Netskope Help

Log into Google Cloud console and click Activate Cloud Shell.

At the shell prompt, type nano netskope_role.yaml.

Copy the following content into the file.

title: "Netskope_Role"
description: "Role for supporting Netskope for performing Storage Scan"
stage: "ALPHA"
includedPermissions:
# get IAM roles to check the Netskope_Role is present
- iam.roles.get
# allow service account to make calls on behalf of the organization
- iam.serviceAccounts.actAs
# get log sinks created for the organization
- logging.sinks.get
# create pubsub subscription required for sending notification to Netskope
- pubsub.subscriptions.create
# delete pubsub subscription on delete of the instance
- pubsub.subscriptions.delete
# get subscriptions for a log sink to check in case of instance creation/regrant
- pubsub.subscriptions.get
# required for pubsub subscription creation
- pubsub.topics.attachSubscription
# this permission is required while listing and getting metadata for folders under organization
- resourcemanager.folders.get
# this permission is required for getting the organization metadata
- resourcemanager.organizations.get
# get bucket metadata
- storage.buckets.get
# list storage buckets under the organization
- storage.buckets.list
# get object metadata
- storage.objects.get
# list objects under the storage buckets
- storage.objects.list
# get project metadata and list projects under organization
- resourcemanager.projects.get
# get ACLs if any created for an object which will be used to check for visibility of the object(public/private)
- storage.objects.getIamPolicy
# get ACLs and Iam policy attached to the bucket used for checking visibility of buckets
- storage.buckets.getIamPolicy

Run the following command to create the role and attach it to the organization.

gcloud iam roles create Netskope_Role --organization=<organization-id> --file=netskope_role.yaml

Verify that the role is created. Run the following command.

gcloud iam roles describe --organization=<organization-id> Netskope_Role

Select any project within the organization's folder and create a service account for the project. To do this, in the left navigation panel, click Service Accounts > Create Service Account.

Provide a name for the service account and click Create and Continue. Click Continue without granting access or permissions to the project. Then click Done without granting user access to the service account.

On the Service accounts page, click the service account you created and select on the Keys tab.

Click Add Key and from the drop-down list click Create new key.

In the Create private key for <service account> dialog box, select the key type as JSON and click Create. The private key is downloaded to your computer.

Click Close.

Select the Details tab of the service account and copy the email address. This service account must be added as an IAM member in the organization you are setting up for storage scan.

Select the organization you are setting up for storage scan. In the left navigation panel, click IAM and click Add.

In the IAM page, click Add. Paste the service account email address in the New member text box of Add members to <organization> window.

Click Select a role and select Netskope_Role. Click Save.

Select the project for which you created the service account. Click the hamburger icon in the left navigation panel and click Pub/Sub under Big Data.

On the Topics page, click Create Topic. Provide a Topic ID and click Create Topic.

Provide permissions to the Pub/Sub so that the service account can create JWT tokens. Open Cloud Shell and in the terminal run the following command to provide permissions.

gcloud projects add-iam-policy-binding <project_id> --member=serviceAccount:service-<project_number>@gcp-sa-pubsub.iam.gserviceaccount.com --role='roles/iam.serviceAccountTokenCreator'

To get the <project_id>, click on the project at the top of the page. The Select from window displays the project name and ID.

To get the <project_number>, in the Select from window click on the project name. The project dashboard displays the Project info which contains the project number.

Create an aggregated log sink to send and receive notifications from Netskope. In the Cloud Shell terminal run the following command.

gcloud logging sinks create ns_sink pubsub.googleapis.com/<pubsub_topic_ID> --log-filter=<log_filter>  --include-children --organization=<org_ID>

To get the <pubsub_topic_ID>,

To get the <org_ID>, click on the project at the top of the page. In the Select from window click on the All tab and click on the organization that the project is under. The organization name has an accompanying ID.

Add the following log filters in the command above.

(resource.type=folder AND 
(protoPayload.methodName=CreateFolder OR 
protoPayload.methodName=DeleteFolder)) OR 
(resource.type=project AND 
(protoPayload.methodName=CreateProject OR 
protoPayload.methodName=DeleteProject)) OR 
(resource.type=gcs_bucket AND 
(protoPayload.methodName=storage.objects.delete OR 
protoPayload.methodName=storage.objects.create OR 
protoPayload.methodName=storage.buckets.create OR 
protoPayload.methodName=storage.buckets.delete))

After running the command successfully, you must add the service account in the organization's IAM role. To do this,

With the organization selected from the top of the page, in the left navigation panel, click Audit logs under IAM & Admin.

On the Audit Logs page, search for Google Cloud Storage and select the service.

In the Google Cloud Storage pane on the right side, select Data Write in the Log Type tab. Click Save.