Connect AWS RDS SQL Server to DSPM

Overview

Netskope DSPM supports scanning AWS RDS SQL Server Data Stores. Follow these instructions to setup your AWS RDS SQL Server database and configure its connection to Netskope DSPM.

Authenticate Data Store

There are two methods for authenticating RDS and Aurora data stores: Snapshots or Service Account.

Using Snapshots

Snapshots are quicker and simpler, spinning up a secure copy of the data store for Netskope DSPM to scan without needing to create a Service Account. This copy exists only within your Netskope DSPM instance, and Netskope DSPM does not store any associated data. It’s encrypted and then immediately spun down, so there are no lingering data copies.

The following features are not supported when authenticating via Snapshot:

• Privilege Analysis
• Data-in-use monitoring
• Database selection
• Sample data collection

Ensure you’ve enabled Data Store Snapshots access during AWS Infrastructure onboarding. For already onboarded accounts, make sure the IAM policy used for DSPM includes the permissions required for Data Store Snapshots Access (note that this also requires the permissions from Feature 3: Unmanaged Data Stores). Depending on whether you onboarded an AWS Organization or an individual AWS account, you can find these granular permissions in the Onboard AWS Infrastructure Manually article under:

• Instructions > Onboard an AWS Organization > Step 3 (Optional): Create the Custom IAM Policy > Feature 4: Authorize Data Store Snapshots Access.
• Instructions > Onboard an Individual AWS Account > Step 3 (Optional): Create the Custom IAM Policy > Feature 4: Authorize Data Store Snapshots Access.

Once connected, data classification in the data store runs via Snapshot, which appears on the Data Store Inventory page as a small layered square note icon to the right of the hyperlinked data store name. You can later edit the data store and turn off Snapshots, at which point a Service Account will be required to authenticate the data store.

Using a Netskope DSPM Service Account

Begin by configuring a service account dedicated to Netskope DSPM’s use:

1. As a DB administrator, log into your SQL database.

2. Create the Netskope DSPM-specific SQL user by executing the following commands in the mentioned order:

   Command	Outcome	Notes
   CREATE LOGIN 'dasera_user' WITH PASSWORD ='dasera_password'	Creates the DB user which will be dedicated to Netskope DSPM's use as a service account.	Substitute dasera_user and dasera_password with your own preferred values. You will need this information later when configuring Netskope DSPM. Note: We recommend using dasera as the username and a password of your choice.
   USE "database name"; CREATE USER dasera FOR LOGIN 'dasera_user'; ALTER ROLE db_datareader ADD MEMBER dasera;	Grants read-only access to the Netskope DSPM specific DB user in each SQL database you want to scan. The CREATE USER command enables the previously created LOGIN to access the database. The built-in db_datareader role grants read-only access to all schemas and tables (including system tables) on the active database.	Substitute database_name with the name of each SQL DB you wish to scan with the Netskope DSPM Application.

Retrieve Connection Information

In addition to configuring a service account, Netskope DSPM will also require additional information in order to communicate with your SQL database. Follow the steps below to identify the connection values for later use within Netskope DSPM.

Highlight Color	Corresponding Netskope DSPM Value	Example
Blue	Data Store Endpoint
Gray	Port

Connect Your Data Store

Step 1: Provide Credentials

Follow these steps to configure the connection:

1. Go to Data Stores > Data Store Inventory.

2. Click CONNECT A DATA STORE in the upper right.

   Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.

   

3. In the Connect a Data Store window, click the data store icon you wish to connect.

4. In the Provide Credentials section, complete the following fields:

Field	Value
AWS Account Name	Select one of the AWS Accounts defined within the Infrastructure Section screen. The field defaults if there is just one AWS account configured.
Data Store Identifier	Friendly name to describe this Data Store. Your value is displayed in other Netskope DSPM screens such as Policy Management and Classification Management.
Data Store Endpoint	Enter the corresponding value from the Retrieve Connection Information section above.
Database Username (if Service Account)	Enter the corresponding value from the Using a Netskope DSPM Service Account step above.
Password (if Service Account)	Enter the corresponding value from the Using a Netskope DSPM Service Account step above.
Scan Frequency	Controls how often your Data Store is reviewed for changes, Netskope DSPM's recommended frequency is defaulted, which you can override (if desired).
Sidecar Pool	If you will use sidecars to monitor this data store, select a sidecar pool with network visibility to said data store. This field is displayed when there is at least one defined sidecar pool. To learn more, please visit our Sidecar Administration article.

Step 2: Scanning Infrastructure

1. Click Next.
2. When the Select Capabilities tab appears, complete the following fields:
   • Assign a Data Owner (Optional): Select one or more users responsible for this data store.
   • Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
   • Features: Select the features you want to enable.

Feature	Supported for AWS RDS SQL Server via Service Account	Supported for AWS RDS SQL Server via Snapshots
Discovery	Yes (always-on)	Yes
Configuration Analysis	Yes	Yes
Privilege Analysis	Yes	No
Shadow Data Analysis	Yes	No
Classification	Yes	Yes
Data In-Use Monitoring	No	No
Automation	Yes (always-on)	Yes

Step 3: Review and Save

1. Click Save.
   • When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
2. Click Save to finalize the connection.