Publish DSPM Alerts to AWS SNS

Overview

Netskope DSPM supports sending notifications via Amazon Simple Notification Service (AWS SNS), either within the same AWS account or across different accounts. To enable this, you must grant the Netskope DSPM service account specific permissions to publish messages to your SNS topic.

Use the steps below to configure the SNS Topic and the required IAM permissions.

Message Packaging Behavior

When configuring external workflows to publish DSPM alerts to AWS SNS, the system packages messages differently based on the data store type:

• Structured Data Stores: The workflow emits a single SNS message per data store when policy conditions are met.
• Unstructured Data Stores: The workflow emits multiple SNS messages per data store when policy conditions are met, each containing information on multiple files that violated the policy.

This behavior applies regardless of whether the SNS topic resides in the same AWS account or a different one.

Step 1: Configure AWS SNS Topic

If you already have an SNS Topic for notifications, copy its ARN and proceed to the next section. Otherwise, create a new one:

1. Log in to the AWS SNS Console.
2. Go to Dashboard > Topics in the left menu.
3. Click Create topic.
4. Select Standard as the type (unless FIFO is specifically required).
5. Enter a Name and Display name.
6. Click Create topic.
7. Copy the ARN (Amazon Resource Name) displayed in the topic details. You will need this for the IAM Policy.

Step 2: Create the AWS IAM Policy

You must define a permission policy that allows the sns:Publish action on your specific topic.

1. Log in to the AWS IAM Console.

2. Go to Access management > Policies in the left menu.

3. Click Create policy > Click the JSON tab.

4. Paste the following policy, replacing the Resource value with the SNS Topic ARN you copied in Step 1:

   {
       "Version": "2012-10-17",
       "Statement": [
          
           {
               "Effect": "Allow",
               "Action": "sns:Publish",
               "Resource": "arn:aws:sns:<region>:<account>:<Netskope One DSPM Radar_topic>"
           },   
      ]
   }

5. Click Next.

6. Enter a descriptive Policy name (e.g., NetskopeDSPM-SNSPublish).

7. Click Create policy.

Step 3: Assign Permission to the Service Account

Finally, attach the newly created policy to the IAM User dedicated to Netskope DSPM.

1. Go to Access management > Users in the AWS IAM Console.
2. Search for and click the name of the Netskope DSPM-dedicated service account (the user created during the initial onboarding).
3. Go to the Permissions tab > Click Add permissions > Select Add permissions.
4. Select Attach policies directly.
5. Search for the policy you created in Step 2 (e.g., NetskopeDSPM-SNSPublish).
6. Select the checkbox next to the policy name.
7. Click Next > Review the changes > Click Add permissions.