Deploy DSPM Sidecars on AWS EC2 via CloudFormation

Overview

The Netskope DSPM application (also known as Netskope One DSPM) requires seamless connectivity to scan your Data Stores. However, as per common security practices, businesses tends to deny proper firewall egress between their internal networks & external applications. Such limitations impact the operational use of Netskope DSPM and reduce the full return value of your subscription.

To overcome this, Netskope DSPM provides a flexible collection architecture, consisting of one or many sidecars you deploy alongside your Data Stores. These sidecars collect necessary metadata and transfer it to the Netskope DSPM application. Within this central management console, you can take action on insights from across all Data Stores regardless of where they are hosted.

Prerequisites

Ensure you meet the following requirements:

• Netskope DSPM Tenant: You will need a Netskope DSPM-hosted tenant to receive the sidecar-collected metadata.
• Sidecar AMI: The Netskope DSPM sidecar AMI needs to be shared with your organization. Contact your CSM to request this AMI and supply:
  • Your AWS account number.
  • The AWS region where you will deploy the instance.
• DLP Appliance Connectivity : Sidecars require connectivity to a local DLP appliance to perform classification activities using your DLP Profiles and Rules. Before deploying the sidecar, ensure the following:
  • A DLP appliance has been deployed and is accessible within the same network where the sidecar will be installed (or in directly connected networks, to avoid additional peering or complex routing).
  • The sidecar and DLP appliance must be able to communicate via HTTPS (port 443).
  • You have generated or obtained the required REST API v1 Key and License Key.

Architecture

Netskope DSPM uses a flexible architecture where you deploy one or more sidecars alongside your main application. These sidecars connect directly to your data stores to collect samples, which a local DLP appliance then scans. Afterward, the sidecars upload the classification results back to the Netskope DSPM application.

A single sidecar can efficiently scan multiple data stores within its installed environment. Although you typically deploy one sidecar per isolated network (such as a VPC or VNet), you can install multiple sidecars to achieve higher scalability and redundancy. In these highly available setups, the Netskope DSPM application automatically load-balances scan operations across all healthy sidecars within a given pool.

The following diagram illustrates the relationship between Netskope DSPM resources and your environment:

Configure Outbound Egress

Since Netskope hosts and manages the Netskope DSPM application, you must update your firewall or security group settings to allow outbound egress. Configure your allowlist on port 443 using the following group.

• Required for Core Connectivity: Add these addresses to ensure the sidecar can communicate with the DSPM platform. Substitute [TENANT] with your actual tenant name:

  Address
  [TENANT].goskope.com
  sidecar-[tenant].goskope.com
  netskope-dspm-release.s3.us-west-2.amazonaws.com
  995750983908.dkr.ecr.us-west-2.amazonaws.com

Configure Sidecar Pool

To set up the relationship between your sidecars and Netskope DSPM-hosted tenant, you will provide the sidecars with unique authentication tokens generated within our Sidecar Administration UI.

1. Log in to the Netskope DSPM application.

2. Go to the Administration > Sidecar menu.

3. Click Add Sidecar Pool.

4. On the Details tab, complete the following field:

   Field	Value
   Name	Any friendly value to describe the sidecar pool.

5. Click Save.

6. Click Copy at the bottom of the Sidecar Authentication Token modal to save the generated token to your clipboard.

   

7. Click the X button to exit the modal.

Since you haven’t yet associated this token with a sidecar, the sidecar pool will appear only when you click the Show Inactive Sidecars icon in the upper right, with empty Version, Status, and DLP Status columns for now.

Configure the CloudFormation Stack

1. For the account where you will configure the CloudFormation Stack, log in to the AWS console. The CloudFormation Stacks dashboard displayed.

2. Select the target region, if necessary.

3. On the dashboard, click Create Stack and select the With new resources (standard) option. The Step 1 screen is displayed.

4. Under the Specify template section, enter the following value in the Amazon S3 URL field:

   https://netskope-dspm-release.s3.us-west-2.amazonaws.com/NetskopeDSPM-SidecarOnEC2-dlp.yml

5. Click Next. The Step 2 screen is displayed.

6. Provide the required Name field.

7. Under the Parameters section, enter these values:

   Parameter	Value
   AMIImageId	AMI ID of the Netskope DSPM sidecar image shared with your organization. This value can be found in your AMI Catalog in the My AMIs section after clearing all filters then filtering by Owner = “Shared With Me”.
   DaseraMainApplicationHost	Your tenant URL minus the protocol. For example, if your tenant is accessed using https://example.goskope.com, your value will be example.goskope.com.
   SidecarPoolToken	An existing sidecar token, or a new one generated in the Register Sidecar Pool section above.
   SSHKey	Name of the SSH key you wish to install on the sidecar. Installing patches and security updates requires an admin to connect to the sidecar via SSH. If this is pre-configured you can select the same from the drop down list; otherwise, please configure a new key pair within the AWS EC2 Console.
   SecurityGroupId	Your own AWS security group that you wish to associate. Please ensure the security group belongs to the same network as the subnet you will launch the Netskope DSPM sidecar, otherwise deployment will fail.
   SubnetId	This is the subnet to launch the Netskope DSPM sidecar. This will determine the VPC and availability zone of the sidecar.

Proceed with configuring the remainder of your CloudFormation deployment as desired. When ready, go to the final step, click Submit, and monitor the build to completion.

• When your sidecar deployment is complete, its EC2 instance status will change from CREATE_IN_PROGRESS to CREATE_COMPLETE.
• If not, review the Status Reason column to understand the cause, remediate the issues, and reattempt configuring the CloudFormation stack.

To learn more about the resources created by the above actions, expand the following section:

Resources Created

On the Resources tab, these resources are listed:

Resource Type	Logical ID	Additional Details
AWS::EC2::LaunchTemplate	IMDSv2LaunchTemplate	None
AWS::IAM::Role	DSPMSidecarInstanceRole	Creates a role named DSPMSidecarInstanceRole that contains permissions needed for sidecar to read all supported data store types.
AWS::IAM::Policy	DSPMPolicy	Creates a policy named DSPM_SidecarInstance_Policy that contains permissions needed to facilitate scanning features, including standing up temporary EC2 instances to facilitate snapshot scanning.
AWS::EC2::Instance	DSPMInstance	Creates an instance named Netskope DSPM Sidecar using m5.xlarge instance type & 100GB gp2 SSD volume.
AWS::IAM::InstanceProfile	DSPMInstanceProfile	Associates a new role to instance created.

Each sidecar instance is deployed as a m5.2xlarge EC2 instance (equaling 8CPU/32GB).

Validate Sidecar Connection

When deploying sidecar, you’ll need to ensure that the sidecar has the ability to reach your tenant. Take the following steps to verify the connectivity from the sidecar.

1. Log in to the Netskope DSPM application.
2. Go to Administration > Sidecar.
3. For the sidecar(s) in question, validate that:
   • The Version column is populated.
   • The Status indicator is green. 
   • The DLP Status column shows a healthy connection to your DLP appliance.

It may take a few minutes for newly-running sidecars to communicate with the Netskope DSPM application.

Rotating Sidecar Tokens

These instructions apply if your security practice requires regularly rotating security tokens, or if your sidecar is failing to communicate with the Netskope DSPM application due to an invalid token. These steps will be repeated for each individual sidecar within the sidecar pool.

Generate a New Token in Netskope DSPM

1. Log in to your Netskope DSPM instance.
2. Go to Administration > Sidecar to open the Sidecar Administration screen.
3. For the sidecar pool registration whose token you wish to rotate, click the Generate New Token icon.
4. The Generate New Token modal is displayed. Read and then click Confirm.
5. Click Copy at the bottom of the Generate New Token modal to save the generated token to your clipboard.
6. Close the modal.

Apply the New Token in AWS

1. Log in to the AWS EC2 Console. The EC2 dashboard is displayed.

2. In the left menu, go to the Instances > Instances screen. The Instances dashboard is displayed.

3. In the list of instances, click the Instance ID hyperlink corresponding to the Netskope One DSPM sidecar requiring the token update. The Instance Summary screen is displayed.

4. Click Connect. The Connect to instance screen is displayed.

5. Provide ubuntu as the user name and press the Connect button to start a SSH session to the sidecar.

   

6. The AWS CLI is displayed.

7. Enter the command ./tokenrotate.sh

8. Follow the prompts to enter your new token

9. Enter the command helm uninstall netskope -n netskope to delete the existing Helm deployment

10. Enter the command ./helm.sh to redeploy Helm using the new token

Configure for an SSL Proxy Environment (Optional)

If your organization routes outbound traffic through an SSL proxy, you must perform the following steps to allow your sidecar to communicate with the Netskope DSPM platform.

1. Use an SSH client to connect to the sidecar’s IP address

2. In the Helm chart folder, open the values.yaml file.

3. Add an entry at the bottom of the file for the httpsProxy value eg.

   httpsProxy: https://192.168.1.17

4. Redeploy the Helm chart

When deployment is complete, your sidecar should immediately begin communicating via the designated proxy.

Next Steps: Link Sidecar to DLP Appliance

After deployment, you must link your newly deployed sidecar to a DLP appliance to enable data classification.

For detailed instructions, see Link a DLP Appliance to a Sidecar Pool.