> ## Documentation Index
> Fetch the complete documentation index at: https://docs.valkyrie.vals.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS permissions

> Scope the AWS credentials used by Valkyrie runs.

Valkyrie uses your AWS credentials for artifact storage, logs, sandbox-provider secrets, and optional post-run integrations. In [managed AWS execution](/get-started/hosting#aws-execution-mode), local credentials are used only by local operations such as uploading an agent.

| Service           | Permissions                                                        | Used for                                                         |
| ----------------- | ------------------------------------------------------------------ | ---------------------------------------------------------------- |
| S3                | `s3:PutObject`, `s3:GetObject`, `s3:DeleteObject`, `s3:ListBucket` | Benchmark results, agent artifacts, and run outputs              |
| CloudWatch Logs   | `logs:CreateLogGroup`, `logs:CreateLogStream`, `logs:PutLogEvents` | Task execution logs in access-key runs                           |
| Secrets Manager   | `secretsmanager:GetSecretValue`                                    | Sandbox-provider credentials and webhook URLs in access-key runs |
| Lambda (optional) | `lambda:InvokeFunction`                                            | Post-run Lambda invocation in access-key runs                    |

Scope local permissions to the configured S3 bucket. For access-key execution, also scope permissions to the CloudWatch log groups, Lambda functions, and Secrets Manager secrets that the installation uses.

<Warning>
  In access-key execution, the SDK and CLI send AWS credentials to the configured tracker through `X-Harness-*` headers. Connect only to a trusted tracker and use HTTPS outside local development.
</Warning>