Onboard AWS Infrastructure Manually - Netskope Technical Documentation

Overview

This article provides instructions to manually onboard AWS Accounts or AWS Organizations to Netskope DSPM (also known as Netskope One DSPM). This allows the discovery, scanning, and classification of your data stores.

These manual configuration steps for setting up Netskope DSPM with AWS are still valid but have been replaced by automation methods. For a simpler and recommended approach, see the following articles:
– Onboarding AWS via CloudFormation
– Onboarding AWS via Terraform

Feature Summary

When you configure an Individual AWS Account or an AWS Organization in Netskope DSPM, you can enable several capabilities on the Capabilities tab. The following table summarizes what each toggle does and where it applies.

Use this summary together with the JSON policy blocks detailed in Step 3 of the instructions below.

Toggle Description	Details
Auto-Discover New Data Stores	Automatically discovers supported data stores (for example, S3, RDS, Redshift, EC2 volumes, DynamoDB) in the onboarded account or organization.
Scan EBS/EFS and Auto-Discover Unmanaged Data Stores	Allows Netskope DSPM to scan EBS volumes and EFS file systems, and auto-discover unmanaged data stores by creating a temporary, isolated scan environment.
Ingest Tags	Allows Netskope DSPM to ingest AWS resource tags to provide additional context and improve classification.
Authorize Data Store Snapshots Access	Allows Netskope DSPM to create and access temporary snapshots of supported data stores (for example, RDS), including KMS‑encrypted snapshots, for deep scanning.
Auto-Discover New Accounts (Org)	Applies only to AWS Organizations. Automatically discovers new data stores when they are created within the AWS Organization. Not applicable to individual accounts.
Enable AWS Inventory	Toggle this option to allow DSPM to use the native AWS S3 Inventory feature for S3 data stores. When enabled, DSPM stores bucket metadata in a dedicated inventory bucket instead of making individual API calls to fetch file metadata. This significantly reduces API costs for large buckets. Note: This toggle is disabled by default because it requires additional AWS permissions. When enabled at the infrastructure level, the Use S3 Inventory option becomes available when connecting individual S3 data stores. For more details, see Connect AWS S3 to DSPM.

Instructions

Choose the workflow that matches your goal. The instructions for onboarding an Individual Account and an Organization are separate and self-contained.

Onboard an Individual AWS Account

Onboard an AWS Organization

Follow this workflow to onboard a single AWS Account.

Step 1: Start in Netskope DSPM

You must start in the Netskope DSPM console to generate a unique ExternalId for your AWS account.

Go to Administration > Infrastructure Connections.
Click Add Infrastructure > Select AWS > Add Account.
Select the Capabilities tab > Enable the toggles for the features you plan to configure (e.g., “Ingest Tags”, “Auto-Discover New Data Stores”).
Select Manually Configured > Click Next.
Fill in the Account Name > Click Next.
Copy the External ID.
Keep this browser tab open.

Step 2: Create the IAM Role in AWS

In a new browser tab, log into the AWS IAM Console.
Go to Roles and click Create role.
Select trusted entity > Choose Custom trust policy.

Paste the following JSON.

Note: In the sts:ExternalId field, paste the External ID you copied from Netskope in Step 1.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAssumeRoleForNetskope",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::842940822891:root",
          "arn:aws:iam::946157925481:root"
        ]
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "PASTE_YOUR_EXTERNAL_ID_HERE"
        }
      }
    },
    {
      "Sid": "AllowTagSessionForNetskope",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::842940822891:root",
          "arn:aws:iam::946157925481:root"
        ]
      },
      "Action": "sts:TagSession"
    }
  ]
}

Click Next.
Give the role a name (e.g., NetskopeDSPMRole) > Click Create role.
From the list of roles, click your new role and copy its Role ARN.

Step 3 (Optional): Create the Custom IAM Policy

You only need to complete this step if you enabled “Ingest Tags”, “Scan EBS/EFS and Auto-Discover Unmanaged Data Stores”, or “Authorize Data Store Snapshots Access” in Step 1. If you only enabled “Auto-Discover New Data Stores”, you can skip this step and proceed to Step 4.

In the AWS IAM Console, go to Policies > Create policy > JSON tab.

Paste the following JSON wrapper.

{
  "Version": "2012-10-17",
  "Statement": [ ]
}

Copy only the JSON blocks for the features you enabled in step 1 and paste them into the empty Statement: [] array.

Feature 1: Ingest Tags

Feature 2: Auto-Discover New Data Stores

Feature 3: Scan EBS/EFS and Auto-Discover Unmanaged Data Stores

Feature 4: Authorize Data Store Snapshots Access

{
  "Sid": "TagGetResources",
  "Effect": "Allow",
  "Action": [
    "tag:GetResources"
  ],
  "Resource": "*"
}

{
  "Sid": "EFSReadAndMount",
  "Effect": "Allow",
  "Action": [
    "elasticfilesystem:DescribeBackupPolicy",
    "elasticfilesystem:DescribeMountTargets",
    "elasticfilesystem:DescribeTags",
    "elasticfilesystem:DescribeReplicationConfigurations",
    "elasticfilesystem:ListTagsForResource",
    "elasticfilesystem:DescribeLifecycleConfiguration",
    "elasticfilesystem:ClientMount",
    "elasticfilesystem:DescribeFileSystemPolicy",
    "elasticfilesystem:DescribeAccessPoints",
    "elasticfilesystem:DescribeFileSystems",
    "elasticfilesystem:DescribeMountTargetSecurityGroups"
  ],
  "Resource": "*"
},
{
  "Sid": "FSXRead",
  "Effect": "Allow",
  "Action": [
    "fsx:DescribeFileSystems",
    "fsx:DescribeStorageVirtualMachines"
  ],
  "Resource": "*"
},
{
  "Sid": "AllowRedshiftGetCredentials",
  "Effect": "Allow",
  "Action": [
    "redshift:GetClusterCredentials"
  ],
  "Resource": "*"
},
{
  "Sid": "DSPMRestrictedAthenaAndGlueAccess",
  "Effect": "Allow",
  "Action": [
    "athena:ListDataCatalogs",
    "athena:GetDataCatalog",
    "athena:ListDatabases",
    "athena:GetDatabase",
    "athena:ListTableMetadata",
    "athena:GetTableMetadata",
    "athena:StartQueryExecution",
    "athena:GetQueryExecution",
    "athena:GetQueryResults",
    "athena:GetQueryResultsStream",
    "athena:BatchGetQueryExecution",
    "athena:CancelQueryExecution",
    "athena:ListQueryExecutions",
    "athena:ListWorkGroups",
    "athena:GetWorkGroup",
    "athena:CreatePreparedStatement",
    "athena:GetPreparedStatement",
    "athena:ListPreparedStatements",
    "athena:UpdatePreparedStatement",
    "athena:DeletePreparedStatement",
    "athena:BatchGetPreparedStatement",
    "athena:GetNamedQuery",
    "athena:ListNamedQueries",
    "athena:BatchGetNamedQuery",
    "athena:CreateWorkGroup",
    "athena:UpdateWorkGroup",
    "athena:TagResource",
    "athena:UntagResource",
    "glue:GetDatabase",
    "glue:GetDatabases",
    "glue:GetTable",
    "glue:GetTables",
    "glue:GetPartition",
    "glue:GetPartitions",
    "glue:BatchGetPartition",
    "glue:GetTags",
    "glue:SearchTables",
    "lakeformation:GetDataAccess",
    "lakeformation:ListPermissions",
    "lakeformation:ListResources",
    "s3:GetObject",
    "s3:ListBucket",
    "s3:PutObject",
    "s3:AbortMultipartUpload",
    "s3:ListMultipartUploadParts",
    "s3:GetBucketLocation",
    "s3:ListAllMyBuckets",
    "s3:GetEncryptionConfiguration"
  ],
  "Resource": "*"
}

{
  "Sid": "ScanEnvironmentCreation",
  "Effect": "Allow",
  "Action": [
    "ec2:CreateVpc",
    "ec2:CreateSecurityGroup",
    "ec2:CreateSubnet",
    "ec2:CreateSnapshot",
    "ec2:CreateVolume",
    "ec2:CreateInternetGateway"
  ],
  "Resource": "*",
  "Condition": {
    "StringEqualsIfExists": {
      "aws:RequestTag/Vendor": "Netskope",
      "aws:RequestTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "RestrictedEC2InstanceLaunching",
  "Effect": "Allow",
  "Action": "ec2:RunInstances",
  "Resource": "*",
  "Condition": {
    "StringEqualsIfExists": {
      "aws:RequestTag/Vendor": "Netskope",
      "aws:RequestTag/Product": "DSPM"
    },
    "StringLikeIfExists": {
      "ec2:InstanceType": [
        "t3.*",
        "m5.*"
      ]
    }
  }
},
{
  "Sid": "NetworkConnectivityResourceCreation",
  "Effect": "Allow",
  "Action": [
    "ec2:CreateRoute",
    "ec2:ModifySubnetAttribute"
  ],
  "Resource": "*"
},
{
  "Sid": "EC2NetworkAndSGManagement",
  "Effect": "Allow",
  "Action": [
    "ec2:AttachInternetGateway",
    "ec2:ModifyVpcAttribute",
    "ec2:AuthorizeSecurityGroupIngress",
    "ec2:AuthorizeSecurityGroupEgress"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "ec2:ResourceTag/Vendor": "Netskope",
      "ec2:ResourceTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "MandatoryResourceTagging",
  "Effect": "Allow",
  "Action": "ec2:CreateTags",
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "ec2:CreateAction": [
        "CreateVpc",
        "CreateSecurityGroup",
        "CreateSubnet",
        "CreateSnapshot",
        "CreateVolume",
        "RunInstances",
        "CreateRoute",
        "CreateInternetGateway"
      ]
    }
  }
},
{
  "Sid": "EC2DeleteDSPMResources",
  "Effect": "Allow",
  "Action": [
    "ec2:DeleteSecurityGroup",
    "ec2:DeleteSubnet",
    "ec2:DetachInternetGateway",
    "ec2:DeleteInternetGateway",
    "ec2:DeleteVpc",
    "ec2:DeleteVolume",
    "ec2:DeleteSnapshot",
    "ec2:TerminateInstances"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "ec2:ResourceTag/Vendor": "Netskope",
      "ec2:ResourceTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "EC2DeleteRoute",
  "Effect": "Allow",
  "Action": [
    "ec2:DeleteRoute"
  ],
  "Resource": "*"
}

This feature also requires all 7 permissions from Feature 3 (Unmanaged Data Stores).

In the PassRoleForRDSRestoreOperations statement below, if you used a different role name in Step 2, replace NetskopeDSPMRole with your custom role name.

{
  "Sid": "RDSDescribeDatabasesAndSnapshots",
  "Effect": "Allow",
  "Action": [
    "rds:DescribeDBClusters",
    "rds:DescribeDBSnapshots",
    "rds:DescribeDBClusterSnapshots",
    "rds:ListTagsForResource",
    "rds:DescribeEventSubscriptions",
    "rds:DescribeDBSubnetGroups",
    "rds:DescribeEvents",
    "rds:DescribeReservedDBInstances",
    "rds:DescribeDBEngineVersions",
    "rds:DescribeDBInstanceAutomatedBackups",
    "rds:DescribeDBInstances"
  ],
  "Resource": "*"
},
{
  "Sid": "AllowRDSRestoreFromSnapshot",
  "Effect": "Allow",
  "Action": [
    "rds:CreateDBSnapshot",
    "rds:CreateDBClusterSnapshot",
    "rds:RestoreDBInstanceFromDBSnapshot",
    "rds:RestoreDBClusterFromSnapshot",
    "rds:CreateDBSubnetGroup"
  ],
  "Resource": "*",
  "Condition": {
    "StringEqualsIfExists": {
      "aws:RequestTag/Vendor": "Netskope",
      "aws:RequestTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "AllowAddingTagsToRDSResources",
  "Effect": "Allow",
  "Action": [
    "rds:AddTagsToResource"
  ],
  "Resource": "*"
},
{
  "Sid": "RDSModifyTemporaryResources",
  "Effect": "Allow",
  "Action": [
    "rds:ModifyDBInstance"
  ],
  "Resource": [
    "arn:aws:rds:*:*:db:dasera-scan-temp-*",
    "arn:aws:rds:*:*:db:netskope-dspm-scan-temp-*"
  ]
},
{
  "Sid": "RDSDeleteTaggedTemporaryResources",
  "Effect": "Allow",
  "Action": [
    "rds:DeleteDBInstance"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "rds:db-tag/Vendor": "Netskope",
      "rds:db-tag/Product": "DSPM"
    }
  }
},
{
  "Sid": "KMSAccessForEncryptedSnapshots",
  "Effect": "Allow",
  "Action": [
    "kms:Decrypt",
    "kms:DescribeKey",
    "kms:CreateGrant"
  ],
  "Resource": "arn:aws:kms:*:*:key/*",
  "Condition": {
    "StringEquals": {
      "kms:ViaService": "rds.amazonaws.com"
    }
  }
},
{
  "Sid": "PassRoleForRDSRestoreOperations",
  "Effect": "Allow",
  "Action": "iam:PassRole",
  "Resource": "arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>",
  "Condition": {
    "StringEquals": {
      "iam:PassedToService": "rds.amazonaws.com"
    }
  }
}

Click Next.
Give the policy a name (e.g., NetskopeDSPMCustomPolicy) and click Create policy.

Step 4: Attach Policies to the Role

Return to your NetskopeDSPMRole in the AWS Console.
On the Permissions tab, click Add permissions > Attach policies.
Find and attach the AWS-managed policy:
- IAMReadOnlyAccess: Allows DSPM to map which IAM users and roles have access to your sensitive data stores, providing a complete picture of your data access posture.
(If you created an Optional Custom Policy in the previous step) Find and attach NetskopeDSPMCustomPolicy.
(If you enabled the feature “Auto-Discover New Data Stores”) Attach these five AWS-managed policies:
- AmazonS3ReadOnlyAccess: Allows DSPM to discover and read S3 buckets to assess their security and classify the data inside.
- AmazonRedshiftReadOnlyAccess: Allows DSPM to discover and classify data within Amazon Redshift clusters.
- AmazonRDSReadOnlyAccess: Allows DSPM to discover and inventory Amazon RDS database instances.
- AmazonEC2ReadOnlyAccess: Allows DSPM to discover EC2 instances and attached EBS volumes. This is required for detecting unmanaged data stores on those volumes.
- AmazonDynamoDBReadOnlyAccess: Allows DSPM to discover and classify data within Amazon DynamoDB tables.
  - Note for Advanced Users (Least-Privilege):
    These 5 policies are listed together for simplicity. For a stricter least-privilege configuration, you only need to attach the policies for the AWS services you actively use. For example, if your environment does not use Amazon S3, you may omit the AmazonS3ReadOnlyAccess policy.

Step 5: Complete Connection in Netskope DSPM

Return to the Netskope DSPM browser tab.
On the Review screen, paste the Role ARN you copied.
Click Save.

Follow this workflow to onboard an entire AWS Organization or specific OUs.

Step 1: Start in Netskope DSPM

You must start in the Netskope DSPM console to generate a unique ExternalId for your AWS account.

Go to Administration > Infrastructure Connections.
Click the AWS tab > Add Infrastructure > Add Organization.
Select the Capabilities tab > Enable the toggles for the features you plan to configure.
Click Next. Select Manually Configured.
Fill in the Organization Name.
Click Next to the Review screen.
Copy the External ID.
Keep this browser tab open.

Step 2: Create the IAM Role in AWS

In a new browser tab, log into the AWS IAM Console.
Go to Roles and click Create role.
Select trusted entity > Choose Custom trust policy.

Paste the following JSON.

In the sts:ExternalId field, paste the External ID you copied from Netskope Step 1.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAssumeRoleForNetskope",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::842940822891:root",
          "arn:aws:iam::946157925481:root"
        ]
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "PASTE_YOUR_EXTERNAL_ID_HERE"
        }
      }
    },
    {
      "Sid": "AllowTagSessionForNetskope",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::842940822891:root",
          "arn:aws:iam::946157925481:root"
        ]
      },
      "Action": "sts:TagSession"
    }
  ]
}

Click Next.
Give the role a name (e.g., NetskopeDSPMOrgRole) > Click Create role.
From the list of roles, click your new role and copy its Role ARN.

Step 3 (Optional): Create the Custom IAM Policy

In the AWS IAM Console, go to Policies > Create policy > JSON tab.

Paste the following JSON wrapper.

{
  "Version": "2012-10-17",
  "Statement": [ ]
}

Copy only the JSON blocks for the features you enabled in step 1 (e.g., Ingest Tags, Unmanaged Data Stores, etc.) and paste them into the empty Statement: [] array.

Feature 1: Ingest Tags

Feature 2: Auto-Discover New Data Stores

Feature 3: Scan EBS/EFS and Auto-Discover Unmanaged Data Stores

Feature 4: Authorize Data Store Snapshots Access

{
  "Sid": "TagGetResources",
  "Effect": "Allow",
  "Action": [
    "tag:GetResources"
  ],
  "Resource": "*"
}

{
  "Sid": "EFSReadAndMount",
  "Effect": "Allow",
  "Action": [
    "elasticfilesystem:DescribeBackupPolicy",
    "elasticfilesystem:DescribeMountTargets",
    "elasticfilesystem:DescribeTags",
    "elasticfilesystem:DescribeReplicationConfigurations",
    "elasticfilesystem:ListTagsForResource",
    "elasticfilesystem:DescribeLifecycleConfiguration",
    "elasticfilesystem:ClientMount",
    "elasticfilesystem:DescribeFileSystemPolicy",
    "elasticfilesystem:DescribeAccessPoints",
    "elasticfilesystem:DescribeFileSystems",
    "elasticfilesystem:DescribeMountTargetSecurityGroups"
  ],
  "Resource": "*"
},
{
  "Sid": "FSXRead",
  "Effect": "Allow",
  "Action": [
    "fsx:DescribeFileSystems",
    "fsx:DescribeStorageVirtualMachines"
  ],
  "Resource": "*"
},
{
  "Sid": "AllowRedshiftGetCredentials",
  "Effect": "Allow",
  "Action": [
    "redshift:GetClusterCredentials"
  ],
  "Resource": "*"
},
{
  "Sid": "DSPMRestrictedAthenaAndGlueAccess",
  "Effect": "Allow",
  "Action": [
    "athena:ListDataCatalogs",
    "athena:GetDataCatalog",
    "athena:ListDatabases",
    "athena:GetDatabase",
    "athena:ListTableMetadata",
    "athena:GetTableMetadata",
    "athena:StartQueryExecution",
    "athena:GetQueryExecution",
    "athena:GetQueryResults",
    "athena:GetQueryResultsStream",
    "athena:BatchGetQueryExecution",
    "athena:CancelQueryExecution",
    "athena:ListQueryExecutions",
    "athena:ListWorkGroups",
    "athena:GetWorkGroup",
    "athena:CreatePreparedStatement",
    "athena:GetPreparedStatement",
    "athena:ListPreparedStatements",
    "athena:UpdatePreparedStatement",
    "athena:DeletePreparedStatement",
    "athena:BatchGetPreparedStatement",
    "athena:GetNamedQuery",
    "athena:ListNamedQueries",
    "athena:BatchGetNamedQuery",
    "athena:CreateWorkGroup",
    "athena:UpdateWorkGroup",
    "athena:TagResource",
    "athena:UntagResource",
    "glue:GetDatabase",
    "glue:GetDatabases",
    "glue:GetTable",
    "glue:GetTables",
    "glue:GetPartition",
    "glue:GetPartitions",
    "glue:BatchGetPartition",
    "glue:GetTags",
    "glue:SearchTables",
    "lakeformation:GetDataAccess",
    "lakeformation:ListPermissions",
    "lakeformation:ListResources",
    "s3:GetObject",
    "s3:ListBucket",
    "s3:PutObject",
    "s3:AbortMultipartUpload",
    "s3:ListMultipartUploadParts",
    "s3:GetBucketLocation",
    "s3:ListAllMyBuckets",
    "s3:GetEncryptionConfiguration"
  ],
  "Resource": "*"
}

{
  "Sid": "ScanEnvironmentCreation",
  "Effect": "Allow",
  "Action": [
    "ec2:CreateVpc",
    "ec2:CreateSecurityGroup",
    "ec2:CreateSubnet",
    "ec2:CreateSnapshot",
    "ec2:CreateVolume",
    "ec2:CreateInternetGateway"
  ],
  "Resource": "*",
  "Condition": {
    "StringEqualsIfExists": {
      "aws:RequestTag/Vendor": "Netskope",
      "aws:RequestTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "RestrictedEC2InstanceLaunching",
  "Effect": "Allow",
  "Action": "ec2:RunInstances",
  "Resource": "*",
  "Condition": {
    "StringEqualsIfExists": {
      "aws:RequestTag/Vendor": "Netskope",
      "aws:RequestTag/Product": "DSPM"
    },
    "StringLikeIfExists": {
      "ec2:InstanceType": [
        "t3.*",
        "m5.*"
      ]
    }
  }
},
{
  "Sid": "NetworkConnectivityResourceCreation",
  "Effect": "Allow",
  "Action": [
    "ec2:CreateRoute",
    "ec2:ModifySubnetAttribute"
  ],
  "Resource": "*"
},
{
  "Sid": "EC2NetworkAndSGManagement",
  "Effect": "Allow",
  "Action": [
    "ec2:AttachInternetGateway",
    "ec2:ModifyVpcAttribute",
    "ec2:AuthorizeSecurityGroupIngress",
    "ec2:AuthorizeSecurityGroupEgress"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "ec2:ResourceTag/Vendor": "Netskope",
      "ec2:ResourceTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "MandatoryResourceTagging",
  "Effect": "Allow",
  "Action": "ec2:CreateTags",
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "ec2:CreateAction": [
        "CreateVpc",
        "CreateSecurityGroup",
        "CreateSubnet",
        "CreateSnapshot",
        "CreateVolume",
        "RunInstances",
        "CreateRoute",
        "CreateInternetGateway"
      ]
    }
  }
},
{
  "Sid": "EC2DeleteDSPMResources",
  "Effect": "Allow",
  "Action": [
    "ec2:DeleteSecurityGroup",
    "ec2:DeleteSubnet",
    "ec2:DetachInternetGateway",
    "ec2:DeleteInternetGateway",
    "ec2:DeleteVpc",
    "ec2:DeleteVolume",
    "ec2:DeleteSnapshot",
    "ec2:TerminateInstances"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "ec2:ResourceTag/Vendor": "Netskope",
      "ec2:ResourceTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "EC2DeleteRoute",
  "Effect": "Allow",
  "Action": [
    "ec2:DeleteRoute"
  ],
  "Resource": "*"
}

This feature also requires all 7 permissions from Feature 3 (Unmanaged Data Stores).

In PassRoleForRDSRestoreOperations, if you used a different role name in Step 2, replace NetskopeDSPMRole with your custom role name.

{
  "Sid": "RDSDescribeDatabasesAndSnapshots",
  "Effect": "Allow",
  "Action": [
    "rds:DescribeDBClusters",
    "rds:DescribeDBSnapshots",
    "rds:DescribeDBClusterSnapshots",
    "rds:ListTagsForResource",
    "rds:DescribeEventSubscriptions",
    "rds:DescribeDBSubnetGroups",
    "rds:DescribeEvents",
    "rds:DescribeReservedDBInstances",
    "rds:DescribeDBEngineVersions",
    "rds:DescribeDBInstanceAutomatedBackups",
    "rds:DescribeDBInstances"
  ],
  "Resource": "*"
},
{
  "Sid": "AllowRDSRestoreFromSnapshot",
  "Effect": "Allow",
  "Action": [
    "rds:CreateDBSnapshot",
    "rds:CreateDBClusterSnapshot",
    "rds:RestoreDBInstanceFromDBSnapshot",
    "rds:RestoreDBClusterFromSnapshot",
    "rds:CreateDBSubnetGroup"
  ],
  "Resource": "*",
  "Condition": {
    "StringEqualsIfExists": {
      "aws:RequestTag/Vendor": "Netskope",
      "aws:RequestTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "AllowAddingTagsToRDSResources",
  "Effect": "Allow",
  "Action": [
    "rds:AddTagsToResource"
  ],
  "Resource": "*"
},
{
  "Sid": "RDSModifyTemporaryResources",
  "Effect": "Allow",
  "Action": [
    "rds:ModifyDBInstance"
  ],
  "Resource": [
    "arn:aws:rds:*:*:db:dasera-scan-temp-*",
    "arn:aws:rds:*:*:db:netskope-dspm-scan-temp-*"
  ]
},
{
  "Sid": "RDSDeleteTaggedTemporaryResources",
  "Effect": "Allow",
  "Action": [
    "rds:DeleteDBInstance"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "rds:db-tag/Vendor": "Netskope",
      "rds:db-tag/Product": "DSPM"
    }
  }
},
{
  "Sid": "KMSAccessForEncryptedSnapshots",
  "Effect": "Allow",
  "Action": [
    "kms:Decrypt",
    "kms:DescribeKey",
    "kms:CreateGrant"
  ],
  "Resource": "arn:aws:kms:*:*:key/*",
  "Condition": {
    "StringEquals": {
      "kms:ViaService": "rds.amazonaws.com"
    }
  }
},
{
  "Sid": "PassRoleForRDSRestoreOperations",
  "Effect": "Allow",
  "Action": "iam:PassRole",
  "Resource": "arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>",
  "Condition": {
    "StringEquals": {
      "iam:PassedToService": "rds.amazonaws.com"
    }
  }
}

Click Next.
Give the policy a name (e.g., NetskopeDSPMCustomPolicy) > Click Create policy.

Step 4: Attach Policies to the Role

Return to your NetskopeDSPMOrgRole in the AWS Console.
On the Permissions tab, click Add permissions > Attach policies.
Find and attach the following AWS-managed policies:
- IAMReadOnlyAccess: Allows DSPM to map which IAM users and roles have access to your sensitive data stores, providing a complete picture of your data access posture.
- AWSOrganizationsReadOnlyAccess: Required for discovering accounts within your AWS Organization.
(If you created an “Optional Custom Policy” in the previous step) Find and attach NetskopeDSPMCustomPolicy.
(If you enabled “Auto-Discover New Data Stores”) Attach these five AWS-managed policies:
- AmazonS3ReadOnlyAccess: Allows DSPM to discover and read S3 buckets to assess their security and classify the data inside.
- AmazonRedshiftReadOnlyAccess: Allows DSPM to discover and classify data within Amazon Redshift clusters.
- AmazonRDSReadOnlyAccess: Allows DSPM to discover and inventory Amazon RDS database instances.
- AmazonEC2ReadOnlyAccess: Allows DSPM to discover EC2 instances and attached EBS volumes. This is required for detecting unmanaged data stores on those volumes.
- AmazonDynamoDBReadOnlyAccess: Allows DSPM to discover and classify data within Amazon DynamoDB tables.
  - Note for Advanced Users (Least-Privilege):
    These 5 policies are listed together for simplicity. For a stricter least-privilege configuration, you only need to attach the policies for the AWS services you actively use.

Step 5: Complete Connection in Netskope DSPM

Return to the Netskope DSPM browser tab.
On the Review screen, paste the Role ARN you copied.
Click Save.

Troubleshooting

Error: “Cannot ingest AWS tags due to missing permissions.”
- Cause: The IAM policy is missing the tag:GetResources permission.
- Fix: Edit your NetskopeDSPMCustomPolicy in AWS and add the JSON statement for the Ingest Tags feature.
Error: “Netskope encountered an error while scanning… Missing required AWS permissions: ec2:DeleteSnapshot”
- Cause: The role is missing permissions for Unmanaged Data Stores.
- Fix: Edit your custom IAM policy and add all 7 JSON statements for the Scan EBS/EFS and Auto-Discover Unmanaged Data Stores feature.
Error: “KMS decryption failed for RDS snapshot”
- Cause: The role is missing the KMS permissions required for Data Store Snapshots.
- Fix: Edit your custom IAM policy and add all 8 JSON statements for the Authorize Data Store Snapshots Access feature.

Overview

Feature Summary

Use this summary together with the JSON policy blocks detailed in Step 3 of the instructions below.

Toggle Description	Details
Auto-Discover New Data Stores	Automatically discovers supported data stores (for example, S3, RDS, Redshift, EC2 volumes, DynamoDB) in the onboarded account or organization.
Scan EBS/EFS and Auto-Discover Unmanaged Data Stores	Allows Netskope DSPM to scan EBS volumes and EFS file systems, and auto-discover unmanaged data stores by creating a temporary, isolated scan environment.
Ingest Tags	Allows Netskope DSPM to ingest AWS resource tags to provide additional context and improve classification.
Authorize Data Store Snapshots Access	Allows Netskope DSPM to create and access temporary snapshots of supported data stores (for example, RDS), including KMS‑encrypted snapshots, for deep scanning.
Auto-Discover New Accounts (Org)	Applies only to AWS Organizations. Automatically discovers new data stores when they are created within the AWS Organization. Not applicable to individual accounts.
Enable AWS Inventory	Toggle this option to allow DSPM to use the native AWS S3 Inventory feature for S3 data stores. When enabled, DSPM stores bucket metadata in a dedicated inventory bucket instead of making individual API calls to fetch file metadata. This significantly reduces API costs for large buckets. Note: This toggle is disabled by default because it requires additional AWS permissions. When enabled at the infrastructure level, the Use S3 Inventory option becomes available when connecting individual S3 data stores. For more details, see Connect AWS S3 to DSPM.

Instructions

Choose the workflow that matches your goal. The instructions for onboarding an Individual Account and an Organization are separate and self-contained.

Onboard an Individual AWS Account

Onboard an AWS Organization

Follow this workflow to onboard a single AWS Account.

Step 1: Start in Netskope DSPM

You must start in the Netskope DSPM console to generate a unique ExternalId for your AWS account.

Go to Administration > Infrastructure Connections.
Click Add Infrastructure > Select AWS > Add Account.
Select the Capabilities tab > Enable the toggles for the features you plan to configure (e.g., “Ingest Tags”, “Auto-Discover New Data Stores”).
Select Manually Configured > Click Next.
Fill in the Account Name > Click Next.
Copy the External ID.
Keep this browser tab open.

Step 2: Create the IAM Role in AWS

In a new browser tab, log into the AWS IAM Console.
Go to Roles and click Create role.
Select trusted entity > Choose Custom trust policy.

Paste the following JSON.

Note: In the sts:ExternalId field, paste the External ID you copied from Netskope in Step 1.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAssumeRoleForNetskope",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::842940822891:root",
          "arn:aws:iam::946157925481:root"
        ]
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "PASTE_YOUR_EXTERNAL_ID_HERE"
        }
      }
    },
    {
      "Sid": "AllowTagSessionForNetskope",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::842940822891:root",
          "arn:aws:iam::946157925481:root"
        ]
      },
      "Action": "sts:TagSession"
    }
  ]
}

Click Next.
Give the role a name (e.g., NetskopeDSPMRole) > Click Create role.
From the list of roles, click your new role and copy its Role ARN.

Step 3 (Optional): Create the Custom IAM Policy

In the AWS IAM Console, go to Policies > Create policy > JSON tab.

Paste the following JSON wrapper.

{
  "Version": "2012-10-17",
  "Statement": [ ]
}

Copy only the JSON blocks for the features you enabled in step 1 and paste them into the empty Statement: [] array.

Feature 1: Ingest Tags

Feature 2: Auto-Discover New Data Stores

Feature 3: Scan EBS/EFS and Auto-Discover Unmanaged Data Stores

Feature 4: Authorize Data Store Snapshots Access

{
  "Sid": "TagGetResources",
  "Effect": "Allow",
  "Action": [
    "tag:GetResources"
  ],
  "Resource": "*"
}

{
  "Sid": "EFSReadAndMount",
  "Effect": "Allow",
  "Action": [
    "elasticfilesystem:DescribeBackupPolicy",
    "elasticfilesystem:DescribeMountTargets",
    "elasticfilesystem:DescribeTags",
    "elasticfilesystem:DescribeReplicationConfigurations",
    "elasticfilesystem:ListTagsForResource",
    "elasticfilesystem:DescribeLifecycleConfiguration",
    "elasticfilesystem:ClientMount",
    "elasticfilesystem:DescribeFileSystemPolicy",
    "elasticfilesystem:DescribeAccessPoints",
    "elasticfilesystem:DescribeFileSystems",
    "elasticfilesystem:DescribeMountTargetSecurityGroups"
  ],
  "Resource": "*"
},
{
  "Sid": "FSXRead",
  "Effect": "Allow",
  "Action": [
    "fsx:DescribeFileSystems",
    "fsx:DescribeStorageVirtualMachines"
  ],
  "Resource": "*"
},
{
  "Sid": "AllowRedshiftGetCredentials",
  "Effect": "Allow",
  "Action": [
    "redshift:GetClusterCredentials"
  ],
  "Resource": "*"
},
{
  "Sid": "DSPMRestrictedAthenaAndGlueAccess",
  "Effect": "Allow",
  "Action": [
    "athena:ListDataCatalogs",
    "athena:GetDataCatalog",
    "athena:ListDatabases",
    "athena:GetDatabase",
    "athena:ListTableMetadata",
    "athena:GetTableMetadata",
    "athena:StartQueryExecution",
    "athena:GetQueryExecution",
    "athena:GetQueryResults",
    "athena:GetQueryResultsStream",
    "athena:BatchGetQueryExecution",
    "athena:CancelQueryExecution",
    "athena:ListQueryExecutions",
    "athena:ListWorkGroups",
    "athena:GetWorkGroup",
    "athena:CreatePreparedStatement",
    "athena:GetPreparedStatement",
    "athena:ListPreparedStatements",
    "athena:UpdatePreparedStatement",
    "athena:DeletePreparedStatement",
    "athena:BatchGetPreparedStatement",
    "athena:GetNamedQuery",
    "athena:ListNamedQueries",
    "athena:BatchGetNamedQuery",
    "athena:CreateWorkGroup",
    "athena:UpdateWorkGroup",
    "athena:TagResource",
    "athena:UntagResource",
    "glue:GetDatabase",
    "glue:GetDatabases",
    "glue:GetTable",
    "glue:GetTables",
    "glue:GetPartition",
    "glue:GetPartitions",
    "glue:BatchGetPartition",
    "glue:GetTags",
    "glue:SearchTables",
    "lakeformation:GetDataAccess",
    "lakeformation:ListPermissions",
    "lakeformation:ListResources",
    "s3:GetObject",
    "s3:ListBucket",
    "s3:PutObject",
    "s3:AbortMultipartUpload",
    "s3:ListMultipartUploadParts",
    "s3:GetBucketLocation",
    "s3:ListAllMyBuckets",
    "s3:GetEncryptionConfiguration"
  ],
  "Resource": "*"
}

{
  "Sid": "ScanEnvironmentCreation",
  "Effect": "Allow",
  "Action": [
    "ec2:CreateVpc",
    "ec2:CreateSecurityGroup",
    "ec2:CreateSubnet",
    "ec2:CreateSnapshot",
    "ec2:CreateVolume",
    "ec2:CreateInternetGateway"
  ],
  "Resource": "*",
  "Condition": {
    "StringEqualsIfExists": {
      "aws:RequestTag/Vendor": "Netskope",
      "aws:RequestTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "RestrictedEC2InstanceLaunching",
  "Effect": "Allow",
  "Action": "ec2:RunInstances",
  "Resource": "*",
  "Condition": {
    "StringEqualsIfExists": {
      "aws:RequestTag/Vendor": "Netskope",
      "aws:RequestTag/Product": "DSPM"
    },
    "StringLikeIfExists": {
      "ec2:InstanceType": [
        "t3.*",
        "m5.*"
      ]
    }
  }
},
{
  "Sid": "NetworkConnectivityResourceCreation",
  "Effect": "Allow",
  "Action": [
    "ec2:CreateRoute",
    "ec2:ModifySubnetAttribute"
  ],
  "Resource": "*"
},
{
  "Sid": "EC2NetworkAndSGManagement",
  "Effect": "Allow",
  "Action": [
    "ec2:AttachInternetGateway",
    "ec2:ModifyVpcAttribute",
    "ec2:AuthorizeSecurityGroupIngress",
    "ec2:AuthorizeSecurityGroupEgress"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "ec2:ResourceTag/Vendor": "Netskope",
      "ec2:ResourceTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "MandatoryResourceTagging",
  "Effect": "Allow",
  "Action": "ec2:CreateTags",
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "ec2:CreateAction": [
        "CreateVpc",
        "CreateSecurityGroup",
        "CreateSubnet",
        "CreateSnapshot",
        "CreateVolume",
        "RunInstances",
        "CreateRoute",
        "CreateInternetGateway"
      ]
    }
  }
},
{
  "Sid": "EC2DeleteDSPMResources",
  "Effect": "Allow",
  "Action": [
    "ec2:DeleteSecurityGroup",
    "ec2:DeleteSubnet",
    "ec2:DetachInternetGateway",
    "ec2:DeleteInternetGateway",
    "ec2:DeleteVpc",
    "ec2:DeleteVolume",
    "ec2:DeleteSnapshot",
    "ec2:TerminateInstances"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "ec2:ResourceTag/Vendor": "Netskope",
      "ec2:ResourceTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "EC2DeleteRoute",
  "Effect": "Allow",
  "Action": [
    "ec2:DeleteRoute"
  ],
  "Resource": "*"
}

This feature also requires all 7 permissions from Feature 3 (Unmanaged Data Stores).

In the PassRoleForRDSRestoreOperations statement below, if you used a different role name in Step 2, replace NetskopeDSPMRole with your custom role name.

{
  "Sid": "RDSDescribeDatabasesAndSnapshots",
  "Effect": "Allow",
  "Action": [
    "rds:DescribeDBClusters",
    "rds:DescribeDBSnapshots",
    "rds:DescribeDBClusterSnapshots",
    "rds:ListTagsForResource",
    "rds:DescribeEventSubscriptions",
    "rds:DescribeDBSubnetGroups",
    "rds:DescribeEvents",
    "rds:DescribeReservedDBInstances",
    "rds:DescribeDBEngineVersions",
    "rds:DescribeDBInstanceAutomatedBackups",
    "rds:DescribeDBInstances"
  ],
  "Resource": "*"
},
{
  "Sid": "AllowRDSRestoreFromSnapshot",
  "Effect": "Allow",
  "Action": [
    "rds:CreateDBSnapshot",
    "rds:CreateDBClusterSnapshot",
    "rds:RestoreDBInstanceFromDBSnapshot",
    "rds:RestoreDBClusterFromSnapshot",
    "rds:CreateDBSubnetGroup"
  ],
  "Resource": "*",
  "Condition": {
    "StringEqualsIfExists": {
      "aws:RequestTag/Vendor": "Netskope",
      "aws:RequestTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "AllowAddingTagsToRDSResources",
  "Effect": "Allow",
  "Action": [
    "rds:AddTagsToResource"
  ],
  "Resource": "*"
},
{
  "Sid": "RDSModifyTemporaryResources",
  "Effect": "Allow",
  "Action": [
    "rds:ModifyDBInstance"
  ],
  "Resource": [
    "arn:aws:rds:*:*:db:dasera-scan-temp-*",
    "arn:aws:rds:*:*:db:netskope-dspm-scan-temp-*"
  ]
},
{
  "Sid": "RDSDeleteTaggedTemporaryResources",
  "Effect": "Allow",
  "Action": [
    "rds:DeleteDBInstance"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "rds:db-tag/Vendor": "Netskope",
      "rds:db-tag/Product": "DSPM"
    }
  }
},
{
  "Sid": "KMSAccessForEncryptedSnapshots",
  "Effect": "Allow",
  "Action": [
    "kms:Decrypt",
    "kms:DescribeKey",
    "kms:CreateGrant"
  ],
  "Resource": "arn:aws:kms:*:*:key/*",
  "Condition": {
    "StringEquals": {
      "kms:ViaService": "rds.amazonaws.com"
    }
  }
},
{
  "Sid": "PassRoleForRDSRestoreOperations",
  "Effect": "Allow",
  "Action": "iam:PassRole",
  "Resource": "arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>",
  "Condition": {
    "StringEquals": {
      "iam:PassedToService": "rds.amazonaws.com"
    }
  }
}

Click Next.
Give the policy a name (e.g., NetskopeDSPMCustomPolicy) and click Create policy.

Step 4: Attach Policies to the Role

Return to your NetskopeDSPMRole in the AWS Console.
On the Permissions tab, click Add permissions > Attach policies.
Find and attach the AWS-managed policy:
- IAMReadOnlyAccess: Allows DSPM to map which IAM users and roles have access to your sensitive data stores, providing a complete picture of your data access posture.
(If you created an Optional Custom Policy in the previous step) Find and attach NetskopeDSPMCustomPolicy.
(If you enabled the feature “Auto-Discover New Data Stores”) Attach these five AWS-managed policies:
- AmazonS3ReadOnlyAccess: Allows DSPM to discover and read S3 buckets to assess their security and classify the data inside.
- AmazonRedshiftReadOnlyAccess: Allows DSPM to discover and classify data within Amazon Redshift clusters.
- AmazonRDSReadOnlyAccess: Allows DSPM to discover and inventory Amazon RDS database instances.
- AmazonEC2ReadOnlyAccess: Allows DSPM to discover EC2 instances and attached EBS volumes. This is required for detecting unmanaged data stores on those volumes.
- AmazonDynamoDBReadOnlyAccess: Allows DSPM to discover and classify data within Amazon DynamoDB tables.
  - Note for Advanced Users (Least-Privilege):
    These 5 policies are listed together for simplicity. For a stricter least-privilege configuration, you only need to attach the policies for the AWS services you actively use. For example, if your environment does not use Amazon S3, you may omit the AmazonS3ReadOnlyAccess policy.

Step 5: Complete Connection in Netskope DSPM

Return to the Netskope DSPM browser tab.
On the Review screen, paste the Role ARN you copied.
Click Save.

Follow this workflow to onboard an entire AWS Organization or specific OUs.

Step 1: Start in Netskope DSPM

You must start in the Netskope DSPM console to generate a unique ExternalId for your AWS account.

Go to Administration > Infrastructure Connections.
Click the AWS tab > Add Infrastructure > Add Organization.
Select the Capabilities tab > Enable the toggles for the features you plan to configure.
Click Next. Select Manually Configured.
Fill in the Organization Name.
Click Next to the Review screen.
Copy the External ID.
Keep this browser tab open.

Step 2: Create the IAM Role in AWS

In a new browser tab, log into the AWS IAM Console.
Go to Roles and click Create role.
Select trusted entity > Choose Custom trust policy.

Paste the following JSON.

In the sts:ExternalId field, paste the External ID you copied from Netskope Step 1.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAssumeRoleForNetskope",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::842940822891:root",
          "arn:aws:iam::946157925481:root"
        ]
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "PASTE_YOUR_EXTERNAL_ID_HERE"
        }
      }
    },
    {
      "Sid": "AllowTagSessionForNetskope",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::842940822891:root",
          "arn:aws:iam::946157925481:root"
        ]
      },
      "Action": "sts:TagSession"
    }
  ]
}

Click Next.
Give the role a name (e.g., NetskopeDSPMOrgRole) > Click Create role.
From the list of roles, click your new role and copy its Role ARN.

Step 3 (Optional): Create the Custom IAM Policy

In the AWS IAM Console, go to Policies > Create policy > JSON tab.

Paste the following JSON wrapper.

{
  "Version": "2012-10-17",
  "Statement": [ ]
}

Copy only the JSON blocks for the features you enabled in step 1 (e.g., Ingest Tags, Unmanaged Data Stores, etc.) and paste them into the empty Statement: [] array.

Feature 1: Ingest Tags

Feature 2: Auto-Discover New Data Stores

Feature 3: Scan EBS/EFS and Auto-Discover Unmanaged Data Stores

Feature 4: Authorize Data Store Snapshots Access

{
  "Sid": "TagGetResources",
  "Effect": "Allow",
  "Action": [
    "tag:GetResources"
  ],
  "Resource": "*"
}

{
  "Sid": "EFSReadAndMount",
  "Effect": "Allow",
  "Action": [
    "elasticfilesystem:DescribeBackupPolicy",
    "elasticfilesystem:DescribeMountTargets",
    "elasticfilesystem:DescribeTags",
    "elasticfilesystem:DescribeReplicationConfigurations",
    "elasticfilesystem:ListTagsForResource",
    "elasticfilesystem:DescribeLifecycleConfiguration",
    "elasticfilesystem:ClientMount",
    "elasticfilesystem:DescribeFileSystemPolicy",
    "elasticfilesystem:DescribeAccessPoints",
    "elasticfilesystem:DescribeFileSystems",
    "elasticfilesystem:DescribeMountTargetSecurityGroups"
  ],
  "Resource": "*"
},
{
  "Sid": "FSXRead",
  "Effect": "Allow",
  "Action": [
    "fsx:DescribeFileSystems",
    "fsx:DescribeStorageVirtualMachines"
  ],
  "Resource": "*"
},
{
  "Sid": "AllowRedshiftGetCredentials",
  "Effect": "Allow",
  "Action": [
    "redshift:GetClusterCredentials"
  ],
  "Resource": "*"
},
{
  "Sid": "DSPMRestrictedAthenaAndGlueAccess",
  "Effect": "Allow",
  "Action": [
    "athena:ListDataCatalogs",
    "athena:GetDataCatalog",
    "athena:ListDatabases",
    "athena:GetDatabase",
    "athena:ListTableMetadata",
    "athena:GetTableMetadata",
    "athena:StartQueryExecution",
    "athena:GetQueryExecution",
    "athena:GetQueryResults",
    "athena:GetQueryResultsStream",
    "athena:BatchGetQueryExecution",
    "athena:CancelQueryExecution",
    "athena:ListQueryExecutions",
    "athena:ListWorkGroups",
    "athena:GetWorkGroup",
    "athena:CreatePreparedStatement",
    "athena:GetPreparedStatement",
    "athena:ListPreparedStatements",
    "athena:UpdatePreparedStatement",
    "athena:DeletePreparedStatement",
    "athena:BatchGetPreparedStatement",
    "athena:GetNamedQuery",
    "athena:ListNamedQueries",
    "athena:BatchGetNamedQuery",
    "athena:CreateWorkGroup",
    "athena:UpdateWorkGroup",
    "athena:TagResource",
    "athena:UntagResource",
    "glue:GetDatabase",
    "glue:GetDatabases",
    "glue:GetTable",
    "glue:GetTables",
    "glue:GetPartition",
    "glue:GetPartitions",
    "glue:BatchGetPartition",
    "glue:GetTags",
    "glue:SearchTables",
    "lakeformation:GetDataAccess",
    "lakeformation:ListPermissions",
    "lakeformation:ListResources",
    "s3:GetObject",
    "s3:ListBucket",
    "s3:PutObject",
    "s3:AbortMultipartUpload",
    "s3:ListMultipartUploadParts",
    "s3:GetBucketLocation",
    "s3:ListAllMyBuckets",
    "s3:GetEncryptionConfiguration"
  ],
  "Resource": "*"
}

{
  "Sid": "ScanEnvironmentCreation",
  "Effect": "Allow",
  "Action": [
    "ec2:CreateVpc",
    "ec2:CreateSecurityGroup",
    "ec2:CreateSubnet",
    "ec2:CreateSnapshot",
    "ec2:CreateVolume",
    "ec2:CreateInternetGateway"
  ],
  "Resource": "*",
  "Condition": {
    "StringEqualsIfExists": {
      "aws:RequestTag/Vendor": "Netskope",
      "aws:RequestTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "RestrictedEC2InstanceLaunching",
  "Effect": "Allow",
  "Action": "ec2:RunInstances",
  "Resource": "*",
  "Condition": {
    "StringEqualsIfExists": {
      "aws:RequestTag/Vendor": "Netskope",
      "aws:RequestTag/Product": "DSPM"
    },
    "StringLikeIfExists": {
      "ec2:InstanceType": [
        "t3.*",
        "m5.*"
      ]
    }
  }
},
{
  "Sid": "NetworkConnectivityResourceCreation",
  "Effect": "Allow",
  "Action": [
    "ec2:CreateRoute",
    "ec2:ModifySubnetAttribute"
  ],
  "Resource": "*"
},
{
  "Sid": "EC2NetworkAndSGManagement",
  "Effect": "Allow",
  "Action": [
    "ec2:AttachInternetGateway",
    "ec2:ModifyVpcAttribute",
    "ec2:AuthorizeSecurityGroupIngress",
    "ec2:AuthorizeSecurityGroupEgress"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "ec2:ResourceTag/Vendor": "Netskope",
      "ec2:ResourceTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "MandatoryResourceTagging",
  "Effect": "Allow",
  "Action": "ec2:CreateTags",
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "ec2:CreateAction": [
        "CreateVpc",
        "CreateSecurityGroup",
        "CreateSubnet",
        "CreateSnapshot",
        "CreateVolume",
        "RunInstances",
        "CreateRoute",
        "CreateInternetGateway"
      ]
    }
  }
},
{
  "Sid": "EC2DeleteDSPMResources",
  "Effect": "Allow",
  "Action": [
    "ec2:DeleteSecurityGroup",
    "ec2:DeleteSubnet",
    "ec2:DetachInternetGateway",
    "ec2:DeleteInternetGateway",
    "ec2:DeleteVpc",
    "ec2:DeleteVolume",
    "ec2:DeleteSnapshot",
    "ec2:TerminateInstances"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "ec2:ResourceTag/Vendor": "Netskope",
      "ec2:ResourceTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "EC2DeleteRoute",
  "Effect": "Allow",
  "Action": [
    "ec2:DeleteRoute"
  ],
  "Resource": "*"
}

This feature also requires all 7 permissions from Feature 3 (Unmanaged Data Stores).

In PassRoleForRDSRestoreOperations, if you used a different role name in Step 2, replace NetskopeDSPMRole with your custom role name.

{
  "Sid": "RDSDescribeDatabasesAndSnapshots",
  "Effect": "Allow",
  "Action": [
    "rds:DescribeDBClusters",
    "rds:DescribeDBSnapshots",
    "rds:DescribeDBClusterSnapshots",
    "rds:ListTagsForResource",
    "rds:DescribeEventSubscriptions",
    "rds:DescribeDBSubnetGroups",
    "rds:DescribeEvents",
    "rds:DescribeReservedDBInstances",
    "rds:DescribeDBEngineVersions",
    "rds:DescribeDBInstanceAutomatedBackups",
    "rds:DescribeDBInstances"
  ],
  "Resource": "*"
},
{
  "Sid": "AllowRDSRestoreFromSnapshot",
  "Effect": "Allow",
  "Action": [
    "rds:CreateDBSnapshot",
    "rds:CreateDBClusterSnapshot",
    "rds:RestoreDBInstanceFromDBSnapshot",
    "rds:RestoreDBClusterFromSnapshot",
    "rds:CreateDBSubnetGroup"
  ],
  "Resource": "*",
  "Condition": {
    "StringEqualsIfExists": {
      "aws:RequestTag/Vendor": "Netskope",
      "aws:RequestTag/Product": "DSPM"
    }
  }
},
{
  "Sid": "AllowAddingTagsToRDSResources",
  "Effect": "Allow",
  "Action": [
    "rds:AddTagsToResource"
  ],
  "Resource": "*"
},
{
  "Sid": "RDSModifyTemporaryResources",
  "Effect": "Allow",
  "Action": [
    "rds:ModifyDBInstance"
  ],
  "Resource": [
    "arn:aws:rds:*:*:db:dasera-scan-temp-*",
    "arn:aws:rds:*:*:db:netskope-dspm-scan-temp-*"
  ]
},
{
  "Sid": "RDSDeleteTaggedTemporaryResources",
  "Effect": "Allow",
  "Action": [
    "rds:DeleteDBInstance"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "rds:db-tag/Vendor": "Netskope",
      "rds:db-tag/Product": "DSPM"
    }
  }
},
{
  "Sid": "KMSAccessForEncryptedSnapshots",
  "Effect": "Allow",
  "Action": [
    "kms:Decrypt",
    "kms:DescribeKey",
    "kms:CreateGrant"
  ],
  "Resource": "arn:aws:kms:*:*:key/*",
  "Condition": {
    "StringEquals": {
      "kms:ViaService": "rds.amazonaws.com"
    }
  }
},
{
  "Sid": "PassRoleForRDSRestoreOperations",
  "Effect": "Allow",
  "Action": "iam:PassRole",
  "Resource": "arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>",
  "Condition": {
    "StringEquals": {
      "iam:PassedToService": "rds.amazonaws.com"
    }
  }
}

Click Next.
Give the policy a name (e.g., NetskopeDSPMCustomPolicy) > Click Create policy.

Step 4: Attach Policies to the Role

Return to your NetskopeDSPMOrgRole in the AWS Console.
On the Permissions tab, click Add permissions > Attach policies.
Find and attach the following AWS-managed policies:
- IAMReadOnlyAccess: Allows DSPM to map which IAM users and roles have access to your sensitive data stores, providing a complete picture of your data access posture.
- AWSOrganizationsReadOnlyAccess: Required for discovering accounts within your AWS Organization.
(If you created an “Optional Custom Policy” in the previous step) Find and attach NetskopeDSPMCustomPolicy.
(If you enabled “Auto-Discover New Data Stores”) Attach these five AWS-managed policies:
- AmazonS3ReadOnlyAccess: Allows DSPM to discover and read S3 buckets to assess their security and classify the data inside.
- AmazonRedshiftReadOnlyAccess: Allows DSPM to discover and classify data within Amazon Redshift clusters.
- AmazonRDSReadOnlyAccess: Allows DSPM to discover and inventory Amazon RDS database instances.
- AmazonEC2ReadOnlyAccess: Allows DSPM to discover EC2 instances and attached EBS volumes. This is required for detecting unmanaged data stores on those volumes.
- AmazonDynamoDBReadOnlyAccess: Allows DSPM to discover and classify data within Amazon DynamoDB tables.
  - Note for Advanced Users (Least-Privilege):
    These 5 policies are listed together for simplicity. For a stricter least-privilege configuration, you only need to attach the policies for the AWS services you actively use.

Step 5: Complete Connection in Netskope DSPM

Return to the Netskope DSPM browser tab.
On the Review screen, paste the Role ARN you copied.
Click Save.

Troubleshooting

Error: “Cannot ingest AWS tags due to missing permissions.”
- Cause: The IAM policy is missing the tag:GetResources permission.
- Fix: Edit your NetskopeDSPMCustomPolicy in AWS and add the JSON statement for the Ingest Tags feature.
Error: “Netskope encountered an error while scanning… Missing required AWS permissions: ec2:DeleteSnapshot”
- Cause: The role is missing permissions for Unmanaged Data Stores.
- Fix: Edit your custom IAM policy and add all 7 JSON statements for the Scan EBS/EFS and Auto-Discover Unmanaged Data Stores feature.
Error: “KMS decryption failed for RDS snapshot”
- Cause: The role is missing the KMS permissions required for Data Store Snapshots.
- Fix: Edit your custom IAM policy and add all 8 JSON statements for the Authorize Data Store Snapshots Access feature.