May 29, 2026 · Platform · Security · AWS accounts
Connected AWS accounts are available in the platform
Register account metadata once while keeping read-only and deploy access as separate trust decisions.
Connected AWS accounts are now available in the zerverless platform.
An organization can register the AWS accounts it uses, then let each product request the access level required for a specific workflow.
What the platform stores
The connection record contains the role ARN and a per-customer external ID. It does not store long-lived AWS credentials. Products assume the approved role on demand through AWS STS.
Separate roles for separate trust levels
Read-only discovery and analysis do not share a role with deployment. A team can approve Air or Hero with read access without also granting Xero permission to deploy.
When deploy access is required, it is registered and reviewed separately.
Why this lives in the platform
Users, organizations, account metadata, entitlements, and usage belong to one control plane. Individual products can focus on their own job without reimplementing account access or weakening the permission boundary for convenience.