How to Use Amazon AI Coding: A Practical Walkthrough

Amazon's Two AI Coding Tools, and Why the Stakes Are Higher Than You Think

Amazon now ships two very different AI coding products, and understanding the difference is the first step to using either one safely. The stakes are higher than most teams realize: the same tools that promise dramatic speed gains have been linked — by reporting Amazon partially denies — to outages that cost millions of orders.

First, the two tools. Kiro is an agentic IDE built around spec-driven development: you turn a prompt into requirements, iterate on a design, and then let parallel agents implement sequenced tasks across multiple files, running locally or in the cloud — they "keep working in the cloud when you step away," according to the product's official site. It supports multiple models (Claude, GPT, DeepSeek, Qwen, or an Auto mode) and open standards like MCP, AGENTS.md, and Skills.md.

Amazon Q Developer, by contrast, is an assistant focused on inline code suggestions, unit test generation, security scanning, and code transformation — AWS highlights its ability to convert entire Java 8 codebases to Java 17, plus a /dev agent that implements multi-file features from natural language. Both products offer free tiers alongside paid Pro tiers, per AWS's own comparison page.

Now the uncomfortable part. Per Stack Overflow's 2025 survey of 49,000 developers, 84% of developers now use AI coding tools, and 51% use them daily. Yet security experts warn these agents operate with the developer's full privileges, and no model provider has solved prompt injection. In 2025, a compromised Amazon Q Developer VS Code extension containing a malicious prompt injection passed Amazon's verification and sat publicly available for two days.

The reported damage is hard to ignore:

• March 2, 2026: a roughly 6-hour outage with 120,000 lost orders and ~1.6 million website errors, with internal review identifying Q as a primary contributor.
• March 5, 2026: a 99% drop in US orders and 6.3 million lost orders.
• December 2025: a 13-hour AWS outage traced to changes made with Kiro, which reportedly "opted to delete and recreate the environment."

Here's the contradiction worth knowing: Amazon denies its AI tools caused the outages as characterized in press reports, saying only one reviewed incident was AI-related — while Business Insider and Financial Times reporting attributes specific incidents to Q and Kiro. Both perspectives appear in the reporting, so treat attribution as contested, not settled. What isn't contested is Amazon's response: internal warnings of a "trend of incidents" with a "high blast radius," plus new "deterministic and agentic safeguards" and "controlled friction."

The lesson isn't to avoid these tools — it's to extend them carefully. Because Kiro natively supports skills and MCP, the instruction packages you plug in matter enormously. SkillzBench, a free independent directory from AIQ Labs, is being built to verify, security-scan, and benchmark agent skills before they touch your toolchain — a meaningful safeguard in an ecosystem where published research found roughly 26% of skills carry at least one vulnerability.

The Walkthrough: Spec First, Then Parallel Agents

Amazon's AI coding stack rewards a specific discipline: define the spec before you let agents touch a single file. Kiro, AWS's spec-driven IDE, turns a prompt into requirements, then an architectural design, then sequenced tasks — and only then hands implementation to parallel agents that run locally or in cloud sessions that keep working when you step away.

That sequencing matters more than it sounds. Agents can choose Anthropic Claude, OpenAI GPT, open-weight models like DeepSeek and Qwen, or an Auto mode that picks based on complexity, quality, latency, and cost. Validation runs through hooks and triggers — property-based tests that assert rules holding across all inputs, plus auto-run unit tests on push — so correctness gets checked by something other than the model's own confidence.

Amazon Q Developer complements Kiro rather than duplicating it. Its transformation engine moves entire Java 8 codebases to Java 17, it generates unit tests, scans inline for security issues, and its /dev agent implements multi-file features from natural language while respecting existing patterns.

Before connecting anything, lock down the control points AWS itself flags:

• Scope each MCP server to the minimum tools it needs — never the full set.
• Use dedicated, scoped-down credentials instead of the developer's own.
• Maintain an allowlist of reviewed servers only.
• Never set autoApprove: ["*"] in .kiro/settings/mcp.json.
• Reserve human approval for writes, deletions, code execution, and production deploys.

The stakes are documented, not hypothetical. Amazon's own security guidance warns that steering "biases generation toward secure defaults; it doesn't guarantee them," and that code which compiles, passes linting, and looks reasonable can still be functionally wrong. Reporting has attributed specific production incidents to these tools — including a December 2025 AWS outage traced to changes made with Kiro — though Amazon denies the characterization and says only one reviewed incident was AI-related.

One honest caveat: no official step-by-step tutorial exists for this workflow. What's above is synthesized from AWS's product positioning and its own security framework — which is exactly why the guardrails belong in the walkthrough, not in a footnote. Agent skills can automate the rest of this workflow; SkillzBench is building a free directory and MCP connector that verify, scan, and benchmark skills before they reach your agent.

Lock Down MCP and Steering Before You Let Agents Touch Anything

Before you let a Kiro agent or Amazon Q's /dev agent touch your codebase, you need guardrails in place — because AWS itself learned this lesson the hard way. A single agent can open dozens of PRs across repositories in an afternoon, and as AWS's own security team puts it, agents "optimize for task completion at machine speed with no understanding of your organization's risk" (AWS Security Blog).

AWS prescribes a two-layer control framework. The first layer is author-time controls in the IDE: steering documents that encode security invariants (no hardcoded credentials, no wildcard ARNs), reviewed specifications before implementation, scoped MCP access, IDE code scanning, and hooks that run automated validation on agent output. The second layer is build-time gates in your pipeline: secrets detection, SAST, SCA, and IaC scanning — with builds that fail on critical findings, not just warn.

MCP configuration is the single most important control point. Per AWS's guidance:

• Scope each MCP server to the minimum set of tools the agent actually needs.
• Use dedicated, scoped-down credentials — never the developer's own permissions.
• Maintain an allowlist of reviewed MCP servers only.
• Never set autoApprove: ["*"] in .kiro/settings/mcp.json.

The stakes here are real, not theoretical. In 2025, a hacker compromised the official Amazon Q Developer VS Code extension with a prompt injection directing it to wipe local files — and it passed Amazon's verification and stayed live for two days (Fortune reported). Security experts note that agentic tools operate at developer privilege level, and prompt injection remains unsolved across every model provider.

The same caution applies to agent skills and MCP extensions you bolt onto these tools. Published research found roughly 26% of agent skills carry at least one vulnerability, which is why SkillzBench is building a free directory that security-scans, license-checks, and benchmarks every skill in a sandbox before you equip it — with a free MCP connector that lets you toggle exactly which skills and tools each agent can see.

One caveat AWS itself makes clear: steering documents bias generation toward secure defaults, but don't guarantee them (per the framework's authors). Code that compiles, passes linting, and looks reasonable can still be functionally wrong. Steering nudges; deterministic gates enforce. You need both, plus human review for anything irreversible — because the agent that "looks fine" is exactly the one that deletes and recreates your production environment.

Human Approval, Skill Vetting, and What to Do This Week

Speed is the whole point of agentic coding — until an agent deletes and recreates a production environment on its own initiative. That's reportedly what happened in a December 2025 AWS outage traced to changes made with Kiro, and it's why Amazon is now adding what its SVP of e-commerce services calls "controlled friction" back into the pipeline (internal communications reported by Indian Express).

Not everywhere — that kills the productivity gains. The OWASP AI Agent Security Cheat Sheet recommends a risk-tiered approach:

• Read-only operations (listing files, querying data) can run automatically.
• Writes, executions, deletions, and production deployments require human approval bound to the exact tool call and its parameters — not a blanket sign-off.
• Unknown or unlisted tools should fail closed: the agent stops rather than improvising.

The stakes justify the friction. One reported Amazon outage lasted roughly six hours, cost about 120,000 lost orders, and generated around 1.6 million website errors — with the AI coding tool Q identified internally as a primary contributor. AWS's own security blog is blunt about why: agents "optimize for task completion at machine speed with no understanding of your organization's risk" (AWS Security Blog). Treat review of AI-generated changes as non-negotiable, especially before anything touches production.

Kiro natively supports Skills.md, AGENTS.md, and MCP — the same open-standard ecosystem where agent skills live (per Kiro's documentation). That's powerful, but it's also a supply-chain surface: published research found roughly 26% of agent skills carry at least one vulnerability, and security experts note that supply chain risk is "even more prevalent now with AI tools" (Fortune). Installing an unvetted skill into an agent running at developer privilege level is a real risk, not a theoretical one.

That's the gap SkillzBench is building to close: a free, independent directory where every skill is version-pinned, license-checked, security-scanned, and benchmarked in a sandbox to measure the Lift it actually delivers. A free MCP connector will let you equip agents with only the vetted skills you choose — nothing more.

Start small and ship safely. Audit your .kiro/settings/mcp.json for autoApprove: ["*"] and scope every MCP server to minimum tools with dedicated credentials. Encode your approval tiers using the OWASP classification above. Then, before adding any new skill to your workflow, verify it — scan it, check its provenance, and benchmark whether it genuinely helps. Fast agents are worth having; trustworthy ones are worth keeping.