Connect AWS EBS Volumes to DSPM

Overview

Netskope DSPM enables you to scan unstructured data in AWS Elastic Block Store (EBS) Volumes within EC2 Instances, supporting Discovery and Classification to detect sensitive information associated with your unstructured data accurately. Follow the instructions below to configure and connect your EBS Volumes data store.

Prerequisites:

Before connecting your EBS Volumes, ensure your AWS environment is properly prepared.

• If Auto-Discover Unmanaged Data Stores was selected while onboarding your AWS account, you do not need to grant any additional permissions.

• If Auto-Discover was not selected, you must create a new policy with the following least-privilege permissions and add it to the Netskope role so it can scan unstructured data in EBS Volumes:

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "ScanEnvironmentCreation",
        "Effect": "Allow",
        "Action": [
          "ec2:CreateVpc",
          "ec2:CreateSecurityGroup",
          "ec2:CreateSubnet",
          "ec2:CreateSnapshot",
          "ec2:CreateVolume",
          "ec2:CreateInternetGateway"
        ],
        "Resource": "*",
        "Condition": {
          "StringEqualsIfExists": {
            "aws:RequestTag/Vendor": "Netskope",
            "aws:RequestTag/Product": "DSPM"
          }
        }
      },
      {
        "Sid": "RestrictedEC2InstanceLaunching",
        "Effect": "Allow",
        "Action": "ec2:RunInstances",
        "Resource": "*",
        "Condition": {
          "StringEqualsIfExists": {
            "aws:RequestTag/Vendor": "Netskope",
            "aws:RequestTag/Product": "DSPM"
          },
          "StringLikeIfExists": {
            "ec2:InstanceType": [
              "t3.*",
              "m5.*"
            ]
          }
        }
      },
      {
        "Sid": "NetworkConnectivityResourceCreation",
        "Effect": "Allow",
        "Action": [
          "ec2:CreateRoute",
          "ec2:ModifySubnetAttribute"
        ],
        "Resource": "*"
      },
      {
        "Sid": "EC2NetworkAndSGManagement",
        "Effect": "Allow",
        "Action": [
          "ec2:AttachInternetGateway",
          "ec2:ModifyVpcAttribute",
          "ec2:AuthorizeSecurityGroupIngress",
          "ec2:AuthorizeSecurityGroupEgress"
        ],
        "Resource": "*",
        "Condition": {
          "StringEquals": {
            "ec2:ResourceTag/Vendor": "Netskope",
            "ec2:ResourceTag/Product": "DSPM"
          }
        }
      },
      {
        "Sid": "MandatoryResourceTagging",
        "Effect": "Allow",
        "Action": "ec2:CreateTags",
        "Resource": "*",
        "Condition": {
          "StringEquals": {
            "ec2:CreateAction": [
              "CreateVpc",
              "CreateSecurityGroup",
              "CreateSubnet",
              "CreateSnapshot",
              "CreateVolume",
              "RunInstances",
              "CreateRoute",
              "CreateInternetGateway"
            ]
          }
        }
      },
      {
        "Sid": "EC2DeleteDSPMResources",
        "Effect": "Allow",
        "Action": [
          "ec2:DeleteSecurityGroup",
          "ec2:DeleteSubnet",
          "ec2:DetachInternetGateway",
          "ec2:DeleteInternetGateway",
          "ec2:DeleteVpc",
          "ec2:DeleteVolume",
          "ec2:DeleteSnapshot",
          "ec2:TerminateInstances"
        ],
        "Resource": "*",
        "Condition": {
          "StringEquals": {
            "ec2:ResourceTag/Vendor": "Netskope",
            "ec2:ResourceTag/Product": "DSPM"
          }
        }
      },
      {
        "Sid": "EC2DeleteRoute",
        "Effect": "Allow",
        "Action": "ec2:DeleteRoute",
        "Resource": "*"
      }
    ]
  }

Understand Scanning Infrastructure Behavior

When scanning an EBS volume, Netskope DSPM temporarily provisions resources. During setup in the DSPM console, you will encounter the Use Existing Network Resources toggle, which dictates how these resources are handled during each scan:

Connect Your Data Store

Step 1: Provide Credentials

Follow these steps to configure the connection:

1. Go to Data Stores > Data Store Inventory.

2. Click CONNECT A DATA STORE in the upper right.

   Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.

   

3. In the Connect a Data Store window, click the data store icon you wish to connect.

4. In the Provide Credentials section, complete the following fields:

Field	Value
AWS Account Name	Select one of the AWS Accounts defined within the Infrastructure Connections screen. The field will default if there is just one AWS account configured.
Data Store Identifier	Friendly name to describe your data store. Your value is displayed in other Netskope DSPM screens, such as Policy Management and Classification Management.
Volume ID	Volume ID of EBS Volume to be scanned. Obtain from your AWS S3 console.
Use Existing Network Resources (Toggle)	Enabled by default. Turn on to scan the volume using your existing AWS VPC instead of a temporary Netskope VPC.
Subnet ID	(Required only if Use Existing Network Resources is enabled). Enter the ID of the specific AWS Subnet you want DSPM to use. These values are supplied from your own AWS account. Note: This subnet should be in the same availability zone as the EBS data store being scanned.
Security Group ID	(Required only if Use Existing Network Resources is enabled). Enter the ID of the AWS Security Group you want DSPM to attach to the temporary scanning resources. These values are supplied from your own AWS account.
Sidecar Pool	A new sidecar is created for each EBS volume scan, and once the scan completes, it is deleted. This sidecar is specific to EBS volumes only and cannot be manually edited or deleted.
Auto-Scan, Scan Frequency	Controls how often your Data Store is reviewed for changes; Netskope DSPM's recommended frequency defaults, which you can override if desired.

Step 2: Scanning Infrastructure

1. Click Next.
2. When the Select Capabilities tab appears, complete the following fields:
   • Assign a Data Owner (Optional): Select one or more users responsible for this data store.
   • Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
   • Features: Select the features you want to enable.

Enabling Classification triggers file scanning based on your defined sampling rate. The following classification limits apply when using Advanced Scan. When Smart Scan is selected, file selection is automated by the clustering algorithm and these manual limits do not apply. For more details, see Data Store Smart Scan.

• Scan Limits: DSPM processes a maximum of 100,000 files per scan, regardless of the sampling rate. If you choose 100%, the system scans files in batches of 100,000 across subsequent scans until all files are covered. A maximum of 1,000,000 files will be scanned per data store.
• File Size Exclusions: The scanner skips files larger than 128 MB.
• Incremental Scanning: To optimize performance, DSPM only rescans files that have been modified since the last scan.
• File Type Filtering: You can optionally use a regular expression to restrict sampling to specific file types.

Step 3: Review and Save

1. Click Save.
   • When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
2. Click Save to finalize the connection.

Supported File Types for Unstructured Data Store Scanning

DSPM now supports all file types supported by the DLP appliance: