Amazon Q and Kiro: Write and Fix AWS Cloud Code Faster with AI

By Ravindra Bagale, trainer · LinkedIn · Last updated: 19 October 2026

Generative AI course · Chapter 48 · Estimated reading time: 11 minutes

1. Suppose a junior engineer inherits a messy AWS account

Suppose Rahul joins a small company's cloud team. In his first week he finds an IAM policy nobody can explain, a CloudFormation template that fails to deploy, and a note saying "list all the big files in the reports bucket". He could spend the day reading documentation, or ask an AI helper to explain, fix and draft, and then check each answer.

That second way is faster, but only if he checks. In the cloud, a confident wrong answer can open data to the internet.

2. Amazon Q Developer and Kiro in October 2026

Checked on the AWS and Kiro pages on 19 October 2026:

• Amazon Q Developer in the AWS console continues to be available. You can ask questions about AWS and get help to diagnose common errors right in the console. This is included in the free tier.
• Amazon Q Developer IDE plugins and paid subscriptions are being retired: new sign-ups stopped on 15 May 2026, and the plugins and paid subscriptions reach end of support on 30 April 2027. Existing users keep access until then.
• Kiro is the replacement for coding in your editor and terminal. It is an agentic development environment (an IDE and a CLI) that works from written specs, can run hooks (for example, run tests when you save), and supports MCP. Q Developer Pro subscriptions can also be used with Kiro.
• Kiro plans: a permanent Free tier with 50 credits a month (some models only), then Pro at USD 20 a month (1,000 credits), Pro+ USD 40, Pro Max USD 100 and Power USD 200. Prices exclude taxes; check kiro.dev before you buy.

So, in short: use Q in the console for questions and error help while you work in AWS, and Kiro (or another AI coding tool from the AI coding tools chapter) for writing code and templates on your laptop.

3. Worked example 1: explain an IAM policy and catch the risky line

Rahul finds this policy (bucket names are dummies):

{
  "Version": "2012-10-17",
  "Statement": [
    {"Sid": "ReadReports", "Effect": "Allow", "Action": ["s3:GetObject", "s3:ListBucket"],
     "Resource": ["arn:aws:s3:::dummy-reports-bucket", "arn:aws:s3:::dummy-reports-bucket/*"]},
    {"Sid": "TooBroad", "Effect": "Allow", "Action": "s3:*", "Resource": "*"}
  ]
}

Prompt (in Q in the console, Kiro, or any AI chat; never paste real account IDs or secrets):

Explain this IAM policy line by line for a beginner. Then tell me which statement
gives more access than needed, and rewrite it with least privilege so the user can only
read dummy-reports-bucket.
[paste the policy]

Expected output (yours will be similar, not the same): statement 1 lets the user list the bucket and read its files; statement 2 allows every S3 action on every bucket, including delete, and should be removed because statement 1 already gives the read access needed.

Check it yourself with a tiny script (a second opinion that does not depend on AI):

import json
policy = json.load(open("policy.json"))
for st in policy["Statement"]:
    actions = st["Action"] if isinstance(st["Action"], list) else [st["Action"]]
    resources = st["Resource"] if isinstance(st["Resource"], list) else [st["Resource"]]
    problems = []
    if any(a == "*" or a.endswith(":*") for a in actions): problems.append("wildcard action")
    if "*" in resources: problems.append("all resources")
    print(f"{st.get('Sid', '?')}: {st['Effect']} {', '.join(actions)} on {', '.join(resources)}")
    print("   ->", "RISKY: " + " + ".join(problems) if problems else "OK: limited actions on named resources")

Real output (19 October 2026):

ReadReports: Allow s3:GetObject, s3:ListBucket on arn:aws:s3:::dummy-reports-bucket, arn:aws:s3:::dummy-reports-bucket/*
   -> OK: limited actions on named resources
TooBroad: Allow s3:* on *
   -> RISKY: wildcard action + all resources

The AI and the script agree, so Rahul removes TooBroad. For more patterns, see our guide AWS IAM Policy Examples (JSON) Explained Line by Line, and test policies with the IAM policy simulator before you attach them.

4. Worked example 2: fix a broken CloudFormation template

The template that fails to deploy:

AWSTemplateFormatVersion: "2010-09-09"
Description: Dummy reports bucket (with 3 mistakes)
Resources:
  ReportsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: dummy-reports-bucket-2026
      VersioningConfiguration:
        Status: Enable
      PublicAccessBlockConfig:
        BlockPublicAcls: true
Outputs:
  BucketName:
    Value: !Ref ReportBucket

First, a real check. cfn-lint is AWS's free open-source linter for CloudFormation (pip install cfn-lint). It finds mistakes before you deploy:

cfn-lint bucket-broken.yaml

Real output (cfn-lint 1.57.2, 19 October 2026):

E3030 'Enable' is not one of ['Enabled', 'Suspended']
bucket-broken.yaml:9:9

E3002 Additional properties are not allowed ('PublicAccessBlockConfig' was unexpected. Did you mean 'PublicAccessBlockConfiguration'?)
bucket-broken.yaml:10:7

E6101 'ReportBucket' is not one of ['ReportsBucket', 'AWS::AccountId', 'AWS::NoValue', 'AWS::NotificationARNs', 'AWS::Partition', 'AWS::Region', 'AWS::StackId', 'AWS::StackName', 'AWS::URLSuffix']
bucket-broken.yaml:14:5

Then ask the AI to fix it, giving it the errors:

Fix this CloudFormation template. Here are the cfn-lint errors. Also turn on all 4
public access block settings. Return only the corrected YAML and a list of what you changed.
[paste the template and the errors]

Expected output (yours will be similar, not the same): a corrected template with Status: Enabled, PublicAccessBlockConfiguration with all 4 settings set to true, and !Ref ReportsBucket, plus a 4-line change list.

Check the fix with the same tool:

cfn-lint bucket-fixed.yaml

Real output: no messages, and the exit code is 0. The template is now valid. Before deploying, still read it once: a valid template can still create something you did not want.

Giving the AI the exact linter errors gives a much better fix than "it doesn't work, fix it".

5. Worked example 3: write AWS CLI commands safely

Rahul's task: "list all the big files in the reports bucket".

Prompt:

Write AWS CLI commands to:
1. list all files in s3://dummy-reports-bucket larger than 100 MB, with size and date,
2. show the total size of the bucket.
Use read-only commands only. Explain each part of each command in one line.
Do not include any command that deletes, moves or changes anything.

Expected output (yours will be similar, not the same): a command using aws s3api list-objects-v2 with a --query filter on Size, a second command such as aws s3 ls s3://dummy-reports-bucket --recursive --summarize --human-readable, and a one-line explanation for each option.

Safe-use steps:

1. Run the commands with a read-only IAM user first.
2. If a command has rm, delete, put or --force, stop and read it twice.
3. For commands that support it, try --dryrun (for aws s3 copy, move and sync) or --dry-run (for many EC2 commands) first.
4. Save working commands in a notes file with a comment on what each does.

Our How to Install and Configure AWS CLI (Windows, Mac, Linux) guide sets up the CLI and a profile.

6. Which helper for which cloud task

Whichever you use, give it the exact error text, the AWS Region and what you expected, and ask it to explain its answer, not only to give it. An explanation is easier to check than a bare command.

7. The 5 rules for AI-written cloud code

1. Never paste secrets, account IDs you must protect, or customer data into prompts.
2. Least privilege first: ask the AI for the smallest permissions, and challenge every *.
3. Check with a real tool: cfn-lint, the IAM policy simulator, dry runs, read-only commands.
4. Test in a sandbox account or a test stack, never straight in production.
5. Keep a person in charge of anything that deletes, opens access or costs money.

8. Beginner mistakes and quick fixes

9. Try at home

Recap

Let AI draft and explain your cloud code, and let real tools and your own eyes approve it. That pairing is faster and safer than either alone.

Previous chapter: RAG on AWS: Bedrock Knowledge Bases with S3 (Step by Step)

Next chapter: AWS AI Practitioner (AIF-C01): 20 Practice Questions by Domain

Ravindra Bagale, trainer: linkedin.com/in/ravindra-bagale. Rahul, the company, the policy and the bucket names on this page are made up for learning. Amazon Q Developer and Kiro facts were checked on the AWS DevOps blog, the Amazon Q Developer pricing and FAQ pages, and kiro.dev on 19 October 2026. The script and cfn-lint output were produced on 19 October 2026. AI output changes every time, so your output will be similar, not the same.