TRADING A CLOUD IDENTITY FOR YOUR OWN: WORKLOAD ATTESTATION ON MANAGED COMPUTE

Summary from the TLDR DevOps newsletter

Netflix engineers developed a method to bridge AWS IAM roles with internal identities for Apache Spark workloads on Amazon EMR. The system maps each Data Project identity to a dedicated IAM role, allowing a control plane to sign metadata that an identity service verifies against a cloud proof of possession. This approach ensures that workloads running on managed compute obtain valid certificates from the internal PKI, called Metatron, without relying on the workload's own account of itself.