TRADING A CLOUD IDENTITY FOR YOUR OWN: WORKLOAD ATTESTATION ON MANAGED COMPUTE

Summary from the TLDR Data newsletter

Netflix describes how Spark jobs on managed compute exchange a cloud execution role for an internally trusted workload identity. A signed metadata payload and AWS identity proof are verified before short-lived certificates are issued for mutual TLS. The pattern separates cloud-provider authorization from application trust, giving the platform stronger workload identity and more auditable access boundaries.