Skip to main content
Information Security for Workload Factory

Encryption and key management for NetApp Workload Factory

Contributors netapp-rlithman
PDFs

NetApp Workload Factory uses encryption at rest and defines clear key-management responsibilities across Workload Factory and AWS services. For Amazon FSx for NetApp ONTAP file systems, you can choose your own AWS KMS key or use the AWS-managed default key, and FSx for ONTAP performs the cryptographic operations with that key. Workload Factory also uses envelope encryption to protect stored ONTAP credentials.

KMS encryption-at-rest scope for FSx

When creating an FSx for ONTAP file system through Workload Factory, you can optionally specify your own AWS KMS key for data-at-rest encryption. If you don't specify a key, Workload Factory uses the AWS-managed default FSx key.

What is encrypted

All data stored on the underlying EBS volumes backing the FSx for ONTAP file system (AWS FSx encryption at rest).

Key ownership

The KMS key resides in your AWS account.

Permissions required for key selection and use

Workload Factory requires:

  • kms:DescribeKey

  • kms:ListKeys

  • kms:ListAliases

  • kms:CreateGrant (to allow the FSx for ONTAP service to use the key)

Key access pattern

Workload Factory never directly encrypts or decrypts data with your KMS key. It passes the key ID to the Amazon FSx for NetApp ONTAP API during file system creation; Amazon FSx for NetApp ONTAP performs the cryptographic operations.

Credential protection (service-side envelope encryption)

When you store ONTAP credentials (admin passwords) through Workload Factory, it protects them using envelope encryption before persisting them.

Encryption method

AES-256-CBC with a unique data encryption key (DEK) per credential record.

Envelope encryption flow

  1. A unique 256-bit DEK is generated per credential.

  2. The DEK encrypts the credential (password).

  3. The DEK itself is encrypted with a root key and stored alongside the encrypted credential.

  4. The plaintext DEK is never stored.

Encryption context

Each data key is cryptographically bound to its specific credential record, preventing key reuse across records.

Alternative: AWS Secrets Manager

Instead of storing encrypted passwords in the service, you can store ONTAP credentials in AWS Secrets Manager in your own account. Workload Factory never sees or stores the password; it passes the Secrets Manager ARN to Lambda link, which retrieves the password at runtime within your VPC.

Note AWS Secrets Manager is required for GovCloud accounts.