Overview
Netskope DSPM supports scanning GCP PostgreSQL Data Stores. Follow these instructions to set up your GCP Cloud SQL for PostgreSQL database and configure its connection to Netskope DSPM.
Authenticate Data Store
There are two methods for authenticating GCP Cloud SQL for PostreSQL data stores: Snapshot Scan or Netskope DSPM-specific credentials.
Using Snapshot Scan
Snapshot Scans are quicker and simpler, spinning up a secure copy of the data store for Netskope DSPM to scan without needing to create Netskope DSPM-specific credentials. This copy exists only within your Netskope DSPM instance, and Netskope DSPM does not store any associated data. It’s encrypted and then immediately spun down, so there are no lingering data copies. Please note that spinning up the data store copy can cause the scan initiation process can take several hours.
The following features are not supported when authenticating via Snapshot:
- Privilege Analysis
- Data-in-use monitoring
- Database selection
- Sample data collection
Ensure you’ve enabled data store Snapshots access during GCP Infrastructure onboarding. For already onboarded accounts, you must manually add permission Cloud SQL Admin in the GCP Console.
Once connected, data classification in the data store runs via Snapshot, which appears on the Data Store Inventory page as a small layered square note icon to the right of the hyperlinked data store name. You can later edit the data store and turn off Snapshots, at which point Netskope DSPM-specific credentials will be required to authenticate the data store.
Using Netskope DSPM-Specific Credentials
Authenticating the data store via Netskope DSPM-specific credentials requires additional configuration steps within GCP and may involve additional administrative support, as outlined below. This type of authentication enables access to all supported capabilities within Netskope DSPM.
Begin by configuring an PostgreSQL service account which will be dedicated to Netskope DSPM’s use.
To connect to your database server, you need the full server name and admin sign-in credentials. You can easily find the server name and sign-in information from GCP CloudSql Console page.
- As an administrator, log into your PostgreSQL database’s shell using these GCP instructions.
- Create the Netskope DSPM-specific PostgreSQL user by executing the following commands in order using your preferred client tool, such as Cloudshell, pgAdmin or psql.
| Command | Outcome | Notes |
|---|---|---|
CREATE ROLE "dasera_user" WITH LOGIN NOSUPERUSER INHERIT CREATEDB NOCREATEROLE NOREPLICATION PASSWORD "dasera_password"; | Creates the DB user which will be dedicated to Netskope DSPM’s use as a service account. | Substitute “dasera_user” and “dasera_password” with your own preferred values. You will need this information later when configuring Netskope DSPM. Note : We recommend to use dasera as the username and a password of your choice. You will need this information later when configuring Netskope DSPM. |
GRANT CONNECT ON DATABASE "database name" TO "dasera_user"; | Grants read-only access to the Netskope DSPM specific DB user in the PostgreSQL database to you want to scan. | Substitute “database name ” for each PostgreSQL DB you wish to scan with Netskope DSPM Application |
Retrieve Connection Information
Netskope DSPM requires additional information to communicate with your PostgreSQL instance. Connection details vary depending on whether you connect to the data store with Netskope DSPM-specific credentials or via Snapshot Scan.
Connection Information for Netskope DSPM-Specific Credentials
Please follow the steps below to identify the connection values for later use within Netskope DSPM.
- Click this link to log into your GCP Console, which will navigate you to a list of your SQL instances.
- For the database instance you wish Netskope DSPM to scan, make note of the following value, which will later be used within Netskope DSPM for connecting your Data Store.
| Database Value | Corresponding Netskope DSPM Value | Example |
|---|---|---|
| Public IP address | Data Store Endpoint |  |
Connection Information for Snapshot Scan
Please follow the steps below to identify the connection values for later use within Netskope DSPM.
- Click this link to log into your GCP Console, which will navigate you to a list of your SQL instances.
- For the PostgreSQL database instance you wish Netskope DSPM to scan, make a note of the following value, which will later be used within Netskope DSPM for connecting your data store.
| Database Value | Correspondin Netskope DSPM Value | Example (See highlighted value) |
|---|---|---|
| Instance ID | Data Store Instance ID |  |
Connect Your Data Store
Step 1: Provide Credentials
Follow these steps to configure the connection:
-
Go to Data Stores > Data Store Inventory.
-
Click CONNECT A DATA STORE in the upper right.
Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.
-
In the Connect a Data Store window, click the data store icon you wish to connect.
-
In the Provide Credentials section, complete the following fields:
| Field | Value |
|---|---|
| Select GCP Account | Select one of the GCP Accounts defined within the Infrastructure Section screen. The field will default if there is just one GCP Account configured. |
| Data Store Identifier | Provide a friendly name to describe this Data Store. Your value is displayed in other Netskope DSPM screens such as Policy Management and Classification Management. |
| Data Store Instance ID (If Snapshot Scan) | Enter the corresponding value from the Connection Information for Snapshot Scan step above. |
| Data Store Endpoint (If Netskope DSPM-specific credentials) | Enter the corresponding value from the Connection Information for Netskope DSPM-Specific Credentials step above, plus the port number and database name. For example, for a Public IP address like 1.2.3.4 and database named “example_db”, you would enter 1.2.3.4:5432/example_db Note: 5432 is default PostgreSQL port number. If you are using a custom port number, be sure to substitute it here. |
| Database Username (If Netskope DSPM-specific credentials) | Enter the corresponding value of the service user account created in the step Using Netskope DSPM-specific Credentials above. |
| Password (If Netskope DSPM-specific credentials) | Enter the corresponding value of the service user account password configured in the step Using Netskope DSPM-Specific Credentials above. |
| Scan Frequency | Controls how often your Data Store is reviewed for changes, Netskope DSPM’s recommended frequency is defaulted, which you can override (if desired). |
| Sidecar Pool | If you will use sidecars to monitor this data store, select a sidecar pool with network visibility to said data store. This field is displayed when there is at least one defined sidecar pool. To learn more, please visit our Sidecar Administration article. |
Step 2: Scanning Infrastructure
- Click Next.
- When the Select Capabilities tab appears, complete the following fields:
- Assign a Data Owner (Optional): Select one or more users responsible for this data store.
- Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
- Features: Select the features you want to enable.
| Capability | Supported for this GCP Cloud SQL for PostgreSQL via Netskope DSPM-specific Credentials | Supported for this GCP Cloud SQL for PostgreSQL via Snapshot Scan |
|---|---|---|
| Discovery | Yes (always-on) | Yes |
| Privilege Analysis | Yes | No |
| Shadow Data Analysis | No | No |
| Classification | Yes | Yes |
| Data-In-Use Monitoring | Yes (custom query logs only) | No |
| Automation | Yes (always-on) | Yes |
Step 3: Review and Save
- Click Save.
- When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
- Click Save to finalize the connection.