Connect AWS EFS Volumes to DSPM

Overview

Netskope DSPM allows you to scan unstructured data in AWS Elastic File System (EFS) volumes, supporting Discovery and Classification to accurately detect sensitive information. Follow the instructions below to configure and connect your EFS volumes data store.

Prerequisites:

Before connecting your EFS volumes, ensure your AWS environment is properly prepared.

• If Auto-Discover Unmanaged Data Stores was selected while onboarding your AWS account, you do not need to grant any additional permissions.

• If Auto-Discover was not selected, you must create a new policy with the following least-privilege permissions and add it to the Netskope role so it can scan unstructured data in EFS Volumes:

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "ScanEnvironmentCreation",
        "Effect": "Allow",
        "Action": [
          "ec2:CreateVpc",
          "ec2:CreateSecurityGroup",
          "ec2:CreateSubnet",
          "ec2:CreateSnapshot",
          "ec2:CreateVolume",
          "ec2:CreateInternetGateway"
        ],
        "Resource": "*",
        "Condition": {
          "StringEqualsIfExists": {
            "aws:RequestTag/Vendor": "Netskope",
            "aws:RequestTag/Product": "DSPM"
          }
        }
      },
      {
        "Sid": "RestrictedEC2InstanceLaunching",
        "Effect": "Allow",
        "Action": "ec2:RunInstances",
        "Resource": "*",
        "Condition": {
          "StringEqualsIfExists": {
            "aws:RequestTag/Vendor": "Netskope",
            "aws:RequestTag/Product": "DSPM"
          },
          "StringLikeIfExists": {
            "ec2:InstanceType": [
              "t3.*",
              "m5.*"
            ]
          }
        }
      },
      {
        "Sid": "NetworkConnectivityResourceCreation",
        "Effect": "Allow",
        "Action": [
          "ec2:CreateRoute",
          "ec2:ModifySubnetAttribute"
        ],
        "Resource": "*"
      },
      {
        "Sid": "EC2NetworkAndSGManagement",
        "Effect": "Allow",
        "Action": [
          "ec2:AttachInternetGateway",
          "ec2:ModifyVpcAttribute",
          "ec2:AuthorizeSecurityGroupIngress",
          "ec2:AuthorizeSecurityGroupEgress"
        ],
        "Resource": "*",
        "Condition": {
          "StringEquals": {
            "ec2:ResourceTag/Vendor": "Netskope",
            "ec2:ResourceTag/Product": "DSPM"
          }
        }
      },
      {
        "Sid": "MandatoryResourceTagging",
        "Effect": "Allow",
        "Action": "ec2:CreateTags",
        "Resource": "*",
        "Condition": {
          "StringEquals": {
            "ec2:CreateAction": [
              "CreateVpc",
              "CreateSecurityGroup",
              "CreateSubnet",
              "CreateSnapshot",
              "CreateVolume",
              "RunInstances",
              "CreateRoute",
              "CreateInternetGateway"
            ]
          }
        }
      },
      {
        "Sid": "EC2DeleteDSPMResources",
        "Effect": "Allow",
        "Action": [
          "ec2:DeleteSecurityGroup",
          "ec2:DeleteSubnet",
          "ec2:DetachInternetGateway",
          "ec2:DeleteInternetGateway",
          "ec2:DeleteVpc",
          "ec2:DeleteVolume",
          "ec2:DeleteSnapshot",
          "ec2:TerminateInstances"
        ],
        "Resource": "*",
        "Condition": {
          "StringEquals": {
            "ec2:ResourceTag/Vendor": "Netskope",
            "ec2:ResourceTag/Product": "DSPM"
          }
        }
      },
      {
        "Sid": "EC2DeleteRoute",
        "Effect": "Allow",
        "Action": "ec2:DeleteRoute",
        "Resource": "*"
      }
    ]
  }

  For more details, see our AWS onboarding articles.

  IAM Policy for Customer VPCs: If you plan to scan volumes using your existing AWS VPC (by enabling the Use Existing Network Resources feature) and you previously deployed the Netskope service account using our IaC or manual instructions, you must update your IAM policy.
  
  – Remove the condition block that restricts actions only to Netskope-tagged resources ("Condition": { "StringEquals": { "aws:ResourceTag/CreatedBy": "Netskope" } }). Leaving this condition prevents DSPM from operating on your existing VPC.

Understand Scanning Infrastructure Behavior

When scanning an EFS volume, Netskope DSPM temporarily provisions resources. During setup in the DSPM console, you will encounter the Use Existing Network Resources toggle, which dictates how these resources are handled during each scan:

Connect Your Data Store

Step 1: Provide Credentials

Follow these steps to configure the connection:

1. Go to Data Stores > Data Store Inventory.

2. Click CONNECT A DATA STORE in the upper right.

   Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.

   

3. In the Connect a Data Store window, click the data store icon you wish to connect.

4. In the Provide Credentials section, complete the following fields:

Step 2: Scanning Infrastructure

1. Click Next.
2. When the Select Capabilities tab appears, complete the following fields:
   • Assign a Data Owner (Optional): Select one or more users responsible for this data store.
   • Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
   • Features: Select the features you want to enable.

Enabling Classification triggers file scanning based on your defined sampling rate. The following classification limits apply when using Advanced Scan. When Smart Scan is selected, file selection is automated by the clustering algorithm and these manual limits do not apply. For more details, see Data Store Smart Scan.

• Scan Limits: DSPM processes a maximum of 100,000 files per scan, regardless of the sampling rate. If you choose 100%, the system scans files in batches of 100,000 across subsequent scans until all files are covered. A maximum of 1,000,000 files will be scanned per data store.
• File Size Exclusions: The scanner skips files larger than 128 MB.
• Incremental Scanning: To optimize performance, DSPM only rescans files that have been modified since the last scan.
• File Type Filtering: You can optionally use a regular expression to restrict sampling to specific file types.

Step 3: Review and Save

1. Click Save.
   • When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
2. Click Save to finalize the connection.

Supported File Types for Unstructured Data Store Scanning

DSPM now supports all file types supported by the DLP appliance: