KOEN
Read Original
#DevOps

Trading a Cloud Identity for Your Own: Workload Attestation on Managed Compute

Trading a Cloud Identity for Your Own: Workload Attestation on Managed Compute
01

Summary

Bridging the Identity Gap: How Netflix Attests Managed Spark Workloads for Internal Zero Trust

A deep dive into exchanging AWS cloud identities for internal X.509 certificates using double-claim corroboration

This article explains how Netflix securely bootstraps internal PKI identities for Apache Spark jobs running on managed AWS EMR. It details a robust workload attestation architecture that combines AWS STS pre-signed URLs with signed platform claims to issue short-lived certificates without relying on workload self-reporting.

  • 01Decoupled cloud and internal environments by establishing a strict 1:1 mapping between Data Projects and sharded AWS IAM roles
  • 02Leveraged AWS STS GetCallerIdentity pre-signed URLs as cryptographic, non-reputable proofs of role possession
  • 03Engineered a double-claim corroboration system combining unforgeable AWS proofs with descriptive control plane metadata
  • 04Avoided identity amplification and STS throttling by delegating credential distribution to the Spark driver via secure Spark RPC
  • 05Designed attestation as a repeatable process with background renewal timers to support long-running big data workloads

RECOMMENDATION

Crucial reading for infrastructure, security, and platforms engineers looking to extend zero-trust internal service meshes to managed cloud or multi-tenant big data compute environments.

The Problem

While Netflix relies on its private PKI system (Metatron) for service-to-service mTLS authentication, Apache Spark workloads on managed compute environments like Amazon EMR only launch with an AWS execution role, creating an identity gap with internal services.

The Solution

The team established a 1:1 mapping between Data Project identities and dedicated AWS IAM roles. They bridged the identity systems by corroborating two independent claims: a control plane's signed workload metadata and a transferable proof of possession (a pre-signed AWS STS URL) generated by the Spark driver, which the Identity Service uses to issue Metatron X.509 certificates.

The Result

The solution safely provisions and continuously renews short-lived internal certificates for managed workloads, enabling secure resource access and consistent table-level audit/ACL enforcement without hitting AWS STS rate limits during massive Spark job fan-outs.

Trade-off

Distributing credentials from the driver to executors over secure Spark RPC avoids STS throttling but creates a second trust boundary within the application, making the driver a single point of credential distribution, while the corroboration logic introduces network round trips and strict cryptographic signing requirements.

03

Key Concepts

Concept · 01

Workload Attestation

The process of verifying a software workload's identity based on verifiable platform-specific attributes or proofs before granting access or issuing credentials.

  • Used by Netflix's Metatron identity service to verify that a running Spark job actually corresponds to the claimed Data Project before issuing certificates.
Concept · 02

Pre-signed URL

A URL generated using a client's AWS credentials that grants temporary permission to perform a specific action, which can be shared and verified by third parties.

  • The Spark driver generates a pre-signed 'sts:GetCallerIdentity' URL to prove to the Identity service that it genuinely holds the specified AWS execution role.
Concept · 03

Mutual TLS (mTLS)

A security protocol in which both the client and the server authenticate each other using digital certificates, ensuring confidential and verified communications.

  • The core authentication mechanism used across Netflix internal microservices, relying on short-lived X.509 certificates issued post-attestation.