Connect AWS RDS PostgreSQL to DSPM

Overview

Netskope DSPM supports scanning AWS PostgreSQL Data Stores. Follow these instructions to set up your AWS PostgreSQL database and configure its connection to Netskope DSPM.

Authenticate Data Store

There are two methods for authenticating RDS and Aurora data stores: Snapshots or Service Account.

Using Snapshots

Snapshots are quicker and simpler, spinning up a secure copy of the data store for Netskope DSPM to scan without needing to create a Service Account. This copy exists only within your Netskope DSPM instance, and Netskope DSPM does not store any associated data. It’s encrypted and then immediately spun down, so there are no lingering data copies. Please note that spinning up the data store copy can cause the scan initiation process to take several hours.

The following features are not supported when authenticating via Snapshot:

• Privilege Analysis
• Data-in-use monitoring
• Database selection
• Sample data collection

Ensure you’ve enabled Data Store Snapshots access during AWS Infrastructure onboarding. For already onboarded accounts, make sure the IAM policy used for DSPM includes the permissions required for Data Store Snapshots Access (note that this also requires the permissions from Feature 3: Unmanaged Data Stores). Depending on whether you onboarded an AWS Organization or an individual AWS account, you can find these granular permissions in the Onboard AWS Infrastructure Manually article under:

• Instructions > Onboard an AWS Organization > Step 3 (Optional): Create the Custom IAM Policy > Feature 4: Authorize Data Store Snapshots Access
• Instructions > Onboard an Individual AWS Account > Step 3 (Optional): Create the Custom IAM Policy > Feature 4: Authorize Data Store Snapshots Access

Once connected, data classification in the data store runs via Snapshot, which appears on the Data Store Inventory page as a small layered square note icon to the right of the hyperlinked data store name. You can later edit the data store and turn off Snapshots, at which point a Service Account will be required to authenticate the data store.

Using a Netskope DSPM Service Account

Authenticating the data store via Service Account requires additional configuration steps within AWS and may involve additional administrative support, as outlined below. Service Account authentication enables access to all supported capabilities within Netskope DSPM.

Begin by configuring a PostgreSQL service account, which will be dedicated to Netskope DSPM’s use. There are two approaches you can use for configuring this service account:

User Type	Benefits	Drawbacks
Super User (Netskope DSPM-recommended)	Can automatically access new schemas and databases as they are created.	Some customers are not comfortable with granting super user access.
Non-Super User	Useful for customers who wish to grant Netskope DSPM access to only the data within scanning scope.	Must be explicitly granted access to new schemas and databases.

Configure Query Logging

Netskope DSPM’s Data-In-Use Monitoring capability requires access to query logging. If you wish to leverage this capability, you must configure your PostgreSQL database to begin generating such logs. This includes configuring parameters and establishing a log retrieval function.

Please follow the steps below to define these configurations.

Set Query Logging Parameters

1. Click this link to log into your AWS RDS Console, which will navigate you to the RDS service.
2. Under Amazon RDS in the left-hand menu, go to Parameter groups.

3. Select an existing parameter group for your PostgreSQL database. If one does not exist, create a new one using these AWS instructions.
4. On the next screen, click the Edit parameters button.
5. Using the search box, find the following parameter keys and set the corresponding values:

Parameter Key	Parameter Value
log_statement	all
log_min_duration_statement	0
log_rotation_age	Any value between 60 to 1440 (minutes)
log_destination	csvlog
logging_collector	1
log_filename	postgresql.log.%Y-%m-%d-%H
log_retention_period	4320

Create a Log Retrieval Function

The following steps may require the assistance of your local database administrator.

1. Download the latest (master) Amazon RDS / Aurora Logging function script from the aws-samples GitHub repository.
2. As an administrator, log into your PostgreSQL database’s shell as an administrator using these AWS instructions.
3. Run the downloaded script within your shell to create the necessary logging function. Once run successfully you should be able to see the following functions created in the logs schema.

To validate, call the new function once by executing select public.load_postgres_log_files(). This should result in loading the query logs into the postgres_logs table. You can also run select * from logs.postgres_logs to check the query log output.

Retrieve Connection Information

Netskope DSPM will require information about your data store in order to communicate with your PostgreSQL database. Please follow the steps below to identify the connection values for later use within Netskope DSPM.

1. Click this link to log into your AWS RDS Console, which will navigate you to the RDS service.
2. Under Amazon RDS in the left-hand menu, navigate to Databases.
3. For the database you wish Netskope DSPM to scan, click its link in the DB Identifier column.  For Aurora PostgreSQL, be sure to choose a database with Role = “Writer Instance” (instead of “Regional cluster”)
4. In the Connectivity & security section, make note of the following values:

Highlight Color	Corresponding Netskope DSPM Value	Example
Blue (Endpoint)	Data Store Endpoint
Gray (Port)	Port

Connect Your Data Store

Before attempting to connect an AWS Data Store, be sure you have configured a Netskope DSPM-specific AWS Service Account and onboarded the AWS Infrastructure for this Data Store. 

Step 1: Provide Credentials

Follow these steps to configure the connection:

1. Go to Data Stores > Data Store Inventory.

2. Click CONNECT A DATA STORE in the upper right.

   Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.

   

3. In the Connect a Data Store window, click the data store icon you wish to connect.

4. In the Provide Credentials section, complete the following fields:

Field	Value
AWS Account Name	Select one of the AWS Accounts defined within the Infrastructure Section screen. The field will default if there is just one AWS Account configured.
Data Store Identifier	Provide a friendly name to describe this Data Store. Your value is displayed in other Netskope DSPM screens such as Policy Management and Classification Management.
Data Store Endpoint	Enter the corresponding value from the Retrieve Connection Information step above, plus the port number and database name. For example, for a public IP address like 1.2.3.4 and database named example_db, you would enter 1.2.3.4:5432/example_db. Note: 5432 is the default PostgreSQL port number. If you are using a custom port number, be sure to substitute it here.
Database Username (if Service Account)	Enter the corresponding value from the Using a Netskope DSPM Service Account step above.
Password (if Service Account)	Enter the corresponding value from the Using a Netskope
Scan Frequency	Controls how often your Data Store is reviewed for changes. Netskope DSPM’s recommended frequency is defaulted, which you can override if desired.
Sidecar Pool	If you will use sidecars to monitor this data store, select a sidecar pool with network visibility to said data store. This field is displayed when there is at least one defined sidecar pool. To learn more, please visit our Sidecar Administration article.

Step 2: Scanning Infrastructure

1. Click Next.
2. When the Select Capabilities tab appears, complete the following fields:
   • Assign a Data Owner (Optional): Select one or more users responsible for this data store.
   • Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
   • Features: Select the features you want to enable.

The following table summarizes which capabilities are supported via Service Account versus Snapshots for AWS RDS PostgreSQL:

Feature	Supported for AWS RDS PostgreSQL via Service Account	Supported for AWS RDS PostreSQL via Snapshots
Discovery	Yes (always-on)	Yes
Privilege Analysis	Yes	No
Shadow Data Analysis	Yes	No
Classification	Yes	Yes
Data In-Use Monitoring	Yes (query logging must be configured before enabling this capability; see **Configure Query Logging section above)	No
Automation	Yes (always-on)	Yes

Step 3: Review and Save

1. Click Save.
   • When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
2. Click Save to finalize the connection.