Automated Bootstrap Using AWS Secrets Manager

Complete the following steps before you launch your AI Gateway instance to enable automated enrollment at boot time.

Step 1: Create the Bootstrap Secret in AWS Secrets Manager

1. In the AWS Console, go to Secrets Manager and click Store a new secret.
2. Select Other type of secret.
3. Under Key/value pairs, open the Plaintext tab and enter the following JSON:
   {
"bootstrap": true,
"enrollment_token": "<token>"
}
   Enrollment token is generated in the Netskope UI when you add a new AIG instance. The token has a 24-hour TTL; re-issue it from the UI if it expires before the instance is launched.
4. Click Next, name the secret (for example, aig/prod/bootstrap), and finish the wizard.

Step 2: Attach an IAM Instance Profile

Give your AI Gateway instance an IAM role with permission to read the secret. You don’t need static credentials.

1. In the AWS Console, go to IAM > Policies and click Create policy.
2. Switch to the JSON editor and enter:
   {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ReadAIGBootstrapSecret",
"Effect": "Allow",
"Action": "secretsmanager:GetSecretValue",
"Resource": "arn:aws:secretsmanager:<region>:<account-id>:secret:aig/prod/bootstrap-*"
}
]
}
   Note: Scope the Resource to the specific secret ARN rather than a wildcard.
3. Save the policy.
4. Go to IAM > Roles and attach it to the IAM role used by your AI Gateway instance profile.

Step 3: Launch the EC2 Instance

When you launch the EC2 instance, configure both the IAM instance profile and the User data field.

IAM instance profile

1. Under Advanced details > IAM instance profile, select the instance profile associated with the IAM role from Step 2. This profile grants the instance permission to read the bootstrap secret at boot. Without it the appliance cannot retrieve the secret and enrollment fails.

User Data

1. Set the User data field to the following JSON, replacing the value with your secret name or ARN.
   {"bootstrap_secret": "aig/prod/bootstrap"}

At first boot, the AIG appliance reads the User data, uses the IAM instance profile to retrieve the secret from Secrets Manager, and completes enrollment automatically. No SSH or manual CLI steps needed.

Verify Enrollment Completed

The appliance performs pre-enrollment and enrollment automatically. Confirm completion using either option below.

Option 1: Netskope UI

After successful registration, go to Netskope tenant UI and go to Settings > Security Cloud Platform > VM Onboarding. You’ll see a green icon next to your registered VM in the VM-Name column.

Option 2: Public API

Call GET /api/v2/aig/appliances (use your Netskope API v2 token and include the x-netskope-tenantid header — see REST API v2 Overview) and check the appliance status field.

Example response:

{
  "elements": [
    {
      "id": "00000000-0000-7000-0000-000000000001",
      "name": "Taipei Lab",
      "status": "connected"
    }
  ],
  "total_count": 1
}

A status of connected confirms the appliance is enrolled and reporting.

If the appliance has not reached connected (or shown a green icon in the UI) within one hour of launch, see the Troubleshooting section below.

Optional: Configure DLP On-Demand and AI Guardrails at Bootstrap

To configure DLP on-demand or AI Guardrails during bootstrap, add the corresponding blocks to your Secrets Manager secret. If present, the appliance applies the configuration immediately after enrollment.

DLP on-demand:

{
  "bootstrap": true,
  "enrollment_token": "<token>",
  "dlp": {
    "certificate": "-----BEGIN CERTIFICATE-----\n...",
    "host": "https://dlp.company.internal"
  }
}

Both certificate and host are required when including the dlp block.

AI Guardrails:

{
  "bootstrap": true,
  "enrollment_token": "<token>",
  "ai_guardrails": {
    "host": "https://<llm-endpoint>/invocations",
    "certificate": "-----BEGIN CERTIFICATE-----\n...",
    "jwt_url": "https://<auth-provider>/oauth2/token",
    "client_id": "<client-id>",
    "client_secret": "<client-secret>",
    "scope": "<scope>"
  }
}

You need only host. Add the other fields only if your LLM backend requires TLS certificate configuration or token-based authentication.

If DLP or AI Guardrails configuration fails, enrollment remains unaffected. Re-apply the service configuration after the instance is enrolled.

Troubleshooting

The bootstrap flow is automated, so you normally do not need SSH or CLI interaction. Use the steps below only if the appliance has not reached connected (or shown a green icon in the UI) within one hour of launch.

SSH into the appliance with the nsadmin account and start the AIG CLI (see Signing in to Your Appliance).

Step 1: Check whether bootstrap enrollment is still running

From the main menu, select Enroll this AI Gateway.

• If you see the Bootstrap Enrollment In Progress page (“This appliance is being enrolled automatically. No action is needed.”), enrollment is still underway. Return to the main menu and wait; do not start manual enrollment.
  
• If you land on the normal enrollment flow (no Bootstrap Enrollment In Progress page), the automated bootstrap did not run or failed. Proceed to Step 2.

Step 2: Collect a debug bundle and contact Netskope Support

From the main menu, select Debug Bundle and follow the prompts (enter a password to start generation). For details, see Manage Logs (start at step 4). When generation completes, the CLI shows:

The bundle can be downloaded from the SCP/SFTP with nsdebug account

Retrieve the bundle via SCP/SFTP using the nsdebug account, then upload the ns-debug.zip bundle and its decryption password to the Netskope support portal for engineering analysis.