Onboard AWS Infrastructure via Terraform - Netskope Technical Documentation

Overview

Follow these steps to onboard both AWS Accounts and AWS Organizations to Netskope DSPM as infrastructure connections via Terraform. These connections allow DSPM to discover data stores and run scans and classification.

This process has been updated to use more granular, feature-based IAM permissions. The downloaded Terraform templates now include inline comments and will only deploy the permissions necessary for the features you select.

Prerequisites:

Before you begin, make sure you have the required tools installed and set up on your machine:

Template Permission Summary

The Terraform template you will download is dynamically generated based on the capabilities you select in the Netskope UI. This section explains what permissions the template will automatically create in your AWS environment, giving you full transparency.

Permission Type	Policies & Permissions	Purpose
Base Permissions (Always Included)	• `IAMReadOnlyAccess` (Managed Policy) • `AWSOrganizationsReadOnlyAccess` (Managed Policy, Org only) • Trust Policy for Netskope & EC2	Provides basic read-only access and allows Netskope to assume the role.
Optional Permissions (Based on Capabilities)	• If "Ingest Tags" is enabled: - `tag:GetResources` (Custom Permission) • If "Auto-Discover New Data Stores" is enabled: - 5 Managed Policies (S3, Redshift, RDS, EC2, DynamoDB ReadOnly) - 3 Custom Policies (EFS, Redshift Credentials, Athena/Glue) • If "Scan EBS/EFS and Auto-Discover Unmanaged Data Stores" is enabled: - 7 custom EC2 policies for creating and deleting temporary scan environments. • If "Authorize Data Store Snapshots Access" is enabled: - All permissions from "Unmanaged Data Stores" - 8 Custom RDS & KMS Policies for scanning snapshots. • If Enable AWS Inventory is enabled: - `s3:PutInventoryConfiguration` (Custom Permission). Required when Enable AWS Inventory is toggled on. Allows DSPM to configure S3 Inventory on customer buckets to store metadata in a dedicated inventory bucket. The inventory bucket is server-side encrypted using AWS S3 Managed Keys (SSE-S3).	Adds specific permissions for each feature you select in the UI.

Instructions for Infrastructure Connection

Follow the steps below to onboard your AWS infrastructure into the Netskope DSPM application. Depending on your setup, choose either the Individual AWS Account or AWS Organization section to proceed.

Individual AWS Account

AWS Organization

Repeat this process for every AWS Account you want to onboard into Netskope DSPM.

This workflow starts in Netskope DSPM, continues with actions in your Terminal and ends back in DSPM to complete the setup.

In the Netskope DSPM Console:

Go to Administration > Infrastructure Connections.
Click Add Infrastructure > Select AWS > Add Account.

Select Capabilities tab > Adjust the toggles based on your discovery and classification needs:

Toggle Description	Details
Auto-Discover New Accounts	Lets DSPM automatically detect new accounts as they are created.
Auto-Discover New Data Stores	Lets DSPM automatically detect new data stores as they are created.
Scan EBS/EFS and Auto-Discover Unmanaged Data Stores	Finds data stores on disk volumes. This is off by default due to potential performance impact on large environments.
Ingest Tags	Pulls AWS tags from each connected data store for filtering and policy use.
Authorize Data Store Snapshots Access	Adds required IAM permissions to the CloudFormation or Terraform templates for snapshot-based onboarding. These templates are created in the next step.
Enable AWS Inventory	Toggle this option to allow DSPM to use the native AWS S3 Inventory feature for S3 data stores. When enabled, DSPM stores bucket metadata in a dedicated inventory bucket instead of making individual API calls to fetch file metadata. This significantly reduces API costs for large buckets. Note: This toggle is disabled by default because it requires additional AWS permissions. When enabled at the infrastructure level, the Use S3 Inventory option becomes available when connecting individual S3 data stores. For more details, see Connect AWS S3 to DSPM.

Select Terraform > Fill in the following values > Click Next.

Field	Value
Organization Name	Any name to help you identify the connection in Netskope DSPM.
Organization ID	Get this from your AWS Organizations console. You can onboard at the root or OU level to include all linked accounts.
Account ID	Get this from your AWS Organizations console.
Netskope Service Account Role	Defaults to `Netskope_Role`. This name must be unique per onboarded organization.

Click Download Template
- This downloads a .zip file.
Don’t close this window and leave it on the Add Infrastructure modal to return to it later.

In your Terminal:
1. Navigate to the directory where you downloaded the file (e.g., cd ~/Downloads).
2. Unzip the file (e.g., unzip file_name.zip).
3. Navigate into the new folder containing the .tf files.
4. Run terraform init to initialize the directory.
5. Run terraform apply to create the resources.
6. Review the plan and type yes to approve the execution.
7. Wait for the Apply complete! message.
In the Netskope Console:
1. Return to the Netskope DSPM browser tab you left open.
2. Click Save.
  
  If your Netskope DSPM session expires while you are working in the terminal, you can easily recover. Once your terraform apply is complete:
  
  1. Log back into Netskope DSPM > Start a new Add Infrastructure workflow > Select Manually Configured > Enter de Account Name > Click Next.
  2. In your AWS Console, find and copy the Role ARN of the role your CloudFormation stack you just created.
  3. Paste this Role ARN into the Summary Info from Netskope DSPM > Click Save.

Repeat this process for every AWS organization you want to onboard into Netskope DSPM. Any changes to the organization’s membership units will be handled automatically.

This workflow starts in Netskope DSPM, continues with actions in your Terminal and ends back in DSPM to complete the setup.

In the Netskope DSPM Console:

Go to Administration > Infrastructure Connections.
Click Add Infrastructure > Select AWS > Add Organization.

Select Capabilities tab > Adjust the toggles based on your discovery and classification needs:

Toggle Description	Details
Auto-Discover New Accounts	Lets DSPM automatically detect new accounts as they are created.
Auto-Discover New Data Stores	Lets DSPM automatically detect new data stores as they are created.
Scan EBS/EFS and Auto-Discover Unmanaged Data Stores	Finds data stores on disk volumes. This is off by default due to potential performance impact on large environments.
Ingest Tags	Pulls AWS tags from each connected data store for filtering and policy use.
Authorize Data Store Snapshots Access	Adds required IAM permissions to the CloudFormation or Terraform templates for snapshot-based onboarding. These templates are created in the next step.
Enable AWS Inventory	Toggle this option to allow DSPM to use the native AWS S3 Inventory feature for S3 data stores. When enabled, DSPM stores bucket metadata in a dedicated inventory bucket instead of making individual API calls to fetch file metadata. This significantly reduces API costs for large buckets. Note: This toggle is disabled by default because it requires additional AWS permissions. When enabled at the infrastructure level, the Use S3 Inventory option becomes available when connecting individual S3 data stores. For more details, see Connect AWS S3 to DSPM.

Select Terraform > Fill in the following values > Click Next.

Field	Value
Account Name	Any name to help you identify the connection in Netskope DSPM.
Account ID	Get this from your AWS Organizations console.
Netskope Service Account Role	Defaults to `Netskope_Role`. This name must be unique per onboarded organization.

Click Download Template
- This downloads a .zip file.
Don’t close this window and leave it on the Add Infrastructure modal to return to it later.

In your Terminal:
1. Navigate to the directory where you downloaded the file (e.g., cd ~/Downloads).
2. Unzip the file (e.g., unzip file_name.zip).
3. Navigate into the new folder containing the .tf files.
4. Run terraform init to initialize the directory.
5. Run terraform apply to create the resources.
6. Review the plan and type yes to approve the execution.
7. Wait for the Apply complete! message.
In the Netskope Console:
1. Return to the Netskope DSPM browser tab you left open.
2. Click Save.
  
  If your Netskope DSPM session expires while you are working in the terminal, you can easily recover. Once your terraform apply is complete:
  
  1. Log back into Netskope DSPM > Start a new Add Infrastructure workflow > Select Manually Configured > Enter de Organization Name > Click Next.
  2. In your AWS Console, find the role your Terraform script just created (e.g., Netskope_Role) and copy its Role ARN.
  3. Paste this Role ARN into the Summary Info from Netskope DSPM > Click Save.

Troubleshooting

Error	Cause	Fix
“Cannot ingest AWS tags due to missing permissions.”	The "Ingest Tags" capability was not selected during the initial onboarding.	Re-download the template from DSPM with "Ingest Tags" enabled and re-run `terraform apply`.
“Netskope encountered an error while scanning... Missing required AWS permissions: ec2:DeleteSnapshot”	The "Scan EBS/EFS and Auto-Discover Unmanaged Data Stores" capability was not selected.	Re-download the template with this feature enabled and re-run `terraform apply`.
“KMS decryption failed for RDS snapshot”	The "Authorize Data Store Snapshots Access" capability was not selected.	Re-download the template with this feature enabled and re-run `terraform apply`.

Next Steps

Now that your AWS infrastructure is connected, if you enabled Auto-Discover New Data Stores, you can proceed to the Data Stores Inventory to view your discovered resources.