Workload Factory is a lifecycle management platform for optimizing workloads, such as databases, VMware migrations, and EDA projects, which run on FSx for ONTAP file systems. Workload Factory itself is free to use. You pay AWS for the services you deploy, such as FSx for ONTAP file systems, VMware Cloud on AWS infrastructure, and other AWS services.

Learn about Workload Factory.

Workload Factory works in all commercial regions where FSx for ONTAP is supported, but not in China regions, Secret Cloud, or Top Secret Cloud.

View supported AWS regions.

Both are web-based consoles that give you access to Workload Factory. The NetApp Console offers a hybrid experience where you manage FSx for ONTAP file systems and workloads in one place alongside other data services. The Workload Factory console is a dedicated experience focused on workloads running on FSx for ONTAP.

Decide which console to use.

Sign up with your NetApp Support Site (NSS) credentials or create a NetApp cloud login. For a cloud login, you must verify your email address before you can log in. At first login you create an account, which organizes your resources, workloads, and credentials, and you become the account admin with access to all Workload Factory functionality. If you already use the NetApp Console, you already belong to an account because Workload Factory uses NetApp accounts.

Sign up and log in.

Select the GovCloud (US) option if you need an account that uses only GovCloud (US) endpoints and regions, with credentials and secrets staying in GovCloud. This selection is permanent. GovCloud accounts must add credentials and create Links manually.

You can manage your account only from the NetApp Console. An account admin adds members there, and the invited user receives an email with instructions to join.

Invite other users to your account.

Adding credentials is optional to get started, so you can use Workload Factory without accessing your AWS account. However, to create and manage FSx for ONTAP file systems and to deploy and manage workloads such as databases, Workload Factory needs credentials.

Credentials use an AWS assume role flow. Each set of credentials consists of one or more IAM policies, based on the workload capabilities and permission levels you select, and an IAM role that Workload Factory assumes. You can add more capabilities later at any time.

Add credentials.

With the manual method, you create the IAM policies and IAM role in the AWS Management Console, copying the policy JSON from Codebox. With the automatic method, you select capabilities and a CloudFormation stack creates the IAM policies and IAM role for you. GovCloud (US) credentials must be added manually, because CloudFormation isn't supported there.

Add credentials.

Permission policies are bundled by workload. For Storage, the choices are View, planning, and analysis, Operations and remediation, and File system creation and deletion. Database workloads offer View, planning, and analysis, Operations and remediation, and Database host creation. The policies let you assign incremental trust based on your IT policies. Select only the capabilities you plan to use now.

Permissions reference.

Selecting Enable automatic permissions check adds iam:SimulatePrincipalPolicy to your permission policies so Workload Factory can confirm that you have the required AWS permissions before it completes operations. You can remove it after adding credentials, but keeping it is recommended. It prevents resource creation for partially successful operations and saves you from manual resource cleanup.

Enable the automatic permissions check when you add credentials.

You can delete credentials only if they aren't associated with an FSx for ONTAP file system. Use Remove in the Workload Factory console or Delete in the NetApp Console.

Remove credentials.

A Link creates a trust relationship and connectivity between a Workload Factory account and one or more FSx for ONTAP file systems. Links use AWS Lambda so you can monitor and manage features through ONTAP REST API calls that the Amazon FSx for ONTAP API doesn't provide. You don't need a Link to get started, but you need one to unlock all Workload Factory features.

Learn more about Links.

Features that require a Link include:

If you try an operation that needs a Link and none is associated, Workload Factory tells you. See Learn more about Links.

Yes. Each Lambda transaction incurs an AWS charge. Because Lambda acts as a proxy, you are charged when it sends a request to the ONTAP REST API on a file system and again when it sends the response back to Workload Factory.

Learn more about Links.

One Link can be associated with many FSx for ONTAP file systems. Each file system can be associated with only one Link in the same NetApp account. If you have multiple NetApp accounts, a file system can be associated with additional Links under different accounts. See Learn more about Links.

Automatic creation registers the Link through Workload Factory, but it uses tokens for Workload Factory automation and its CloudFormation code can be used for only up to six hours. Manual creation uses CloudFormation or Terraform from Codebox, and the code persists. This is useful when teams such as Security and DevOps must first grant permissions. GovCloud accounts must create Links manually.

Create a Link.

You need the required ports open in the file system's security group, the ability for the Link to reach https://api.workloads.netapp.com, and sufficient AWS permissions to create CloudFormation stacks.

Learn about the complete list of prerequisites to create a Link.

No. A Link supports only one authentication method, either Workload Factory credentials or AWS Secrets Manager, and you can't change it later.

You can't edit a Link in the interface. To change one, create a new Link and associate it with the file system. Changing the Lambda network configuration in AWS is not recommended because it can cause connectivity issues.

Manage Links.

File systems and other resources that used the Link can no longer use functionality that depends on it. The Link is deleted only from Workload Factory, not from AWS, so you must also delete the Lambda function in your AWS account.

Remove a Link.

Codebox is an Infrastructure as Code co-pilot that generates the code to run any operation that Workload Factory supports. It supports Workload Factory REST APIs, AWS CLI, AWS CloudFormation, and Terraform. Codebox Viewer shows code generated from your wizard entries, and the Automation Catalog stores saved jobs as reusable templates.

Learn more about Codebox.

Codebox Viewer is read-only. You can only copy the code, save it to the Automation Catalog, or download it for some formats. You can edit downloaded code to adapt it to other AWS accounts. CloudFormation YAML code expires after seven days for security reasons.

Use Codebox.

CloudShell runs AWS CLI and ONTAP CLI commands in a browser-based shell, proxied through the Workload Factory backend, by using the AWS and ONTAP credentials you provided. It requires at least one AWS credential. Shell operators such as pipe |, background &, and redirection > aren't supported, and commands that include them fail. AWS commands succeed only if the selected credentials have permissions in the chosen region.

Use CloudShell.

Workload Factory can send notifications as NetApp Console alerts, as email to addresses associated with the account, or to an Amazon SNS topic. Console alerts appear when you have a Console agent or Link deployed. When you configure notifications in the NetApp Console, it takes ownership of delivery and the Workload Factory console notification options become read-only.

Configure notifications.

Workload Factory supports only the Standard SNS topic type, which doesn't guarantee that notifications reach subscribers in the order received. Consider this for critical or emergency notifications. A subscriber receives all notifications on the topic by default, so use an SNS filter policy (by resource type, workload, priority, or notification type) to receive only what you need.

Configure notifications.

Use a service account for API-only automation so scripts don't depend on a person's user account. The client secret is shown only once and Workload Factory doesn't store it, so copy or download it when you create the service account. Access tokens generated from the client ID and secret are short-lived and last only several hours. In the Workload Factory console you can only create or delete service accounts. To get a new secret, delete the service account and create a new one.

Manage service accounts.

Workload Factory scans FSx for ONTAP file systems daily. It rates configurations as optimized or not optimized, provides recommendations, and can fix some issues automatically, while others need manual steps. You can dismiss checks that don't apply to your environment, or create custom rules in plain language. For a comprehensive analysis of your file systems, you'll need to create and associate a Link with them.

Learn more about the well-architected analysis.

Tracker is the monitoring tool in Workload Factory and keeps events in the user interface for 30 days. You can filter by time frame, workload, status, and user, and download the jobs table as a CSV file. For a failed operation, you can retry it, or edit its parameters and retry. The number of retries allowed for a failed operation is limited.

Monitor operations with Tracker.

On the AI settings page, an admin can choose NetApp-managed Bedrock (recommended) or turn all AI features off. NetApp-managed Bedrock doesn't use your data to train models and needs no extra AWS setup. Turning AI features off makes Ask Me, AI agents, custom dashboards, rules builder, analyzers, and AI error responses in CloudShell unavailable. AI features use AWS Bedrock in public AWS regions, which can matter for GovCloud accounts.

Manage AI features.

Yes. With NetApp-managed Bedrock, each account has a monthly spending limit for each AI feature. When the limit is reached, Workload Factory turns off AI features, grays out the related parts of the interface, and shows a tooltip. To get more credits, contact your NetApp representative.

By default, agents run in read-only mode and can't change resources. In the optional read/write mode, agents summarize each action and take it only after you approve, using the credentials you selected. Agents can access only resources within your current scope and the credentials chosen in Agents settings, and selecting a credential doesn't grant additional AWS permissions.

New dashboards are private to the creator. Sharing makes a dashboard public to everyone in your Workload Factory account, and you can't share outside the account. Only the creator can edit a dashboard, but all users in the account can delete one. Deletion is permanent and removes the dashboard for everyone, so coordinate with your team.

Your account admin should enable AI features. You need AWS credentials with read access to the services you want to monitor. You need a Link to connect to FSx for ONTAP file systems. Dashboards are read-only and can't change your storage or workload settings.

Learn about custom dashboards.