Overview
Netskope DSPM supports scanning AWS Athena data stores, often used as a wrapper for different data services. Follow these instructions to set up Athena and configure its connection to Netskope DSPM.
Retrieve Connection Information
Data Store Endpoint
Use the default endpoint, which is in the below format:
athena.{region}.amazonaws.com
For example: https://athena.us-east-2.amazonaws.com
In case of a custom setup within a VPC, please contact your DevOps team to get the connection details.
Athena S3 Output Location
This can be any secure, accessible S3 bucket to which Netskope DSPM has “write” privileges. For example: s3://athena-query-results/.
Athena Catalog Name
This refers to the data source Athena is querying and requires an integration with AWS Glue. First you’ll need to set up your crawler for Athena. Once set up, go to your Athena console, then click on Data sources in the left side nav, under Administration.
Note the Data source name value for the Athena Catalog Name field in the Netskope DSPM data store connection wizard.
Athena Workgroup
From the Athena console, click on Workgroups from the left side nav under Administration. Click on the Workgroup name for your Athena engine. You may need to create a non-default workgroup for Netskope DSPM to use if only the default is set up when connecting.
Note the Workgroup name value for the Athena Workgroup field in the Netskope DSPM data store connection wizard.
Connect Your Data Store
Step 1: Provide Credentials
Follow these steps to configure the connection:
-
Go to Data Stores > Data Store Inventory.
-
Click CONNECT A DATA STORE in the upper right.
Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.
-
In the Connect a Data Store window, click the data store icon you wish to connect.
-
In the Provide Credentials section, complete the following fields:
| Field | Value |
|---|---|
| AWS Account Name | Select one of the AWS Accounts defined within the Infrastructure Section screen. The field will default if there is just one AWS account configured. |
| Data Store Identifier | Friendly name to describe this Data Store. Your value is displayed in other Netskope DSPM screens, such as Policy Management and Classification Management. |
| Data Store Endpoint | Enter the corresponding value from the Retrieve Connection Information: Data Store Endpoint section above. |
| Athena S3 Output Location | Enter the corresponding value from the Retrieve Connection Information: Athena S3 Output Location section above. |
| Athena Catalog Name | Enter the corresponding value from the Retrieve Connection Information: Athena Catalog Name section above. |
| Athena Workgroup | Enter the corresponding value from the Retrieve Connection Information: Athena Workgroup Name section above. |
| Sidecar Pool | If you will use sidecars to monitor this data store, select a sidecar pool with network visibility to said data store. This field is displayed when there is at least one defined sidecar pool. To learn more, please visit our Sidecar Administration article. |
| Scan Frequency | Controls how often your Data Store is reviewed for changes, Netskope DSPM’s recommended frequency is defaulted, which you can override (if desired). |
Step 2: Scanning Infrastructure
- Click Next.
- When the Select Capabilities tab appears, complete the following fields:
- Assign a Data Owner (Optional): Select one or more users responsible for this data store.
- Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
- Features: Select the features you want to enable.
| Capability | Supported for AWS Athena |
|---|---|
| Discovery | Yes |
| Privilege Analysis | Not applicable (as there are no database users and access is controlled via IAM Roles) |
| Shadow Data Analysis | Yes |
| Classification | Yes |
| Data-in-Use Monitoring | Yes (custom query logs only) |
| Automation | Yes (always-on) |
Step 3: Review and Save
- Click Save.
- When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
- Click Save to finalize the connection.