Overview

Netskope One DSPM supports the ability to onboard, connect to, and scanning your AWS organizations and accounts. These capabilities require programmatic access to connect to and scan the Data Stores, including configuring specific AWS users or IAM roles.

Configure AWS Access

Begin by configuring an AWS User or IAM Role dedicated to Netskope One DSPM's use.  Which you configure depends on whether your application is Netskope One DSPM-hosted or self-hosted.

Option A: Create AWS IAM Role

This option is recommended for Netskope One DSPM-hosted tenants.

1. Log into the AWS IAM Console
2. Create a new IAM Role
3. Using the on-screen wizard, configure the following values:
   1. Name: Netskope One DSPMRole
   2. Permissions
      1. AmazonEC2ReadOnlyAccess: for getting regions and instance IDs
      2. AmazonEC2FullAccess: required for scanning EBS volumes
      3. AmazonElasticFileSystemFullAccess: required for scanning EFS volumes
      4. AmazonRDSReadOnlyAccess: for discovering RDS clusters
         1. Optionally, include AmazonRDSFullAccess instead of permission B above if you plan to connect with RDS and Aurora data stores via Snapshots.
      5. AmazonRedshiftReadOnlyAccess: required for discovering RedShift clusters, otherwise optional
      6. AmazonAthenaFullAccess: required for discovering Athena clusters and running scans, otherwise optional
      7. AmazonS3ReadOnlyAccess: also required for scanning Athena, otherwise optional
      8. AmazonDynamoDBReadOnlyAccess: required for scanning DynamoDB data stores. Also contains necessary permission for AWS tag ingestion.
      9. IAMReadOnlyAccess: required for Privilege Analysis on S3, otherwise optional
4. Save your new IAM Role
5. Make note the Role ARN value, then proceed to the next step

Option B: Configure AWS User

This option is recommended for self-hosted instances (e.g. installed via AMI installation).

1. Log into the AWS IAM Console
2. Click on "Users" in the left navigation under Access Management
3. Click on the blue "Add users" button on the top right of the screen
4. Enter a User name of your choice (e.g. Netskope One DSPM_IAM)
5. Check the "Programmatic access" check box in the Access type section.
6. Click on the blue “Next: Permissions” button on the bottom of the page.
7. Set permissions for this user by attaching policies that give Netskope One DSPM access to the following resources
   1. AmazonEC2ReadOnlyAccess: for getting regions and instance IDs
   2. AmazonEC2FullAccess: required for scanning EBS volumes
   3. AmazonElasticFileSystemFullAccess: required for scanning EFS volumes
   4. AmazonRDSReadOnlyAccess: for discovering RDS clusters
      1. Optionally, include AmazonRDSFullAccess instead of permission B above if you plan to connect with RDS and Aurora data stores via Snapshots.
   5. AmazonRedshiftReadOnlyAccess: required for discovering RedShift clusters, otherwise optional
   6. AmazonAthenaFullAccess: required for discovering Athena clusters and running scans, otherwise optional
   7. AmazonS3ReadOnlyAccess: also required for scanning Athena, otherwise optional
   8. AmazonDynamoDBReadOnlyAccess: required for scanning DynamoDB data stores. Also contains necessary permission for AWS tag ingestion.
   9. IAMReadOnlyAccess: required for Privilege Analysis on S3, otherwise optional
8. Click the blue “Next: Tags” button on the bottom of the page.
9. Optionally add any tags you would like to describe this Netskope One DSPM user.
   1. The permission tag:GetResources is required for AWS tag ingestion.
10. Click the blue “Next: Review” button on the bottom of the page.
11. Review the details and then click the blue “Create user” button on the bottom of the page.
12. Copy the Access Key ID and Secret Key, then proceed to Step 2 below.

Configure Trust Relationship

Follow these steps to configure a trust relationship between the "Netskope One DSPMRole" IAM Role and a new IAM Role called “Netskope One DSPMLaunchRole”. Otherwise, you can skip ahead to the next step.

1. Log into the AWS IAM Console
2. Create a new IAM Role
3. Using the on-screen wizard, configure the following values:
   1. Name: Netskope One DSPMLaunchRole
4. Save your new IAM Role
5. Within the role header, make note of its Role ARN value
6. Select the "Netskope One DSPMRole", then navigate to the Trusted Relationships tab
7. Edit the Trusted Entities JSON to add an additional line under Principal which references the "Netskope One DSPMLaunchRole" Role ARN value. See below for an example (be sure to edit the account number portion if you cut-and-paste)
8. Save your changes

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "AllowAssumeRoleForAnotherAccount",
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam::946157925481:root"
			},
			"Action": "sts:AssumeRole",
			"Condition": {
				"StringEquals": {
					"sts:ExternalId": "<enter-external-id-from-UI>"
				}
			}
		}
	]
}

9. Within EC2, select your Netskope One DSPM instance, then navigate to Actions > Security > Modify IAM Role
10. In the IAM Role field, select "Netskope One DSPMLaunchRole"
11. Click the Save button

Create a Netskope One DSPM Infrastructure Connection

At this point, your configuration of AWS is complete, and Netskope One DSPM can now be connected to your infrastructure.

1. Log into your Netskope One DSPM instance
2. Navigate to Administration > Infrastructure Connections
3. On the next screen, click the AWS tab
4. Complete the Account Name field

Configure an AWS IAM Role

• Select the Using IAM Role radio button.
• In the Role ARN field, enter the corresponding value from the Create AWS IAM Role step above.

If your tenant is Netskope One DSPM-hosted, complete these additional steps:

• Make note of the Netskope One DSPM-generated External ID value
• Log into the AWS IAM Console.
• Select the "Netskope One DSPMRole", then navigate to the Trusted Relationships tab.
• Edit the Trusted Entities JSON to add an additional line under Principal which references the Netskope One DSPM-generated External ID value. See below for an example (be sure to edit the account number portion if you cut-and-paste).
• Save your changes and continue the next steps within your Netskope One DSPM instance.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
                "ARN": [arn:aws:iam::123456789012:role/Netskope One DSPMLaunchRole]
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "abcd1234-6578-efgh-9012-ijklmnopqrst"
                }
            }            
        }
    ]
}

Optionally, the following policy conditions should be attached if you plan to connect with RDS or Aurora data stores via Snapshots.

{
              "Effect": "Allow",
              "Action": [
                "ec2:AttachInternetGateway",
                "ec2:ModifyVpcAttribute",
                "ec2:AuthorizeSecurityGroupIngress"
              ],
              "Resource": "*",
              "Condition": {
                "StringEquals": {
                  "ec2:ResourceTag/Vendor": "Netskope One DSPM"
                }
              }
            },
            {
              "Effect": "Allow",
              "Action": [
                "ec2:CreateRoute",
                "ec2:CreateVpc",
                "ec2:CreateInternetGateway",
                "ec2:CreateSecurityGroup",
                "ec2:CreateSubnet"
              ],
              "Resource": "*"
            },
            {
              "Effect": "Allow",
              "Action": [
                "ec2:CreateTags"
              ],
              "Resource": "*",
              "Condition": {
                "StringEquals": {
                  "ec2:CreateAction": [
                    "CreateVpc",
                    "CreateInternetGateway",
                    "CreateSecurityGroup",
                    "CreateSubnet"
                  ]
                }
              }
            } 

 

 

 

1. Confirm the Auto-Discovery setting:
   1. If Auto-Discovery is enabled (example below), Netskope One DSPM will start discovering and cataloging your AWS Data Stores under the Data Stores > Data Stores Inventory screen.
   2. Otherwise, you can later connect to individual Data Stores

6. Click the ACKNOWLEDGE button.  Netskope One DSPM will verify the connection and kick off the initial auto-discovery scan (if enabled).