Overview

Netskope One DSPM supports scanning AWS MySQL Data Stores. Follow these instructions to setup your MySQL database and configure its connection to Netskope One DSPM.

Authenticate Data Store

There are two methods for authenticating RDS and Aurora data stores: Snapshots or Service Account. 

Using Snapshots

Snapshots are quicker and simpler, spinning up a secure copy of the data store for Netskope One DSPM to scan without needing to create a Service Account. This copy exists only within your Netskope One DSPM instance, and Netskope One DSPM does not store any associated data. It's encrypted and then immediately spun down, so there are no lingering data copies. Please note that spinning up the data store copy can cause the scan initiation process can take several hours.

The following features are not supported when authenticating via Snapshot:

• Privilege Analysis
• Data-in-use monitoring
• Database selection
• Sample data collection

Ensure you've enabled data store Snapshots access during AWS Infrastructure onboarding. For already onboarded accounts, you must manually add permission AmazonRDSFullAccess in the AWS Console.

Once connected, data classification in the data store runs via Snapshot, which appears on the Data Store Inventory page as a small layered square note icon to the right of the hyperlinked data store name. You can later edit the data store and turn off Snapshots, at which point a Service Account will be required to authenticate the data store.

Using a Netskope One DSPM Service Account

Begin by configuring a MySQL service account which will be dedicated to Netskope One DSPM’s use.  The following instructions apply to all of the cloud infrastructure solutions listed above.  Authentication to RDS is supported using either password- or IAM-based authentication.

The following steps may require the assistance of your AWS and/or local database administrator.

IAM-based authentication

Configure RDS

1. As an administrator, log into your AWS RDS Console.
2. Navigate to the database you wish to connect
3. Under the Configuration tab, 
   1. Within the Summary section, make note of the Region value 
   2. Within the Instance section, ensure that the IAM Connectivity setting is enabled

1. As an administrator, log into your MySQL database's shell using these AWS instructions.
2. Create the Netskope One DSPM-specific MySQL user by executing the following commands in order:

Command	Outcome	Notes
CREATE USER '[USER]'@'%' IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';	Creates the Netskope One DSPM-specific user for authentication using the AWS RDS plugin.	Substitute [USER] with your own preferred value.   @'%' creates a user which supports remote connection. As an alternative, substitute it with @'#.#.#.#' to limit to specific IP addresses.
GRANT SELECT ON *.* TO '[USER';	Grants to the Netskope One DSPM-specific user the required permissions which power capabilities within the Netskope One DSPM platform.	Substitute [USER] with the value used above.   *.* means “on all schemas, in all tables in those schemas (current and future).

Configure IAM

1. As an administrator, log into your IAM Dashboard.
2. In the left-hand menu, select the Roles menu item.
3. Using the search box, find and open the Netskope-specific role.  
   1. Most likely, it is named “Netskope_Role” if it was created using the CloudFormation template or Terraform script provided by Netskope
   2. Otherwise, you are welcome to create a new custom role and ensure it has the same Trust Relationship as the Netskope-specific rule.

1. The role summary screen is displayed.
2. Under the Permissions tab, click the Add Permissions button 
3. In the dropdown, select the Create inline policy option.
4. On the Specify Permissions screen, click the JSON button.
5. In the Policy editor section, overwrite the default JSON with the following, replacing the following values:

Placeholder	Value
[REGION]	The AWS region where your RDS database resides, as identified in the Configure RDS step above
[ACCOUNT]	Your AWS account number
[USER]	Your DB user, as defined in the Configure RDS step above

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"rds-db:connect"
			],
			"Resource": [
				"arn:aws:rds-db:[REGION]:[ACCOUNT]:dbuser:*/[USER]"
			]
		}
	]
}

If your plan to connect with RDS databases in more than one AWS region, add additional rows to Resource object, one for each region you will eventually connect with.

 

When complete, your screen should resemble the following:

1. Click the Next button.
2. On the Policy Details screen, enter the following values:

Field	Value
Policy Name	Any value.  It is recommended to use “Netskope_Policy_RMS", so it is clear the purpose of this custom addition to the Netskope-specific role

1. Click the Create policy button.

When complete, your final Netskope-specific role definition should resemble the following:

 

 

CREATE USER '[USER]'@'%' IDENTIFIED BY 'netskope_password';

GRANT SELECT ON *.* TO '[USER]';

Configure Query Logging (Optional)

Netskope One DSPM’s Data-In-Use-Monitoring capability requires access to query logging.  If you wish to leverage this capability, you must configure your MySQL instance to begin generating such logs.

Users who have the MySQL permission to set the sql_log_off session variable can disable logging for their own session (and the separate permission to set set restricted session variables).  For optimal security and audibility, the ability to access & adjust this setting should be restricted.

These changes will require a MySQL server restart to take effect.  It is recommended you schedule this reboot during an internally-publicized maintenance window in order to least impact your users.

The following steps may require the assistance of your local database administrator.

Please follow the steps below to define these configurations:

1. Click this link to log into your AWS RDS Console, which will navigate you to the RDS service.
2. Under Amazon RDS in the left-hand menu, navigate to Parameter groups.
3. Select an existing parameter group for your MySQL database. If one does not exist, create a new one using these AWS instructions.
4. On the next screen, click the Edit parameters button.
5. Using the search box, find the following parameter keys and set the corresponding values:

1. Click the SAVE button.
2. As an administrator, log into your MySQL database's shell using these AWS instructions.
3. Continue your logging setup by executing the following command:

CALL mysql.rds_rotate_general_log;

1. Restart your MySQL server at your earliest convenience. 

Retrieve Connection Information

In addition to configuring a service account, Netskope One DSPM will also require additional information in order to communicate with your MySQL instance. Please follow the steps below to identify the connection values for later use within Netskope One DSPM.

1. Click this link to log into your AWS RDS Console, which will navigate you to the RDS service.
2. Under Amazon RDS in the left-hand menu, navigate to Databases.
3. For the database you wish Netskope One DSPM to scan, click its link in the DB Identifier column.  For Aurora MySQL, be sure to choose a database with Role = "Writer Instance" (instead of "Regional cluster")
4. In the Connectivity & security section, make note of the following values:

Highlight Color	Corresponding Netskope One DSPM Value	Example
Blue (Endpoint)	Data Store Endpoint
Grey (Port)	Data Store Endpoint

Connect Your Data Store

Before attempting to connect a AWS Data Store, be sure you have configured a Netskope One DSPM-specific AWS Service Account and onboarded the AWS Infrastructure for this Data Store.