Connect AWS RDS MySQL to DSPM - Netskope Technical Documentation

Overview

Netskope DSPM supports scanning AWS MySQL Data Stores. Follow these instructions to set up your MySQL database and configure its connection to Netskope DSPM.

These instructions are for connecting an individual MySQL Data Store. To learn more about onboarding many MySQL Data Stores at once, please visit our Connecting to multiple MySQL Data Stores article.

Authenticate Data Store

There are two methods for authenticating RDS and Aurora data stores: Snapshots or Service Account.

Using Snapshots

Snapshots are quicker and simpler, spinning up a secure copy of the data store for Netskope DSPM to scan without needing to create a Service Account. This copy exists only within your Netskope DSPM instance, and Netskope DSPM does not store any associated data. It’s encrypted and then immediately spun down, so there are no lingering data copies. Please note that spinning up the data store copy can cause the scan initiation process to take several hours.

The following features are not supported when authenticating via Snapshot:

Privilege Analysis
Data-in-use monitoring
Database selection
Sample data collection

Ensure you’ve enabled Data Store Snapshots access during AWS Infrastructure onboarding. For already onboarded accounts, make sure the IAM policy used for DSPM includes the permissions required for Data Store Snapshots Access (note that this also requires the permissions from Feature 3: Unmanaged Data Stores). Depending on whether you onboarded an AWS Organization or an individual AWS account, you can find these granular permissions in the Onboard AWS Infrastructure Manually article under:

Instructions > Onboard an AWS Organization > Step 3 (Optional): Create the Custom IAM Policy > Feature 4: Authorize Data Store Snapshots Access
Instructions > Onboard an Individual AWS Account > Step 3 (Optional): Create the Custom IAM Policy > Feature 4: Authorize Data Store Snapshots Access

Once connected, data classification in the data store runs via Snapshot, which appears on the Data Store Inventory page as a small layered square note icon to the right of the hyperlinked data store name. You can later edit the data store and turn off Snapshots, at which point a Service Account will be required to authenticate the data store.

Using a Netskope DSPM Service Account

Begin by configuring a MySQL service account which will be dedicated to Netskope DSPM’s use. The following instructions apply to all of the cloud infrastructure solutions listed above. Authentication to RDS is supported using either password‑ or IAM‑based authentication.

The following steps may require the assistance of your AWS and/or local database administrator.

TabIAM-based authentication1

Password-based authentication

Configure RDS

As an administrator, log into your AWS RDS Console.
Navigate to the database you wish to connect.
Go to the database you wish to connect. Under the Configuration tab:
- Within the Summary section, make note of the Region value
- Within the Instance section, ensure that the IAM Connectivity setting is enabled
As an administrator, log into your MySQL database’s shell using these AWS instructions.

Create the Netskope DSPM-specific MySQL user by executing the following commands in order:

Command	Outcome	Notes
`CREATE USER '[USER]'@'%' IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';`	Creates the Netskope DSPM-specific user for authentication using the AWS RDS plugin.	Substitute `[USER]` with your own preferred value. `@'%'` creates a user which supports remote connection. As an alternative, substitute it with `@'#.#.#.#'` to limit to specific IP addresses.
`GRANT SELECT ON . TO '[USER';`	Grants to the Netskope DSPM-specific user the required permissions which power capabilities within the Netskope DSPM platform.	Substitute `[USER]` with the value used above. `.` means “on all schemas, in all tables in those schemas (current and future).”

Configure IAM

As an administrator, log into your IAM Dashboard.
In the left-hand menu, select Roles.
Using the search box, find and open the Netskope-specific role.
- Note: Most likely named “Netskope_Role” if created using the Netskope CloudFormation or Terraform script. Otherwise, you can create a new custom role with the same Trust Relationship).
Under the Permissions tab, click Add Permissions > Create inline policy.
On the Specify Permissions screen, click the JSON button.
On the Specify Permissions screen, click the JSON button.

In the Policy editor section, overwrite the default JSON with the following code. Replace [REGION], [ACCOUNT], and [USER] with your specific values:

Placeholder	Outcome
[REGION]	The AWS region where your RDS database resides, as identified in the Configure RDS step above.
[ACCOUNT]	Your AWS account number.
[USER]	Your DB user, as defined in the Configure RDS step above.

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"rds-db:connect"
			],
			"Resource": [
				"arn:aws:rds-db:[REGION]:[ACCOUNT]:dbuser:*/[USER]"
			]
		}
	]
}

If you plan to connect with RDS databases in more than one AWS region, add additional entries to the Resource array, one for each region you will eventually connect with.

Click Next.
On the Policy Details screen, enter a Policy Name (e.g., Netskope_Policy_RMS to clarify its purpose).
Click Create policy.

As an administrator, log into your MySQL database’s shell using these AWS instructions.
Create the Netskope DSPM-specific MySQL user by executing the following commands in order:

Command	Outcome	Notes
`CREATE USER '[USER]'@'%' IDENTIFIED BY 'netskope_password';`	Creates the Netskope DSPM-specific user for authentication using a password.	Substitute `[USER]` and `netskope_password` with your own preferred values. `@'%'` creates a user which supports remote connection. As an alternative, substitute it with `@'#.#.#.#'` to limit to specific IP addresses.
`GRANT SELECT ON . TO '[USER]';`	Grants to the Netskope DSPM-specific user the required permissions which power capabilities within the Netskope DSPM platform.	Substitute `[USER]` with the value used above. `.` means “on all schemas, in all tables in those schemas (current and future)”.

Configure Query Logging (Optional)

Netskope DSPM’s Data-In-Use Monitoring capability requires access to query logging. If you wish to leverage this capability, you must configure your MySQL instance to begin generating such logs.

Enabling query logging on a MySQL database may impact its performance. Closely monitor your database along with any dependent pipelines/applications.

Users with the MySQL permission to set the sql_log_off session variable can disable logging for their own session (and the separate permission to set set restricted session variables). For optimal security, restrict access to this setting.
These changes require a MySQL server restart. We recommend scheduling this reboot during a maintenance window.

The following steps may require the assistance of your local database administrator.

Click this link to log into your AWS RDS Console.
Under Amazon RDS in the left-hand menu, go to Parameter groups.
Select an existing parameter group for your MySQL database (or create a new one using these AWS instructions)
Click Edit parameters.
Using the search box, find the following parameter keys and set their corresponding values:

Flag Value
general_log On
log_output TABLE
Click Save.

Flag	Value
general_log	On
log_output	TABLE

Log into your MySQL database’s shell and execute the following command to manage log rotation:

Command	Outcome	Notes
`CALL mysql.rds_rotate_general_log;`	Deletes the `mysql.general_log_backup` table, renames `mysql.general_log` to `general_log_backup`, and creates a new `mysql.general_log` table.	mysql.rds_rotate_general.log is a function delivered with all AWS MySQL databases. For more information, please visit the AWS RDS documentation. Note: To limit the size of logs, AWS RDS calls this function whenever logs exceed 10GB or 10% of database space. You can also configure your MySQL server to call this function on a regular cadence.

Restart your MySQL server at your earliest convenience.

Retrieve Connection Information

In addition to configuring a service account, Netskope DSPM will also require additional information in order to communicate with your MySQL instance.

Click this link to log into your AWS RDS Console.
Under Amazon RDS in the left-hand menu, navigate to Databases.
For the database you wish Netskope DSPM to scan, click its link in the DB Identifier column.
- Note: For Aurora MySQL, be sure to choose a database with Role = “Writer Instance” instead of “Regional cluster”.
In the Connectivity & security section, make note of the following values:

Highlight Color Corresponding Netskope DSPM Value Example
Blue (Endpoint) Data Store Endpoint
Grey (Port) Data Store Endpoint

Highlight Color	Corresponding Netskope DSPM Value	Example
Blue (Endpoint)	Data Store Endpoint
Grey (Port)	Data Store Endpoint

Connect Your Data Store

Before attempting to connect a AWS Data Store, be sure you have configured a Netskope DSPM-specific AWS Service Account and onboarded the AWS Infrastructure for this Data Store.

Step 1: Provide Credentials

Follow these steps to configure the connection:

Go to Data Stores > Data Store Inventory.
Click CONNECT A DATA STORE in the upper right.

Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.
In the Connect a Data Store window, click the data store icon you wish to connect.
In the Provide Credentials section, complete the following fields:

Field	Value
Select AWS Account	Select one of the AWS Accounts defined within the Infrastructure Section screen. The field defaults if there is just one AWS Account configured.
Data Store Identifier	Provide a friendly name to describe this Data Store.
Data Store Endpoint	Enter the corresponding values from the Retrieve Connection Information step above, plus the port number. For example, for an address like `example.rds.amazonaws.com`, you would enter `example.rds.amazonaws.com:3306`. (Note: 3306 is the default MySQL port number. Substitute if you use a custom port).
Authentication Method	Select the desired authentication method (Snapshots, IAM, or Username/Password).
Database Username	Enter the corresponding value from the Using a Netskope DSPM Service Account step above.
Password	When Authentication Method equals “Username / Password”, enter the corresponding value from the Password-based authentication step above.
Scan Frequency	Controls how often your Data Store is reviewed for changes.
Sidecar Pool	If you will use sidecars to monitor this data store, select a sidecar pool with network visibility to said data store. This field is displayed when there is at least one defined sidecar pool. To learn more, please visit our Sidecar Administration article.

Step 2: Scanning Infrastructure

Click Next.
When the Select Capabilities tab appears, complete the following fields:
- Assign a Data Owner (Optional): Select one or more users responsible for this data store.
- Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
- Features: Select the features you want to enable.

Capability	Supported for AWS Aurora MySQL via Service Account	Supported for AWS Aurora MySQL via Snapshots
Discovery	Yes (always-on)	Yes
Privilege Analysis	Yes Note: MySQL version 8.0 or higher is required. Disable for older versions.	No
Shadow Data Analysis	Yes	No
Classification	Yes	Yes
Data In Use Monitoring	Yes Note: Query logging must be configured first.	No
Automation	Yes (always-on)	Yes

Step 3: Review and Save

Click Save.
- When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
Click Save to finalize the connection.

If you encounter the error Unable to access system logs for MySQL database after saving, double-check your logging configurations in the Configure Query Logging section above.