Netflix has developed a workload attestation mechanism that allows Apache Spark jobs running on Amazon EMR to exchange their AWS execution identity for a short-lived internal workload identity. The approach bridges AWS IAM with Netflix’s internal Metatron PKI, allowing managed compute workloads to authenticate to internal services without manually injecting credentials.

Source: InfoQ