automated user and group synchronization
- Blocking of social logins and AWS Builder IDs
- Session management and timeout policies
- End-to-end VPC architecture with no internet-facing endpoints
- AWS PrivateLink for private connectivity to Kiro services
- Security groups and Network ACLs for defense-in-depth
- DNS resolution within private network
- Amazon WorkSpaces VDI with encryption at rest and in transit
- Group Policy (GPO) hardening for Windows environments
- Data Loss Prevention (DLP) agent deployment
- Centralized MCP configuration management
- Whitelist-based MCP server approval process
- Centrally managed configuration preventing developer modifications
- Approved MCP servers for banking use cases
- Audit logging of all MCP tool usage
- CloudTrail logging for all Kiro activities
- CloudWatch monitoring and alerting
- Automated compliance validation scripts
- MAS TRM Guidelines mapping
- Locked default agent: least-privilege
tools/allowedTools,toolsSettingsdeny rules (denyByDefault, denied paths/commands) - Fail-closed
preToolUsehooks: PII/secret guard, git policy guard, destructive-filesystem guard - Tamper-evident (hash-chained) tool-use audit; declarative
denyByDefaultas the primary control
- Immutable, append-only, self-healing control files across Windows/macOS/Linux/VDI (
chattr/chflags/icaclsvia MDM) - Application allow-listing + non-privileged developers; server-side branch protection / IAM as the authoritative boundary
- Zero Trust: vendor "built-in" protections treated as unverifiable backstops, not the boundary
- Chaos / penetration harness: non-privileged human and Kiro agent vs the controls
- Reproducible, hash-chained, sanitized evidence (
kiro-docs/chaos-pentest-evidence.md)
| Document | Description | Status |
|---|---|---|
| QUICK-REFERENCE.md | Quick reference card with checklists | ✅ Complete |
| Kiro-Agentic-SDLC-Banking-Best-Practices.md | Comprehensive implementation guide (Sections 1-4) | ✅ Complete |
| Kiro-Banking-Best-Practices-Part2.md | Extended guidance (Sections 5-14) incl. PDPA, Outsourcing, AI/ML, ABS | ✅ Complete |
| Banking-Skills-Development-Guide.md | How to build MAS-compliant Kiro Skills for banking | ✅ Complete |
| kiro-docs/agent-runtime-governance.md | Agent runtime governance: tool permissions, hooks, tamper-evident audit | ✅ Complete |
| kiro-docs/mdm-endpoint-enforcement.md | MDM-managed, immutable, self-healing global hooks/steering/agent across clients | ✅ Complete |
| kiro-docs/mdm-test-evidence.md | Sanitized Windows/macOS/Linux lockdown test results | ✅ Complete |
| kiro-docs/chaos-pentest-evidence.md | Chaos/pentest: non-privileged human + agent vs controls (findings + recommendations) | ✅ Complete |
| SECURITY.md | Security vulnerability reporting policy | ✅ Complete |
| Skill | Description | MAS Reference |
|---|---|---|
| .kiro/skills/mas-compliance-review/ | Automated MAS TRM + PDPA compliance checking | TRM 9, 10, 11, 15 + PDPA |
| .kiro/skills/pii-detection/ | Singapore-specific PII detection and masking | PDPA + TRM 11.1 |
| .kiro/skills/banking-code-review/ | Banking security code review with checklists | TRM 6, 9, 10, 11 + AIRG |
| Document | Description |
|---|---|
| cdk/ | AWS CDK (TypeScript) modules for MAS-compliant infrastructure |
| cdk/README.md | CDK deployment guide with architecture diagram |
| File | Description |
|---|---|
| .kiro/steering/banking-standards.md | Security requirements, prohibited patterns, data handling rules |
| .kiro/steering/fairness.md | MAS FEAT principles for bias prevention in financial logic |
| .kiro/steering/repo-map.md | Repository navigation map for agents (always-included steering) |
| Workflow | Description |
|---|---|
| .github/workflows/validate.yml | Automated validation: docs, CDK synth/test, skill structure |
| Diagram | Description |
|---|---|
| diagrams/architecture-option-a.png | Option A: Via IAM Identity Center |
| diagrams/architecture-option-b.png | Option B: Direct IdP Federation |
| diagrams/security-layers.png | MAS TRM 5-layer security model |
Local snapshots of Kiro platform documentation for offline/air-gapped environments. See kiro-docs/README.md for source URLs and freshness tracking.
| Document | Description |
|---|---|
| kiro-docs/mcp-configuration.md | MCP server configuration guide |
| kiro-docs/mcp-security.md | MCP security best practices |
| kiro-docs/mcp-servers.md | Available MCP servers reference |
| kiro-docs/mcp-usage.md | MCP usage patterns and examples |
| kiro-docs/privacy-and-security.md | Privacy and security guidelines |
| kiro-docs/security-governance-features.md | Consolidated Kiro security & governance feature reference (CLI + IDE/General), mapped to MAS TRM |
- MAS Framework for Impact and Risk Assessment of Financial Institutions.pdf
- TRM Guidelines 18 January 2021.pdf
- Risk Management Guidelines_Insurance Core Activities.pdf
- Monograph - A guide for senior executives - Final revised in April 2013.pdf
Fast path for first-time users (full prerequisites are below).
# 1. Install Kiro CLI — see https://kiro.dev/docs/cli/
# 2. Clone and enter the repo
git clone https://github.com/timwukp/kiro-banking-best-practices.git
cd kiro-banking-best-practices
# 3. Validate the reference locked-down agent
kiro-cli agent validate --path agent-hooks/banking-secure.agent.json
# 4. Run the repo + hook checks
./validate-repo.sh # expect: RESULT: PASSED
bash agent-hooks/tests/run-tests.sh # expect: FAIL=0Next: read kiro-docs/agent-runtime-governance.md to deploy the hooks and set banking-secure as your default agent, then Security Architecture.
Before implementing Kiro in your banking environment, ensure you have:
- ✅ AWS Organization with IAM Identity Center enabled
- ✅ Enterprise IdP (Azure AD, Okta, Ping Identity) with SAML 2.0 support
- ✅ Corporate VPC with private subnets configured
- ✅ Amazon WorkSpaces directory set up
- ✅ DLP solution deployed (Symantec, McAfee, Microsoft Purview, or Forcepoint)
- ✅ CloudTrail enabled for audit logging
No fixed calendar. Duration depends on your starting point and your organization's approval / identity / change processes — not on the technical work, which is small and largely automated. The estimates below are illustrative; validate them in your environment.
Assumptions that drive duration: existing AWS Organization + enterprise IdP; identity-team availability for SCIM; security-team availability for MCP review; one starting region/account; your change-management cadence.
| Workstream | Prerequisite | Technical effort* | Exit criterion (objective evidence) |
|---|---|---|---|
| Identity & access (IdP + SCIM + MFA) | IdP admin, IAM Identity Center | ~0.5–1 d | Test user auto-provisioned via SCIM; MFA enforced; social / Builder ID blocked |
| Network isolation (VPC endpoints, SG/NACL, private DNS) | VPC + subnets | ~0.5–1 d | cdk synth clean; VDI connectivity test passes; no public endpoint |
| Secure VDI (WorkSpaces + GPO/DLP) | Directory service | ~1–2 d | Encrypted WorkSpace launches; protected paths / trusted commands enforced |
| MCP governance | approved-server list | ~0.5 d | Registry allow-list active; mcp.json read-only to developer (permission check) |
| Agent runtime + endpoint enforcement | golden image | ~0.5–1 d | agent-hooks/tests/run-tests.sh + mdm/tests/test-lockdown.sh green; chaos harness = 0 unexpected bypass |
| Monitoring & compliance | CloudTrail / CloudWatch | ~0.5 d | Audit shipped off-box; test alarm fires; MAS TRM mapping reviewed |
* Hands-on time assuming the prerequisite already exists.
The long pole is organizational, not technical. Hands-on effort totals only a few days; the calendar is set by IdP/SCIM coordination, MCP security reviews, and change approvals — days to weeks, depending on your organization. Measure progress by the exit criteria above (verifiable evidence), not by elapsed weeks.
-
Read the Overview
# Start with the comprehensive overview open QUICK-REFERENCE.md -
Review Architecture
# Understand the security architecture open Kiro-Agentic-SDLC-Banking-Best-Practices.md -
Configure Your Environment
# Follow the step-by-step implementation guide # Begin with Section 2: Authentication & Identity Management
-
Validate Compliance
# Use the provided validation scripts ./validate-repo.sh
This guide supports two architecture options depending on your organization's identity management strategy.
Enterprise IdP federates through IAM Identity Center, which centrally manages access to both Kiro subscriptions and WorkSpaces. This is the traditional approach and provides unified access management across all AWS services.
Since Kiro v0.9.40, enterprise teams can connect Okta or Microsoft Entra ID directly to Kiro without IAM Identity Center. Amazon WorkSpaces also supports direct SAML 2.0 federation with external IdPs when using AWS Directory Service directories.
This option removes IAM Identity Center entirely, simplifying the architecture for organizations that prefer direct IdP integration.
Option B Requirements:
- Kiro: Create OIDC + SAML apps in your IdP, configure SCIM provisioning, verify company domain via DNS (Okta setup)
- WorkSpaces: AWS Directory Service (Managed AD, Simple AD, or AD Connector) with SAML 2.0 configured for your IdP
- MFA enforcement handled directly by the IdP (not IAM Identity Center)
When to choose Option B:
- Your organization already uses Okta or Entra ID as the primary identity platform
- You want fewer AWS service dependencies in the authentication chain
- You prefer a single IdP configuration that works across both Kiro IDE and CLI
Both architectures share the same 5-layer security model:
- Identity Layer - Enterprise IdP + MFA (via IAM Identity Center or direct federation)
- Network Layer - VPC + PrivateLink + Security Groups
- Endpoint Layer - WorkSpaces VDI + DLP + GPO
- Application Layer - MCP Governance + Centralized Configuration + Agent Runtime Governance
- Audit Layer - CloudTrail + CloudWatch + Compliance Validation (incl. agent tool-use audit log via
postToolUsehook)
Where to configure enforced security: start with
kiro-docs/agent-runtime-governance.md(Layer 4 runtime controls — tool permissions, hooks, OS-level file lockdown); seekiro-docs/security-governance-features.mdfor the enterprise/registry governance layer.
| Regulation | Scope | Document Reference |
|---|---|---|
| MAS TRM Guidelines (Jan 2021) | Technology risk management (15 sections) | Part 1 & Part 2 |
| Singapore PDPA (2012, amended 2020) | Personal data protection | Part 2, Section 11 |
| MAS Outsourcing Guidelines (2018) | Third-party service risk management | Part 2, Section 12 |
| MAS FEAT Principles | AI/ML fairness, ethics, accountability, transparency | Part 2, Section 13 |
| ABS Cloud Computing Guide | Industry cloud security standards | Part 2, Section 14 |
| ABS Penetration Testing Guidelines | Security assessment standards | Part 2, Section 14.2 |
| MAS Section | Control Area | Implementation | Document Reference |
|---|---|---|---|
| 3.1 | Governance & Oversight | IAM IDC + Enterprise IdP | Section 2 |
| 5.1-5.2 | IT Project Mgmt & Security-by-Design | Supervised mode + Skills | Section 6 |
| 9.1 | Access Control | MFA + Session Management | Section 2.1.3 |
| 9.3 | Remote Access Security | VPC + PrivateLink | Section 3 |
| 10 | Cryptography | TLS 1.2+ + KMS | Section 7 |
| 11.1 | Data Security | DLP + Encryption + PDPA | Section 4.1.3, Section 11 |
| 11.2 | Network Security | VPC Endpoints + Security Groups | Section 3.2 |
| 12.1-12.3 | Cyber Security Operations | CloudWatch + monitoring | Section 8 |
| 13.1-13.4 | Security Assessment | Annual VA/PT of Kiro environments | Section 14.2 |
| 15 | IT Audit | CloudTrail + Monitoring | Section 8 |
- ✅ Zero Trust Architecture - No internet-facing endpoints, all traffic through VPC PrivateLink
- ✅ MFA Enforcement - Required for all user access via Enterprise IdP
- ✅ Least Privilege - IAM policies grant minimum required permissions
- ✅ Encryption - Data encrypted at rest (KMS) and in transit (TLS 1.2+)
- ✅ Audit Trails - CloudTrail logging with 90-day minimum retention
- ✅ Data Location Governance - Kiro operates from supported profile regions (us-east-1, eu-central-1); prompt logs and user activity reports are stored in the profile region per AWS requirements. MAS TRM does not mandate data localisation — residency preferences are customer-driven. For organizations requiring regional log copies, S3 Cross-Region Replication (CRR) to ap-southeast-1 is available as a complementary control
- ✅ DLP Controls - Prevent code exfiltration and credential exposure
- ✅ MCP Governance - Centrally managed whitelist, no developer modifications
- ✅ PDPA Compliance - Data classification, DLP rules for personal data, breach notification
- ✅ AI Governance - FEAT principles applied, human accountability for AI-generated code
- ✅ Outsourcing Risk - Due diligence, exit strategy, concentration risk management
This documentation is designed for:
- Banking Developers - Implementing Kiro in daily SDLC workflows
- Security Architects - Designing secure AI development environments
- Compliance Officers - Validating MAS regulatory compliance
- Cloud Operations Teams - Deploying and managing Kiro infrastructure
- Development Team Leads - Establishing secure development practices
- IT Auditors - Reviewing security controls and audit trails
We welcome contributions from the banking and financial services community. Please see CONTRIBUTING.md for guidelines on:
- Submitting security enhancements
- Reporting compliance gaps
- Sharing implementation experiences
- Proposing new MCP server approvals
- Improving documentation
This documentation is licensed under the MIT License. See LICENSE for full details.
This documentation is provided for informational and educational purposes only. It does not constitute legal advice, regulatory guidance, or professional security consulting services. Organizations must:
- Conduct independent security assessments and risk analysis
- Consult with qualified legal, compliance, and security professionals
- Validate implementations against specific regulatory requirements
- Maintain full responsibility for security posture and compliance status
- AWS Documentation - Official AWS docs access
- Git - Repository operations (read-only recommended)
- Filesystem - Controlled directory access
- GitHub - With token scope restrictions
- Docker - For containerized builds
- Kubernetes - For deployment automation
- Web Search - External data leakage risk
- Browser - Uncontrolled web access
- Custom/Unverified - Unknown security posture
- Kiro Privacy and Security
- Kiro MCP Security
- Kiro MCP Configuration
- Kiro External IdP Support (Okta)
- Kiro External IdP Changelog
- AWS IAM Identity Center
- Amazon WorkSpaces SAML 2.0 Authentication
- AWS PrivateLink
- Amazon WorkSpaces
- Technology Risk Management Guidelines (Jan 2021)
- MAS Framework for Impact and Risk Assessment
- MAS Guidelines on Outsourcing
- MAS FEAT Principles (AI/ML)
For questions, issues, or feedback:
- Documentation Issues: Open an issue in this repository
- Security Concerns: Follow responsible disclosure practices
- Implementation Support: Consult with AWS Professional Services or AWS Partners
| Version | Date | Changes |
|---|---|---|
| 1.0 | 2026-02-25 | Initial release (Sections 1-4) |
| 1.1 | 2026-02-26 | Complete sections 5-10, add README |
| 1.2 | 2026-02-28 | Regulatory enhancement: PDPA, Outsourcing, AI/ML, ABS guidelines |
| 1.3 | 2026-02-28 | AWS CDK infrastructure modules (4 stacks) |
| 1.4 | 2026-02-28 | Working Kiro Skills (3 skills) + GitHub Actions CI/CD |
| 1.5 | 2026-03-11 | Add Option B: Direct IdP federation architecture (no IAM IDC), fix CDK compilation and tests |
| 1.6 | 2026-03-11 | Architecture diagrams (PNG), SECURITY.md, steering samples, README consolidation, kiro-docs tracking |
| 1.7 | 2026-06-04 | Agent Runtime Governance (Layer 4 hooks/agent/audit), security-governance-features reference, CI fixes, AGENTS.md + Kiro-targeting refactor + steering map, QUICK-REFERENCE rename |
| 1.8 | 2026-06-05 | Agent runtime governance, MDM endpoint enforcement, chaos/pentest, Key Features update |
Version: 1.8 Last Updated: June 5, 2026 Maintained By: Security Architecture Team