Connect AWS Redshift to DSPM - Netskope Technical Documentation

Overview

Netskope DSPM supports scanning AWS Redshift data stores. Follow these instructions to setup AWS Redshift and configure its connection to Netskope DSPM.

Prerequisites:

You have database administrator access for the data store.
The following are locally-installed:
- Python (version 3 or higher)
- PostgreSQL-only: Psycopg PostgreSQL driver for Python
- AWS-only: AWS CLI
Redshift only: you have validated your setup & AWS environment connectivity using the aws configure command.

Retrieve Connection Information

Netskope DSPM will require information about your data store in order to communicate with Redshift. Please follow the steps below to identify the connection values for later use within Netskope DSPM.

Click this link to log into your AWS Console, which will navigate you to the Redshift service.
Click Clusters in the left-hand menu.
In the displayed list of clusters, navigate to the Redshift cluster you wish to later connect.
In the General information section, make note of the following values:

Highlighted Value	Example
Endpoint
Port
Database

Create a Netskope DSPM Service Account

A service account within the database is required for connecting your data store with the Netskope DSPM application. Netskope DSPM provides a Python script which both creates the service account and assigns the necessary non-super user permissions.

Run Script

Open the command line interface (CLI).
Run the following command to download the script:

wget https://dasera-release.s3.us-west-2.amazonaws.com/redshift_setup.py

If necessary, navigate to the directory where the script was downloaded.
Run the script.
When prompted, enter the following parameters:

Parameter	Value
Endpoint	Enter the corresponding value from the Retrieve Connection Information step above.
Database	Enter the corresponding value from the Retrieve Connection Information step above.
Port	Enter the corresponding value from the Retrieve Connection Information step above. Note: 5439 is default Redshift port number. If you are using a custom port number, be sure to substitute it here.
Username	Username of the database administrator running this script
Password	Password of the database administrator running this script
Username to create for Netskope DSPM user	Provide the Database name for which you want to create the Netskope DSPM DB user. dasera_user is recommended, but you can use any value.
Password	Password for the Netskope DSPM DB user

When the script is complete, the following message (or similar) will be displayed:

Created user dasera_user with global select access

Using IAM as Authentication Method

For Netskope DSPM to authenticate via IAM, you’ll need to give Netskope DSPM the following AWS permission:

{
  "Action": "redshift:GetClusterCredentials",
  "Resource": [
    "arn:aws:redshift:<region>:<account>:dbuser:<cluster>/<username>",
    "arn:aws:redshift:<region>:<account>:dbname:<cluster>/<database>"
  ]
}

Where <username> is the Redshift User (database username) you created above.

The redshift:GetClusterCredentials permission allows the Netskope DSPM instance to authenticate as the Redshift User you just created, forgoing the need to provide the user’s password to Netskope DSPM.

Note you must specify both a dbuser and dbname resource, and the dbname resource identifiers must cover every database you wish Dasera to scan. As an alternative to listing each database explicitly, you can use wildcards. In the example above, if the 2nd resource is replaced with:

"arn:aws:redshift:<region>:<account>:dbname:<cluster>/*

Netskope DSPM will be able to connect (as <username>) to all databases in the specified cluster. Similarly:

"arn:aws:redshift:<region>:<account>:dbname:*/*"

This will allow Netskope DSPM to connect to all clusters and databases in the given region (provided the database user <username> exists in each cluster).

If you have Redshift clusters in different regions (but the same AWS account), you will need a unique dbuser and dbname resource lines per unique combination of <region>, e.g.

{
  "Action": "redshift:GetClusterCredentials",
  "Resource": [
    "arn:aws:redshift:<region1>:<account>:dbuser:<cluster>/<username>",
    "arn:aws:redshift:<region1>:<account>:dbname:*/*",
    "arn:aws:redshift:<region2>:<account>:dbuser:<cluster>/<username>",
    "arn:aws:redshift:<region2>:<account>:dbname:*/*"
  ]
}

If the Netskope DSPM instance is going to be installed in an AWS account that is different from the account(s) running the Redshift cluster(s), IAM is not currently supported. The Dasera instance will need to authenticate via password (see below).

Connect Your Data Store

Before attempting to connect an AWS Data Store, be sure you have configured a Netskope DSPM-specific AWS Service Account and onboarded the AWS Infrastructure for this Data Store. For details, please visit our Onboarding AWS Accounts article.

Step 1: Provide Credentials

Follow these steps to configure the connection:

Go to Data Stores > Data Store Inventory.
Click CONNECT A DATA STORE in the upper right.

Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.
In the Connect a Data Store window, click the data store icon you wish to connect.
In the Provide Credentials section, complete the following fields:

Field	Value
Select AWS Account	Select one of the AWS Accounts defined within the Infrastructure Section screen. The field will default if there is just one AWS Account configured.
Data Store Identifier	Provide a friendly name to describe this Data Store. Your value is displayed in other Netskope DSPM screens such as Policy Management and Classification Management.
Data Store Endpoint	Enter the corresponding value from the Retrieve Connection Information step above, plus the port number and database name. For example, for a Public IP address like 1.2.3.4 and database named “example_db”, you would enter 1.2.3.4:5439/example_db. Note: 5439 is default Redshift port number. If you are using a custom port number, be sure to substitute it here.
Database Username	Enter the corresponding value from the Create a Netskope DSPM Service Account step above.
Authentication Method	Select a type based on your available configurations: AWS Identity Access Management (IAM), RoleUsername/PasswordAWS, Secrets Manager, Self-Managed Secrets Manager
Password	Enter the corresponding value from the Create a Netskope DSPM Service Account step above.
Scan Frequency	Controls how often your Data Store is reviewed for changes, Netskope DSPM’s recommended frequency is defaulted, which you can override if (desired).
Sidecar Pool	If you will use sidecars to monitor this data store, select a sidecar pool with network visibility to said data store. This field is displayed when there is at least one defined sidecar pool. To learn more, please visit our Sidecar Administration article.

Step 2: Scanning Infrastructure

Click Next.
When the Select Capabilities tab appears, complete the following fields:
- Assign a Data Owner (Optional): Select one or more users responsible for this data store.
- Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
- Features: Select the features you want to enable.

Feature	Supported for this data store?
Discovery	Yes (always-on)
Privileges Analysis	Yes
Shadow Data Analysis	Yes
Classification	Yes
Data In Use Monitoring	Yes
Automation	Yes (always-on)

Step 3: Review and Save

Click Save.
- When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
Click Save to finalize the connection.