# How UltraInfra accesses customer AWS accounts

[Website page](https://ultrainfra.ai/guides/how-ultrainfra-accesses-aws/)

> UltraInfra uses purpose-scoped, revocable AWS roles and temporary STS credentials rather than requiring customers to transfer account ownership or provide long-lived access keys.

Reviewed 2026-09-02. By UltraInfra.

## The customer keeps the account

Connected AWS accounts remain customer-owned. UltraInfra resolves a purpose-scoped role only for the operation being evaluated and validates the exact account before execution.

Managed-launch accounts and native customer accounts converge on a revocable connection model as they graduate.

## Temporary authority, exact scope

AWS STS produces temporary credentials that expire. UltraInfra combines that credential boundary with organization, project, account, region, action, workflow, and decision-ledger bindings.

## Revocation is part of the product surface

Customers can disconnect the cloud connection or remove the AWS role. UltraInfra treats missing or invalid authority as a stop condition for new actions and preserves a sanitized audit trail for prior decisions.

## Common questions

### Does UltraInfra require AWS access keys?

No long-lived IAM user access keys are required for the supported connection model. UltraInfra assumes a customer-controlled role and receives temporary AWS STS credentials.

## Primary references

- [AWS: Secure access keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/securing_access-keys.html)
- [AWS: Temporary security credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html)