Install AlphaAgent Organisations into a new, empty AWS account, and give every AlphaAgent Studio deployment a new, empty AWS account of its own. Three reasons:
- It is AWS best practice to isolate each workload in its own account, with its own limits, billing view and permissions.
- Amazon Bedrock quotas are set per AWS account. Many users in one deployment share one quota and exhaust it; one account per deployment keeps each team's capacity its own.
- The blast radius is smaller. A problem in one deployment, or one team's mistake, cannot reach the others.
Deploy your first Studio
For the DeploymentOperator (or owner or operator), with whoever manages DNS. Before you start: a verified account whose role allows its region and us-east-1, a connected Entra tenant, the licence token, an Issued ACM certificate for the Studio hostname in the deployment's region (DNS-validated), Bedrock model access enabled there (Register an AWS account), and a sizing tier from Infrastructure sizing and costs if not the default.
1. Decide: standard or governed
The wizard's Ownership field is the one choice you cannot change later ("This cannot be changed later."): a governed deployment is a standard Studio whose resources are shared.
| Standard · personal resources | Governed · shared resources | |
|---|---|---|
| Sees, edits, runs, shares or deletes an agent, workflow, connector, environment or knowledge graph | Its creator | Everyone assigned |
| Workspace files you can open | Your own | Every user's; you still write only into your own folder |
| Sees and stops a run | Whoever started it | Everyone assigned |
| Attribution | Unchanged | Unchanged |
| Programmatic access (API keys) | Not available | The only kind a key can be bound to |
| PII redaction default | Off | Mask, preselected |
| Per-user caps (256 workflows, 256 agents) | Your own | Your own; not pooled |
Choose Standard when people build for themselves; Governed when a team maintains one set together, another system must start workflows through the API, or you want Mask as the floor. Work moves between kinds through a library (Libraries and sharing). Programmatic Access disables New API key with "Create a governed deployment first" until one exists.
2. Fill in the wizard
Open Fleet and click New deployment (disabled: "Requires the DeploymentOperator role (or owner/operator)"). The wizard is one page, saved to a draft 400 ms after you stop typing (the draft id is in the URL); re-read the text fields in Review and launch.
| Section | What to enter |
|---|---|
| Start from a template (optional) | A saved Fleet Configuration Template pre-fills fields; Start blank for a first deployment. |
| Target account | Deployment name (up to 200 characters; shown in Fleet and the header with the domain beneath; typed to confirm destructive actions). Account: only verified accounts; it sets Region and the Bedrock inference zone. |
| Release version | Version ("Versions from the AlphaAgent catalogue. A version is mirrored into your organisation the first time a job uses it."): the catalogue releases for your channel (one, 2.0.14, on a new install) plus any already mirrored; the first job on a version copies it during Preflight. Entries still copying or failed are shown but not selectable. |
| Parameters | Ownership (section 1) and the eleven fields in the next table. |
| Licence | Paste the License Token (aalk_<id>.<secret>, not the License ID) and click Provide licence. It goes once to your organisation's secret store; the section then reads Licence provided with aalk_<id>.***. Replace the licence token changes it. |
| Identity provider | The connected tenant, "<tenant name> (Microsoft Entra ID)"; no "none" option. |
The Parameters fields, one per row:
| Field | Enter | Default | Changeable later |
|---|---|---|---|
| Ownership | Standard or Governed (section 1) | none | No |
| Environment | dev, staging or prod; part of every AWS resource name | none | No |
| Cognito domain prefix | Auto-generated | generated | No |
| Studio app domain | Paste studio.example.com; stored lower case | none | Not from the console |
| ACM certificate ARN (this region) | Pick from the Issued certificates or paste the ARN | none | Not from the console |
| Bedrock inference zone | us or eu | from the region | No |
| Fargate sizing profile | xs, small, standard, large, xlarge | Automatic (standard; Review and Overview read "Automatic (resolved at install)") | Fleet Configuration Template and Update Manager |
| ElastiCache node type | cache.t4g.medium, cache.t4g.large, cache.m7g.large, cache.r7g.large, cache.r7g.xlarge | Automatic (cache.t4g.medium; shown as "Automatic (resolved at install)") | Fleet Configuration Template and Update Manager |
| Sonnet model id (runner) | The release's Sonnet model (Supported models) | Automatic (the release's default; shown as "Automatic (resolved at install)") | Fleet Configuration Template and Update Manager |
| Opus model id (planner) | The release's Opus model (Supported models) | Automatic (the release's default; shown as "Automatic (resolved at install)") | Fleet Configuration Template and Update Manager |
| Run data retention (days) | 1 to 3650 | blank, 90 | Yes, from Overview |
| PII redaction default | Off, Mask or Hash; a workflow or run can tighten (Off → Mask → Hash), never loosen | Off; Mask preselected on a governed deployment | Fleet Configuration Template and Update Manager |
Every deployment sits behind CloudFront. The deploy requests a matching us-east-1 certificate with DNS validation; if your Studio certificate was DNS-validated in ACM it validates on the same CNAME with no action. An imported or email-validated certificate stops the Edge step after 10 minutes and the failure card prints the validation CNAME to add; add it and click Resume (Troubleshooting the install).
3. Review, preflight, launch
Review and launch lists Deployment, Account and region, Release, Licence, Payload (Studio), Ownership, Run data retention, PII redaction default and CloudFront front door. Click Run preflight; while disabled its hover text names the incomplete section ("Parameters: Studio app domain is not set yet."). Results are Passed, Failed, Warning or Skipped; "Cannot launch: <checks>." blocks, "Acknowledge before launching: <checks>." parks the job later. Save as template (optional; a Name up to 100 characters; captures release and parameters, not account, region, prefix or certificate). Launch Deployment opens the progress screen with no confirmation dialog; Cancel deletes the draft, also without one.
4. Watch the install job
Expect 45 to 50 minutes (measured: 48 and 46 minutes on xs). The Jobs view shows N of M steps complete and the Provisioning steps table (#, Step, Status, Elapsed / duration); click a step for its detail, Attempt N and the log tail (Copy, Download full log). The stream reconnects if it drops and may run 30 seconds behind.
| # | Step | Does | Measured |
|---|---|---|---|
| 1 | Preflight | Readiness checks; caches bundle and images | 5 to 7 min |
| 2 | Core stack | Network, data stores, buckets, user pool | 7 to 8 min |
| 3 | Neo4j credentials | Graph database secret | seconds |
| 4 | Push Studio + env images | Images into your account | under 1 min |
| 5 | Verify the images landed | Digest check | seconds |
| 6 | Seed configuration secrets | Models, ownership, redaction, retention | seconds |
| 7 | Upload the Studio SPA | The web app | seconds |
| 8 | Edge stack (CloudFront front door, us-east-1) | us-east-1 certificate, edge function | about 1 min |
| 9 | Stateless stack (ALB) | Load balancer, distribution | about 5 min |
| 10 | Compute stack (ECS cluster) | Cluster, roles | about 1 min |
| 11 | Task-def stack (services) | Services at your sizing tier | about 18 min, the long pole |
| 12 | Wait for services + connectivity heal | Every service running and reachable | about 6 min |
| 13 | SAML SSO (required) | Enterprise Application in your tenant | seconds |
| 14 | Verify configuration | The deployment's own checks | seconds |
A second deployment launched while the first loads images waits at Preflight: "another job is already loading the images of release stable/2.0.14; waiting for it rather than doing the work twice". Step statuses: Pending, Running, Waiting for you, Succeeded, Failed, Skipped; parked and failed steps: Troubleshooting the install.
5. Create the DNS record
Overview > Endpoints shows App domain, DNS target (CNAME) (until it exists: "appears once the Edge step (8 of 14) has finished, usually 20 to 25 minutes in"), Load balancer and CloudFront front door; the Overview re-reads itself every 15 seconds while the job runs. Create one record at your DNS provider, pointing at the distribution, never at the load balancer:
CNAME <Studio app domain> -> <DNS target (CNAME) value>
What you should see
The header shows the deployment name with the app domain beneath, Status Healthy and Version 2.0.14 (reload after the job ends). Endpoints > CloudFront front door reads "Always on · waiting for the CNAME" until your record resolves, then "Always on · origin locked". Jobs lists the install job Succeeded. https://<Studio app domain> shows the Studio sign-in page; nobody can sign in until After the deploy.
Notes
- Fixed for life: Environment, Cognito domain prefix, Ownership, region; the Parameters table says how the other fields change.
- Wrong kind chosen: create another deployment and delete the first (Deleting a deployment).
- The front door cannot be switched off; one draft launches one deployment; the wizard does not check Bedrock model access.
?minimal=1on the wizard URL deploys "A minimal test deployment, not Studio itself" in about two minutes, without domain, certificate or prefix, to prove the account can take a deployment.