Skip to main content
Information Security for Workload Factory

Least privilege permission tiers for NetApp Workload Factory

Contributors netapp-rlithman
PDFs

You can restrict Workload Factory IAM permissions at any time to align with least-privilege requirements, such as limiting access to specific resources (ARNs) and applying IAM conditions, for example, tags and CIDR ranges.

Tiered permission model

Workload Factory uses a tiered permission model aligned with least privilege. You choose which capability tiers to enable when adding AWS credentials. You can start with read-only discovery and expand as needed.

Workload Factory grants all permissions through an IAM role in your AWS account, which it assumes via STS with an external ID.

Workload Factory further scopes each API call with an inline session policy.

In the Workload Factory console, the AI chat feature Ask Me helps you safely refine permissions by suggesting restriction options and generating an updated policy to apply in AWS.

Granting permissions

When adding AWS credentials to Workload Factory, you can choose which permission tiers to enable. You can enable or disable tiers at any time.

Tiers are cumulative: enabling a higher tier automatically enables all lower tiers.

Security controls

  • External ID (confused deputy protection)

  • Per-operation session policies (least privilege per request)

  • Tag-based conditions (security group modifications restricted to Workload Factory-created resources)

  • Secret ARN scoping (Secrets Manager access restricted to FSxSecret*)

  • Runtime permission validation (missing action/resource reported for targeted remediation)

Permissions documentation

The primary reference for Workload Factory permissions is the permissions reference in Workload Factory setup and administration documentation. You can find information about the impacts of removing permissions from the Storage IAM policies in this reference.