The customer keeps the account
Connected AWS accounts remain customer-owned. UltraInfra resolves a purpose-scoped role only for the operation being evaluated and validates the exact account before execution.
Managed-launch accounts and native customer accounts converge on a revocable connection model as they graduate.
Temporary authority, exact scope
AWS STS produces temporary credentials that expire. UltraInfra combines that credential boundary with organization, project, account, region, action, workflow, and decision-ledger bindings.
Revocation is part of the product surface
Customers can disconnect the cloud connection or remove the AWS role. UltraInfra treats missing or invalid authority as a stop condition for new actions and preserves a sanitized audit trail for prior decisions.
Common questions
Does UltraInfra require AWS access keys?
No long-lived IAM user access keys are required for the supported connection model. UltraInfra assumes a customer-controlled role and receives temporary AWS STS credentials.