Netflix Bridges AWS IAM and Internal Identity with Workload Attestation

Netflix has developed a workload attestation mechanism that allows Apache Spark jobs running on Amazon EMR to exchange their AWS execution identity for a short-lived internal workload identity. The approach bridges AWS IAM with Netflix’s internal Metatron PKI, allowing managed compute workloads to authenticate to internal services without manually injecting credentials.

Dhruv Pratap, Big Data Platform Engineer at Netflix, described the design in a LinkedIn post as

On infrastructure you build yourself, you can bootstrap your own identity however you like.

Netflix operates two identity systems. AWS provides managed workloads with an IAM execution role, while internal services use Metatron, a private PKI that issues short-lived X.509 certificates for mutual TLS. Netflix also uses Data Projects as the ownership and identity boundary for data access. A Spark job running on EMR therefore needs to establish that its AWS identity corresponds to the internal identity associated with its Data Project.

The design maps each Data Project to a dedicated IAM role. Because Netflix expects Data Projects to reach the tens of thousands, these roles are deterministically distributed across a pool of dedicated AWS accounts rather than concentrated in one account.


Netflix workload attestation flow (Source: Netflix Blog Post)

When a job is submitted, Netflix’s control plane validates the request, resolves the Data Project’s IAM role, and creates a signed workload metadata payload identifying the intended workload. The control plane is the only service authorized to create these claims.

The Spark driver uses credentials associated with its execution role to create a pre-signed request to the AWS Security Token Service GetCallerIdentity endpoint. Netflix’s Identity service retrieves the request from AWS STS to determine which IAM role signed it, providing an independently verifiable statement of the workload’s AWS identity.

The Identity service then compares the AWS response with the signed metadata from the control plane. The AWS response proves possession of the expected IAM role, while the signed metadata identifies the intended workload. Their intersection allows the service to issue a Metatron certificate.

The architecture also addresses Spark’s executor fan-out. Rather than independently attesting thousands of executors, Netflix has the driver attest once and distribute credentials through authenticated and encrypted Spark RPC. This avoids attestation traffic proportional to executor count while making the driver an additional credential distribution trust boundary.

Netflix’s driver-based credential distribution for Spark executors (Source: Netflix Blog Post)

Credential renewal is handled separately from initial bootstrap. The driver periodically re attests before its short lived certificate expires, while executors do not independently renew credentials. Netflix notes that repeatable attestation is important for long-running workloads. The pattern separates internal workload identity from the managed compute provider while retaining the provider’s identity as cryptographic proof. Netflix says the approach can also apply to other managed environments where workloads receive a cloud identity but need to establish a separate organizational identity.