Skip to main content
Information Security for Workload Factory

AWS account integration for NetApp Workload Factory

Contributors netapp-rlithman
PDFs

Workload Factory uses AWS sts:AssumeRole to obtain temporary credentials for your AWS account, so long-term AWS access keys are not stored by the service. During onboarding, you configure an IAM role that Workload Factory can assume for approved AWS API operations, using an external ID to help prevent unauthorized cross-account access. Workload Factory then uses the resulting short-lived credentials at runtime, which AWS automatically expires after each session.

AWS account configuration

To let Workload Factory access your AWS account:

  1. Deploy an IAM role in your AWS account (using CloudFormation or manually).

  2. Ensure the role trust policy allows the service principal for Workload Factory to assume it, gated by an external ID.

  3. Use an external ID as a unique secret identifier (UUID v4) shared exclusively between the customer and Workload Factory.

    Embed it as a condition in your IAM role trust policy (sts:ExternalId).

    The external ID prevents confused deputy attacks. In a cross-account access model, an attacker who discovers a customer's role ARN cannot assume that role without also possessing the corresponding external ID. AWS recommends this pattern for third-party cross-account access. For more information, refer to the AWS IAM documentation page "Access to AWS accounts owned by third parties".

    The external ID is generated once during credential onboarding and stored encrypted alongside the role ARN in a Workload Factory database.

  4. Register the role ARN and external ID in Workload Factory.

Runtime

At runtime, Workload Factory assumes your IAM role to obtain short-lived credentials for each AWS API operation:

  1. Workload Factory calls sts:AssumeRole with your role ARN and the external ID.

  2. AWS returns temporary credentials (access key, secret key, and session token).

  3. Workload Factory uses the temporary credentials for AWS API operations in your account.

  4. Credentials expire automatically (by default, one hour).