Skip to main content
Information Security for Workload Factory

Credential types for NetApp Workload Factory

Contributors netapp-rlithman
PDFs

NetAppWorkload Factory uses a split-credential model to separate AWS control-plane permissions from direct ONTAP administrative access. The AWS IAM role authenticates Workload Factory to AWS APIs for operations such as file system management, backup management, and resource discovery. ONTAP credentials authenticate direct access to the ONTAP management endpoint with a Lambda link for operations that require administrative configuration or diagnostics. Some workflows require both credential types when they combine AWS API operations with direct ONTAP management tasks.

Credential types

The following table summarizes the two credential types used in Workload Factory and their respective authentication targets.

Credential type Authenticates to Used for

AWS credentials (AssumeRole)

AWS APIs

All operations that go through the AWS FSx service API

ONTAP credentials (admin password)

ONTAP management endpoint

Operations that require direct ONTAP REST API or CLI access

AWS credential-only operations

These operations interact solely with AWS APIs and require only the IAM role:

  • File system creation and deletion

  • File system capacity and throughput changes

  • Backup creation and management

  • VPC, subnet, and security group discovery

  • KMS key enumeration

  • CloudWatch metrics retrieval

  • Cost Explorer queries

  • Tag management using the FSx API

ONTAP credentials-only operations

These operations communicate directly with the ONTAP management endpoint through the Lambda link and require ONTAP admin credentials:

  • Volume-level QoS policy configuration

  • Export policy and rule management

  • storage VM protocol configuration (NFS, CIFS, iSCSI)

  • igroup and LUN management

  • SnapMirror (replication) configuration

  • Snapshot policy management (ONTAP-level)

  • Performance diagnostics (QoS statistics, latency breakdown)

  • EMS event retrieval and analysis

  • Anti-ransomware protection status monitoring

  • FlexCache management

  • Network interface (LIF) queries

Operations requiring both AWS and ONTAP credentials

Workflow AWS credential used for ONTAP credential used for

AI-powered event analysis

Invoke Bedrock, describe file system

Retrieve EMS events, run diagnostics using SSH

File system creation with storage VM setup

Create file system (AWS API)

Configure storage VM protocols (ONTAP REST)

Volume creation with export policy

Create volume (AWS API)

Set export policy rules (ONTAP REST)

Storage capacity management

Update file system capacity (AWS API)

Check aggregate utilization (ONTAP SSH)