Does Cloudera save AWS user credentials (Access Key ID or Access Key)?
No, Cloudera doesn't save AWS user credentials. If Altus environment is set-up using Altus Quickstart, user is prompted for these credentials, but they never sent to the Altus service. They are used by the web application (in customer's brower) that sends commands directly to AWS service to create necessary resources using CloudFormation script.
In case of the Environment being created via Altus Wizard, credentials will never need to appear inside Altus console. User needs to create necessary resources in AWS console and then grant access to them using AWS cross account access mechanism, which does not involve explicit key management.