Credential storage options for NetApp Workload Factory
Suggest changes
PDFs
NetApp Workload Factory supports credential handling patterns that preserve least privilege and reduce exposure of ONTAP administrative secrets. AI-powered diagnostic features use read-only ONTAP credentials when available so the diagnostic agent can observe and diagnose without modifying the storage environment. You can use Workload Factory-managed encrypted storage or store the ONTAP password in AWS Secrets Manager and provide Workload Factory with a reference. The choice affects where the password is stored, how it is encrypted, and how you manage requirements such as GovCloud support and credential rotation.
Read-only ONTAP access model
For AI-powered features like event analysis and latency diagnostics, Workload Factory uses read-only ONTAP credentials when available. The read-only credential model ensures the AI diagnostic agent cannot make modifications to your storage environment—it can only observe and diagnose.
Credential storage options comparison
AWS credentials
AWS credentials are always assumed through an IAM role. Workload Factory can either manage the role information internally or reference it from AWS Secrets Manager.
| Option | AWS credentials | What's stored | Encryption |
|---|---|---|---|
Workload Factory managed |
IAM role ARN + external ID |
IAM role ARN + external ID |
Role ARN is not a secret (stored as-is) |
ONTAP credentials
Workload Factory can manage ONTAP credentials internally with encrypted storage or reference them from AWS Secrets Manager. The choice affects how the password is stored, encrypted, and rotated.
ONTAP credentials are required for Workload Factory to interact with the ONTAP file system APIs through a Lambda link.
| Option | ONTAP credentials | What's stored | Encryption |
|---|---|---|---|
Workload Factory managed |
Password (encrypted) |
ONTAP admin password (encrypted) |
ONTAP password uses AES-256 envelope encryption |
AWS Secrets Manager |
Secrets Manager ARN reference |
Secrets Manager ARN |
Secrets ARN is not a secret (stored as-is); AWS Secrets Manager encrypts the secret in your account |
Additional considerations
- GovCloud requirement
-
Standard IAM role is used; ONTAP credentials must use Secrets Manager (password storage not permitted).
- Rotation
-
Role policies are updated in your account. Update the ONTAP password in Workload Factory (managed option) or rotate it in AWS Secrets Manager.