AWS Builder Center

Builder Center

How to Use Kiro for Network Operations

How to use Kiro CLI as an AI-powered network operations tool — replacing manual console hopping and CLI memorization with natural language prompts that discover your architecture, validate routes, analyze firewall logs, and run full operational health checks in seconds.

Dexter Moyo

How to Use Kiro for Network Operations


Network troubleshooting on AWS traditionally means juggling the VPC console, CloudWatch dashboards, CloudTrail logs, route tables, security groups, and a dozen CLI commands — often across multiple accounts and regions. A single connectivity investigation can easily consume 15–30 minutes of console-hopping before you even identify the problem.
Kiro CLI changes this. It's an agentic AI tool that operates directly from your terminal, translating natural language into real AWS CLI commands, executing them, analyzing the results, and explaining what it found. Think of it as a senior network engineer that never forgets a CLI flag.
This post walks through practical scenarios for using Kiro to operate, troubleshoot, and monitor AWS network infrastructure.

What Makes Kiro Different for Network Ops

Traditional workflow:
  1. Open the VPC console
  1. Navigate to route tables — check each VPC individually
  1. Switch to Transit Gateway console — verify attachments and routes
  1. Open CloudWatch — find the right namespace, build a query
  1. Check Security Groups and NACLs
  1. Repeat across regions/accounts
Kiro workflow:
  1. Type one prompt
  1. Get a complete, explained answer
Key capabilities:
  • Natural language → real AWS CLI commands — no memorizing flags or metric namespaces
  • Context-aware — remembers your environment throughout the session
  • Multi-service — EC2, VPC, Transit Gateway, Network Firewall, CloudWatch, SSM, and more
  • Executes, analyzes, and explains — you get results and interpretation

Getting Started

Step 1: Install Kiro CLI

Install Kiro CLI using the public installer. On macOS or Linux, run:
Bash
curl -fsSL https://kiro.dev/install.sh | bash
Verify the installation:
Bash
kiro-cli --version
Then log in to authenticate:
Bash
kiro-cli login
Kiro supports the following authentication providers:
  • GitHub — seamless integration with your GitHub account
  • Google — sign in with your Google credentials
  • AWS Builder ID — quick setup for individual developers
  • AWS IAM Identity Center — enterprise-grade authentication
  • External identity provider — connect through your organization's IdP (e.g., Microsoft Entra ID, Okta)
Once logged in to Kiro, it uses your locally configured AWS CLI credentials ( ~/.aws/credentials , environment variables, or IAM roles) to interact with your AWS account. We recommend configuring an IAM role with read-only permissions (e.g.,  ReadOnlyAccess  or a custom policy scoped to  Describe* ,  Get* ,  List* ) — this lets Kiro discover and analyze your network without the ability to modify resources. Make sure your AWS credentials have access to the networking services you want to operate on.

Step 2: Create a Network Operations Agent

Kiro uses agents — JSON configuration files that define the AI's behavior, available tools, and system prompt. For network operations, you'll want a purpose-built agent.
Create the agent:
Bash
kiro-cli agent create aiops
This creates a configuration file at  ~/.kiro/agents/aiops.json . Open it and replace the contents with:
JSON
{
  "name": "aiops",
  "description": "AWS Network Operations - troubleshooting, monitoring, and architecture discovery",
  "prompt": " You are an expert AWS network engineer. Help diagnose connectivity issues, analyze network configurations, query CloudWatch metrics and logs, and provide clear explanations of findings. Always explain what commands you are running and why. When you find issues, provide specific remediation steps.",
  "mcpServers": {
    "awslabs.cloudwatch-mcp-server": {
      "command": "uvx",
      "args": [
        "awslabs.cloudwatch-mcp-server@latest"
      ],
      "env": {
        "FASTMCP_LOG_LEVEL": "ERROR"
      },
      "autoApprove": [],
      "disabled": false,
      "transportType": "stdio"
    }
  },
  "tools": [
    "*"
  ],
  "toolAliases": {},
  "allowedTools": [
    "fs_read",
    "use_aws",
    "knowledge",
    "report_issue",
    "@awslabs.cloudwatch-mcp-server/get_metric_statistics",
    "@awslabs.cloudwatch-mcp-server/list_metrics",
    "@awslabs.cloudwatch-mcp-server/describe_alarms",
    "@awslabs.cloudwatch-mcp-server/get_dashboard",
    "@awslabs.cloudwatch-mcp-server/put_metric_data"
  ],
  "hooks": {
    "agentSpawn": [
      {
        "command": "echo '???? AI-Ops Specialist: Advanced AWS troubleshooting, monitoring, and operational intelligence for complex enterprise workloads.'",
        "timeout_ms": 5000,
        "max_output_size": 2048,
        "cache_ttl_seconds": 0
      },
      {
        "command": "echo '???? Operational Intelligence: Real-time monitoring, anomaly detection, performance optimization, and predictive analytics for AWS resources.'",
        "timeout_ms": 5000,
        "max_output_size": 2048,
        "cache_ttl_seconds": 0
      },
      {
        "command": "echo '???? Advanced Troubleshooting: Root cause analysis, log correlation, distributed tracing, and automated incident response across multi-service architectures.'",
        "timeout_ms": 5000,
        "max_output_size": 2048,
        "cache_ttl_seconds": 0
      },
      {
        "command": "echo '??? Performance Engineering: Cost optimization, resource right-sizing, capacity planning, and workload optimization using data-driven insights.'",
        "timeout_ms": 5000,
        "max_output_size": 2048,
        "cache_ttl_seconds": 0
      }
    ],
    "userPromptSubmit": [
      {
        "command": "pwd",
        "timeout_ms": 5000,
        "max_output_size": 512,
        "cache_ttl_seconds": 0
      }
    ]
  },
  "toolsSettings": {},
  "useLegacyMcpJson": false
}

Key configuration choices explained:
  •  prompt  — Tells the AI to behave as a network engineer, explain its actions, and provide remediation steps
  •  tools  —  use_aws  gives access to all AWS CLI commands;  execute_bash  enables running diagnostic tools like  dig ,  mtr , and  tcpdump  via SSM
  •  allowedTools  — Read-only tools are auto-approved without prompting; write operations still require your confirmation
  •  hooks.agentSpawn  — Hooks are commands that run automatically at specific trigger points during a Kiro agent's lifecycle. They let you inject custom behavior without manually typing commands each time.

Step 3: Set It as Your Default (Optional)

If network operations is your primary use case:
Bash
kiro-cli agent set-default aiops
Or switch to it on demand during any chat session:
Plain text
/agent aiops

Step 4: Verify It Works

Start a chat and run a quick test:
Bash
kiro-cli chat
Then type:
Plain text
Show me all VPCs in this account with their CIDR ranges

If Kiro returns your VPC list, you're ready to go.

AWS Permissions Required

For network operations, your AWS credentials need access to these services at minimum:
  • EC2 — VPCs, subnets, route tables, security groups, NACLs, ENIs, instances
  • CloudWatch — metrics, logs, alarms, Logs Insights queries
  • Transit Gateway / Cloud WAN — attachments, route tables, peering
  • Network Firewall — firewall policies, rule groups, logs
  • Elastic Load Balancing — target groups, health checks, listeners
Recommendation: Start with read-only permissions. Use an IAM role or policy scoped to  Describe* ,  Get* ,  List* , and CloudWatch  GetMetricData  /  StartQuery  actions. This lets Kiro discover your architecture, query metrics, and analyze logs without the ability to modify any resources. You always see every command Kiro runs before it executes, but read-only credentials give you an additional safety net — especially when exploring production environments. Only grant write permissions (like SSM  SendCommand  for remote diagnostics) once you're comfortable with the workflow and have reviewed the commands Kiro generates.

Scenario 1: Architecture Discovery

You just joined the team, or you're looking at an unfamiliar account. Start with the big picture:
Plain text
Describe my full network architecture — list all VPCs, their CIDR ranges, 
subnets, route tables, internet gateways, NAT gateways, and any Transit 
Gateway attachments

Kiro enumerates your VPCs, maps out the subnet layout, identifies public vs. private subnets based on route table associations, and flags any Transit Gateway or peering connections. What would take 10+ minutes of clicking through the console comes back in seconds with a structured summary.
Then get an inventory of what's running:
Plain text
List all running EC2 instances. Show me their name, instance ID, private IP, 
availability zone, and which VPC they belong to
With two prompts, you have a complete picture of the network topology and every workload running on it — no console clicking, no memorizing CLI flags.

Scenario 2: Secure Access

You need to access a private instance with no public IP and no SSH keys. Start by checking what's exposed:
Plain text
Show me the security groups for all instances. Is port 22 open on any of them?

Kiro audits every security group and tells you exactly which instances have SSH open (and to which CIDRs). Then test cross-VPC connectivity without ever opening a port:

Scenario 3: Cross-VPC Troubleshooting

Then check the Transit Gateway routing:
plaintext
Show me the Transit Gateway route tables and all VPC attachments for 
tgw-123456. Are all routes propagated correctly?
And analyze the flow logs for evidence:
Plain text
Query the VPC flow logs in /aws/vpc/flow-logs for the last hour. Show me 
the top 10 source-destination pairs by traffic volume, and separately show 
any REJECTED flows
Kiro does what would take a network engineer 15 minutes of console clicking — tested connectivity, checked TGW routes, analyzed flow logs, and verified route tables. All from natural language prompts.

Scenario 4: Load Balancer & Application Health

Check how traffic flows to your web application:
Plain text
Check the health status of all targets behind the ALB target group my-app-tg. 
Are all instances healthy?
Then pull the performance metrics:
Plain text
Get the ALB request count and target response time metrics for the last 
30 minutes for the my-app-alb load balancer
Kiro checks target health and pulls ALB metrics — all conversationally. No memorizing CloudWatch metric namespaces or building console queries.

Scenario 5: Performance Issue Detection

You suspect a performance problem. Check the compute layer:
plaintext
Check the CPU utilization metric for EC2 instance i-0a1234567
over the last 10 minutes. Is there anything abnormal?
Then correlate with the application layer:
plaintext
Check the health status of all targets behind the ALB target group my-app-tg. 
Are all instances healthy?

And check if any alarms have fired:
Plain text
Are there any CloudWatch alarms currently in ALARM state? If so, please 
investigate the root cause
Kiro detects the CPU spike in CloudWatch, correlates it with ALB latency increases and 5xx errors, checks alarm states, and provides root cause analysis — all through conversation. This is AIOps in action.

Scenario 6: Network Firewall Inspection

See what your Network Firewall is doing:
Plain text
Describe the Network Firewall rule groups for the firewall named 
my-network-firewall. What traffic is being blocked?
Then check the alert logs:
Plain text
Query the /aws/network-firewall/alert log group for the last 30 minutes. 
Show me any blocked or alerted traffic
And analyze the flow logs for traffic patterns:
Plain text
Query the /aws/network-firewall/flow log group for the last 30 minutes. 
Summarize the traffic patterns
Kiro inspects the firewall rules, analyzes the alert logs, and summarizes traffic patterns — showing you exactly what traffic is being inspected and blocked. Centralized network security with full visibility.

Scenario 7: Full Operational Health Check

This is the power move — a single prompt that covers everything:
Plain text
Give me a full operational health summary of my network. Check: all instance 
states, ALB target health, Transit Gateway status, any CloudWatch alarms in 
ALARM state, and any rejected traffic in VPC flow logs from the last hour
Kiro will:
  1. List all EC2 instances and their states
  1. Check ALB/NLB target group health
  1. Verify Transit Gateway attachment states
  1. Pull all CloudWatch alarms currently in ALARM
  1. Query VPC Flow Logs for REJECT actions in the last hour
  1. Summarize findings with severity and recommended actions
One prompt. A complete operational health check across multiple VPCs, instances, load balancers, Transit Gateway, Network Firewall, CloudWatch alarms, and flow logs. That's the power of AI-assisted network operations.

Tips for Effective Prompts

  1. Be specific about scope — "last 30 minutes", "VPC vpc-0abc123", "us-east-1" helps Kiro target the right resources
  1. Ask for explanations — "...and tell me if anything looks wrong" triggers analysis, not just data retrieval
  1. Chain prompts — Start broad ("show me the architecture"), then drill into specifics ("now check the route tables for VPC-A")
  1. Reference previous context — Kiro remembers the session, so "check the security groups for that instance" works after a previous query identified it
  1. Ask for recommendations — "What should I fix first?" after a health check gives you a prioritized action plan

What Kiro Doesn't Replace

Kiro is a powerful operational tool, but it complements — not replaces — your monitoring stack:
  • Continuous monitoring still needs CloudWatch Alarms, dashboards, and EventBridge automation
  • Long-term trend analysis still needs Athena queries over historical flow logs
  • Proactive alerting still needs properly configured thresholds and on-call workflows
  • Network design still needs human architectural judgment
Kiro excels at ad-hoc investigation, rapid triage, and operational awareness — the tasks that eat up engineering time when done manually.

Conclusion

Network operations on AWS doesn't have to mean memorizing CloudWatch namespaces, constructing Logs Insights queries from scratch, or clicking through 15 console screens to trace a connectivity path. Kiro brings the power of agentic AI to your terminal, letting you operate your network infrastructure through natural language while maintaining full visibility into every command it runs.
Try it on your next network investigation. Start with a health check prompt and see how much time it saves.

This post is a companion to  Mastering AWS Network Observability: A Practical Guide , which covers the full network monitoring toolbox across telemetry, visualization, and diagnostics.
# kiro# advanced-networking# networking# cloud-operations
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article