Skip to main content
Valkyrie separates two choices. Hosted or self-hosted determines who operates the tracker and executor host. Managed or access-key AWS determines which AWS account and credentials a run uses. Hosted mode supports both AWS execution modes; eligible organizations default to managed AWS and can configure access keys to run against their own AWS resources instead.

​
Hosted mode

Hosted mode uses Vals-managed compute infrastructure. Vals API key authentication isolates data per organization.

​
Requirements

  • A Vals API key provided by Vals
  • Local AWS SDK credentials for direct agent uploads and artifact downloads, including AWS_PROFILE with AWS SSO
  • A sandbox-provider secret
  • For access-key execution, AWS credentials with the required permissions and an existing S3 bucket
Run configuration and choose hosted:
The CLI validates the Vals API key and configures the organization. When the organization can use managed AWS, it reads the Region and S3 bucket from the tracker instead of asking for access keys. Set a Vals API key directly when needed:
Contact contact@vals.ai for hosted access.

​
AWS execution mode

The AWS credential fields in the selected config determine the execution mode of new runs. Managed execution still allows local AWS operations. Agent uploads and artifact downloads use the local AWS SDK credential chain. To use access-key AWS in hosted mode, run hosted setup first, then add a complete access-key configuration:
Add valkyrie config set AWS_SESSION_TOKEN <session-token> for temporary credentials. Return to managed execution by removing the credential fields; the Region and bucket remain for local AWS operations.
The tracker stores the AWS execution mode when a run starts. Retrying or resuming a run uses the stored mode rather than the current local config, so an access-key run still requires the access-key configuration it started with.

​
Self-hosted mode

Self-hosted mode uses your tracker service and AWS infrastructure.

​
Requirements

Point the CLI at your tracker before configuration:
Then run configuration and choose self-hosted:
Self-hosted mode does not use a Vals API key or Descope authentication. The tracker assigns data to its default organization. Review the infrastructure guide before deploying the included AWS CDK application.