Welcome to the Netskope One DSPM Knowledge Base

You will find your answers here!

    Sorry, we didn't find any relevant articles for you.

    Send us your queries using the form below and we will get back to you with a solution.

    Onboarding AWS Infrastructure via CloudFormation

    Table of Contents

    Overview Instructions for Infrastructure Connection Next Steps

    This article applies to customers using Netskope One DSPM-hosted tenants. For self-hosted customers, please visit our Onboarding AWS Accounts within self-hosted Netskope One DSPM instances article.

     

    Overview

    These instructions are used for onboarding AWS Accounts and Organizations as infrastructure connections within Netskope One DSPM via CloudFormation. Such connections permit Netskope One DSPM to discover your available data stores and facilitate scanning and classification activities. You will repeat these steps for each AWS Account or Organization you wish to onboard to Netskope One DSPM.

    For these instructions, you will start activity within Netskope One DSPM, next be directed to perform actions within the AWS console, then finally return to Netskope One DSPM to complete the connection.

    Instructions for Infrastructure Connection

    Individual AWS Account

    You will repeat these steps for each individual AWS account you wish to onboard within the Netskope One DSPM application.

     

    Steps to Complete Netskope One DSPM Infrastructure Connection

    1. Log into Netskope One DSPM.
    2. Navigate to Administration → Infrastructure Connections → AWS tab.
    3. Click the Add Infrastructure button in the upper right. 
    4. Ensure AWS is selected and click ADD ACCOUNT.
    5. Leave on or toggle off Auto-Discover New Data Stores, depending on your preference.
    6. Click NEXT.
    7. Enter the following values:
    Field Value
    Account Name Any value (this is used to identify your infrastructure connection within Netskope One DSPM).
    Account ID

    Obtain from your AWS console:
    Netskope One DSPM Service Account Role Will default to Dasera_Role. Note that this value needs to be unique to each onboarded account.
    1.  Select CloudFormation.
    2.  Click LAUNCH TEMPLATE to be redirected to the CloudFormation create stack screen within your AWS console. Leave Netskope One DSPM open with the Add Infrastructure modal.
    1. All fields will prepopulate with values from Netskope One DSPM. 
    2. Check the box for acknowledgment at the bottom and then click Create stack.
    3. Wait several seconds for your stack to create and appear in your Events.
    1.  Return to Netskope One DSPM in your browser and click SAVE to finish connecting your AWS Infrastructure.
    1.  Your AWS Account infrastructure connection is now complete, and you are able to discover data stores for analysis.
     
     

    AWS Organization

    Please perform these steps once for each AWS organization you'd like to onboard within the Netskope One DSPM application. Any changes to your organization's membership units will be automatically accommodated.

     

    Steps to Complete Netskope One DSPM Infrastructure Connection

    1. Log into Netskope One DSPM.
    2. Navigate to Administration → Infrastructure Connections → AWS tab.
    3. Click the Add Infrastructure button in the upper right. 
    4. Ensure AWS is selected and click ADD ORGANIZATION.
    5. Leave on or toggle off Auto-Discover New Accounts and Auto-Discover New Data Stores, depending on your preference.
    6. Click NEXT.
    7. Select CloudFormation
    8. Enter the following values:
    Field Value
    Organization Name Any value (this is used to identify your infrastructure connection within Netskope One DSPM).
    Account ID

    Obtain from your AWS Organizations console. Use the management account Account ID, as highlighted below.
    Netskope One DSPM Service Account Role Will default to Dasera_Role. Note that this value needs to be unique to each onboarded organization.
    1. Click DOWNLOAD TEMPLATE. This will create and download and the templated .json file to your local machine. 

    At this point, you will pause your activity in Netskope One DSPM to perform actions within the AWS console. Leave the Add Infrastructure modal open.

    1. From the StackSet dashboard in your AWS CloudFormation Console, click the Create Stackset button.
    2. Under Permissions, select Service-managed permissions.
    3. Under Prerequisite - Prepare template select Template is ready.
    4. Under Specify template, select Upload a template file.
    5. Use the choose file button to upload the .json file described in Step 8 above.
    1. Once uploaded, click Next.
    2. Give your StackSet a name and description. 
    3.  Under Parameters, DaseraRoleName and ExternalID will pre-populate based on your uploaded template. Click Next button.
    4. Keep Inactive selected under Execution configuration. Click Next button.
    5.  Set deployment options should remain as default for first three sections.
    6. Under the Specify regions section, select any value. While AWS requires at least one region to be selected here, this Netskope One DSPM-provided StackSet will only configure IAM Roles (which belong to all regions in your organization).
    7. Deployment options can remain as default. Click Next button.
    8. Check the box for acknowledgment at the bottom and then click Submit.
    9. You will see the StackSet being created on the Operations tab, and once complete, on the Stack Instances tab. This has created Netskope One DSPM roles for all accounts within the management account. 
    1. You must then create a Stack for the management account using the same .json template used in the previous steps. 
      1. Go to Cloudformation → Stacks. Click Create Stack and select With existing resources from the dropdown.
      2. Click Next then select Upload a template file for template source. Click Choose file and upload the same .json file described in step 8 above.
      3. Wait several seconds for your stack to create and appear in your Events.
    2. When your StackSet and Stack are created and running, return to Netskope One DSPM in your browser and click SAVE to finish connecting your AWS Infrastructure.
    1. Your AWS Organization infrastructure connection is now complete, and you are able to discover accounts within the organization and data stores for analysis.
     
     

    Note: For each AWS Account infrastructure connection, if it is a member of the Organization being onboarded, we consolidate that individual Infrastructure Connection to fall underneath the Organization within the UI. 

     

    Next Steps

    • If you have additional AWS Organizations or individual accounts to onboard in Netskope One DSPM, repeat the above steps.
    • Connect your discovered Data Stores. For more information, visit our Connecting AWS Data Stores category and select the article(s) applicable to the Data Store Type(s) you wish to connect.

    Was this article helpful?

    Still can't find what you are looking for?

    Contact Netskope Technical Support