Skip to main content
Information Security for Workload Factory

AWS credential retention for NetApp Workload Factory

Contributors netapp-rlithman
PDFs

Workload Factory secures credential handling through short-lived AWS STS credentials, encrypted role metadata, and bounded retention behavior. The credential model separates retained role metadata from temporary AWS credentials used for API operations. Temporary credentials are cached only for a limited period and expire automatically under AWS enforcement. Removing a credential prevents Workload Factory from obtaining new credentials for the account, while any cached credentials expire shortly afterward.

Key behaviors

  • Workload Factory does not store long-term AWS access keys.

    Workload Factory stores only a pointer (role ARN) and a shared secret (external ID). Neither grants AWS access on its own.

  • Temporary AWS STS credentials have a hard maximum lifetime of one hour (AWS-enforced).

    Workload Factory caches them in Redis for at most 30 minutes before forcing a fresh STS call.

  • If a cached credential set has fewer than 15 minutes remaining, Workload Factory discards it and obtains a new one.

  • Credential deletion by the customer immediately revokes the ability for Workload Factory to access that account.

    The next AssumeRole call fails, and cached credentials expire within minutes.

Retention and storage summary

Data Storage location Retention duration Autoexpires? Deletion method

IAM role ARN + external ID

MySQL (encrypted at rest)

Indefinite (stored until customer explicitly removes)

No

Customer clicks "Delete credential" in the UI

Temporary AWS STS credentials (access key + secret + session token)

Redis (in-memory cache)

Maximum 30 minutes (cache TTL). Underlying STS credentials are valid for up to one hour (AWS default). Cache evicts five minutes before expiry as a safety margin.

Yes (Redis TTL auto-evicts; AWS credential expiry is enforced by AWS)

Automatic

ONTAP admin password

MySQL (AES-256-CBC envelope encryption using KMS)

Indefinite (stored until the customer removes the credential or deletes the file system)

No

Customer deletes the credential, or file system deletion triggers cleanup

Decrypted ONTAP password (plaintext)

In-memory only (never written to disk or cache)

Duration of a single request (milliseconds)

Yes (garbage collected after the request completes)

Automatic

Security controls

  • External ID prevents confused deputy attacks.

  • Session policies enforce per-request least privilege.

  • Workload Factory refreshes short-lived temporary AWS STS credentials before risky expiry windows.

  • Regional and account-type handling differs for Standard, GovCloud, and China environments.

  • Workload Factory never stores long-term AWS access keys.

  • Workload Factory never modifies your IAM role’s permissions.

  • Workload Factory never escalates beyond the permissions granted by your role policy.

  • Session policies can only reduce permissions; Workload Factory never expands them.