Social login (Google) has no profileArn; chat fails with "profileArn is required but no profiles are available

[tony-vs]

Checks

• I have searched github.com/aws/amazon-q-developer-cli/issues and there are no duplicates of my issue
• I have run q doctor in the affected terminal session
• I have run q restart and replicated the issue again

Operating system

macOS 26.3.1 (25D771280a)

Expected behaviour

After logging in with Google (SocialGoogle), kiro-cli whoami should include a resolved Profile section (including profileArn).
Running kiro-cli chat should allow sending prompts and receiving responses normally.
Chat should work for social login users without requiring an enterprise profile configuration.

Actual behaviour

kiro-cli whoami shows only:
Logged in with Google
Email address
No Profile section / no profileArn
kiro-cli chat --list-models succeeds and shows available models (auto).

Any attempt to send a message in kiro-cli chat fails with:

profileArn is required but no profiles are available. Please log in and select a profile.
This blocks all chat usage despite successful authentication.

Steps to reproduce

Install latest Kiro CLI (e.g. 1.28.2):

kiro-cli update --non-interactive

Log in using Google:

kiro-cli login

Verify identity:

kiro-cli whoami

→ Shows SocialGoogle and email, but no profile

Confirm models are available:

kiro-cli chat --list-models

Start chat and send any prompt:

kiro-cli

hello

Observe error:

profileArn is required but no profiles are available

(Optional) Attempt full reset:

kiro-cli logout
rm ~/.local/share/kiro-cli/data.sqlite3
kiro-cli login

→ Issue persists

Environment

<This will be visible to anyone. Do not include personal or sensitive information>

[q-details]
version = "1.28.2"
hash = "27868a6e6508e32a80d15e6eba2f6adbab6c2aa7"
date = "2026-03-27T00:14:48.847531Z (23h ago)"
variant = "full"

[system-info]
os = "macOS 26.3.1 (25D771280a)"
chip = "Apple M4 Max"
total-cores = 16
memory = "48.00 GB"

[environment]
cwd = "/Users/USER"
cli-path = "/Users/USER"
os = "Mac"
shell-path = "/bin/zsh"
shell-version = "5.9"
terminal = "iTerm 2"
install-method = "unknown"

[env-vars]
PATH = "/Users/USER/Downloads/google-cloud-sdk/bin:/Users/USER/.antigravity/antigravity/bin:/opt/homebrew/opt/python@3.12/libexec/bin:/opt/homebrew/opt/openjdk@21/bin:/opt/homebrew/opt/python@3.12/libexec/bin:/Users/USER/.cargo/bin:/opt/homebrew/share/google-cloud-sdk/bin:/usr/local/sbin:/usr/local/opt/maven@3.5/bin:/Users/USER/Applications/SnowSQL.app/Contents/MacOS:/Library/Frameworks/Python.framework/Versions/3.13/bin:/Library/Frameworks/Python.framework/Versions/3.13/bin:/opt/homebrew/opt/mysql-client/bin:/opt/homebrew/share/google-cloud-sdk/bin:/opt/homebrew/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/opt/pmk/env/global/bin:/Applications/VMware Fusion.app/Contents/Public:/Applications/iTerm.app/Contents/Resources/utilities:/Users/USER/.local/bin:/Users/USER/.local/bin:/Users/USER/.local/bin"
QTERM_SESSION_ID = "3477ad1c57494c8082c86c376c4aa6c5"
Q_SET_PARENT_CHECK = "1"
Q_TERM = "1.28.2"
SHELL = "/bin/zsh"
TERM = "xterm-256color"
__CFBundleIdentifier = "com.googlecode.iterm2"

[lekamj]

Hi Im having the same issue as well

[rmaleh]

I'm running into something like this as well:

Kiro is having trouble responding right now: 
   0: Failed to send the request: An unknown error occurred: profileArn is required but no profiles are available. Please log in and select a profile.
   1: An unknown error occurred: profileArn is required but no profiles are available. Please log in and select a profile.

Location:
   crates/chat-cli/src/cli/chat/mod.rs:1647

Backtrace omitted. Run with RUST_BACKTRACE=1 environment variable to display it.
Run with RUST_BACKTRACE=full to include source snippets.

Logging in using AWS Builder account works just fine, but Google login is broken.

[Malhar99]

I am experiencing the same issue. It works with my AWS Builder account, but not with Google login.

[dgeske]

Root cause + fix found

I reproduced this by attempting IAM Identity Center login first (which fails for orgs outside us-east-1), then switching to GitHub login. The browser confirms success but chat still fails.

Diagnosis: stale codewhisperer:odic entries in auth_kv poison the session. The chat module resolves them first and fails, never falling through to the working kirocli:social:token.

Check your state:

sqlite3 "$HOME/Library/Application Support/kiro-cli/data.sqlite3" \
  "SELECT key FROM auth_kv;"

If you see codewhisperer:odic:device-registration and codewhisperer:odic:token alongside kirocli:social:token, that's the bug.

Fix (no re-login needed):

sqlite3 "$HOME/Library/Application Support/kiro-cli/data.sqlite3" \
  "DELETE FROM auth_kv WHERE key LIKE 'codewhisperer:odic%';"

kiro-cli chat works immediately after. Confirmed on kiro-cli 1.28.2, macOS Apple Silicon M1, Homebrew install.

[rmaleh]

@dgeske, I ran your sqlite3 query and I did not find any of the bad keys. The issue still persists for me.

[dgeske]

Then I had a different issue that looked similar. Thanks. — Daniel Geske (he/him)

…

On 28. Mar 2026, at 22:05, rmaleh ***@***.***> wrote: rmaleh left a comment (aws/amazon-q-developer-cli#3695) <#3695 (comment)> @dgeske <https://github.com/dgeske>, I ran your sqlite3 query and I did not find any of the bad keys. The issue still persists for me. — Reply to this email directly, view it on GitHub <#3695?email_source=notifications&email_token=AADSHI3AQR7CYAPXUS63CID4TA5CRA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIMJUHA4DCMRSHE4KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-4148812298>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADSHI2VNL2R4NELZV43J4D4TA5CRAVCNFSM6AAAAACXCUPMOGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DCNBYHAYTEMRZHA>. You are receiving this because you were mentioned.

[rmaleh]

In any case, looks like 1.28.3 just shipped with a fix. Thanks.