Is it safe to remove the client and secret ID from EC2 User Data for the Console Agent?
Applies to
- NetApp Console
- Amazon Web Services (AWS)
- EC2 user-data
Answer
- Yes, it is safe to delete the Client Secret set on the EC2 user-data for the AWS NetApp Console Agent.
- This IAM Client Secret is only used for the initial registration of the NetApp Console Agent on tenancy post deployment.
Partner Notes
Additional Information
Below procedure can be followed in the event the Client Secret needs to be deleted for Security Compliance:
- Stop the EC2 Instance of the NetApp Console Agent VM.
- Once the instance is stopped, click on "Edit User Data":
- Remove the whole user data content and click save.
- Start the EC2 instance of the NetApp Console Agent
Internal Notes
The Console calls the agent-mgmt API (POST /agents-mgmt/organizations/{orgId}/agents), which registers the agent with Auth0. Auth0 returns a clientId and clientSecret.
These credentials are passed into the EC2 instance's user data so the Service Manager (SM2) can read them on first boot without any manual login or file transfer.
SM2 reads the values, writes them into config.json (with the client secret encrypted as enc_clientSecret), generates a JWT service token using the clientId/clientSecret pair, and calls the agent-mgmt PATCH API to update callback URIs and finalize registration.
Once registration completes, the OCCM container comes up (~10–15 min), and the agent is fully operational.
The userdata can be removed after agent registration process complete (seen on audit timeline) and occm container comes up.
SM2 secrets are not rotated.
Once SM2 reads the client ID and client secret from user data during initial provisioning, it writes them into /opt/application/netapp/service-manager-2/config.json (with the secret stored as enc_clientSecret in encrypted form). From that point forward, the agent uses config.json exclusively to generate JWT service tokens for API calls — it does not re-read EC2 user data