Skip to main content

What are Satellites?

Formal Satellites are optional specialized containers you deploy alongside Connectors to enable advanced capabilities like PII detection, schema discovery, and custom policy data loading. Satellites extend Formal’s core functionality without adding complexity to the Connector itself. They’re deployed in your infrastructure and communicate with Connectors and the Control Plane.

Satellite Types

AI

Detects PII and PHI and sensitive data in real-time for automatic redaction and classification. Enables real-time threat detection and mitigation for SSH and Kubernetes sessions

Data Discovery

Catalogs database schemas, tables, and columns across your data infrastructure

Policy Data Loader

Loads external data into policies using custom code in Python or Node.js

AI Satellite

Identifies Personally Identifiable Information (PII) and Protected Health Information (PHI) in database responses, enabling automatic data masking and classification policies. Also enables real-time threat detection and mitigation for SSH and Kubernetes sessions.

Features

  • Real-time PII/PHI detection on query responses
  • Threat detection and mitigation for SSH and Kubernetes sessions
  • Automatic labeling of columns and fields with PII/PHI types
  • Integration with policies for conditional masking
  • GPU acceleration for high-throughput processing (optional, recommended for production)

Configuration

Required Environment Variables:
  • FORMAL_CONTROL_PLANE_API_KEY: Satellite authentication token
GPU Support: The AI Satellite can leverage NVIDIA GPUs for improved performance. Use --gpus all to enable GPU acceleration:
The satellite automatically detects and configures available GPUs for optimal performance.

Data Discovery Satellite

Automatically discovers and catalogs your database schemas, tables, columns, and relationships.

Features

  • Scheduled schema discovery across all resources
  • Regex-based column classification from inventory path (no AI backend)
  • Prompt-based column classification via a linked AI Satellite or AWS Bedrock
  • Schema change tracking with deletion policies

Prompt Classification Backends

Prompt labels need an LLM backend. You do not need an AI Satellite if you use AWS Bedrock. Regex labels never need either option. When prompt labels are configured, discovery samples row values from each table and sends column metadata to the classifier. The classifier returns labels based on your prompt definitions.
The Data Discovery Satellite can call AWS Bedrock directly. No AI Satellite deployment or satellite link is required.Prerequisites:
  • AWS credentials available to the Data Discovery Satellite container (for example, an ECS task role or EKS service account)
  • Amazon Bedrock access to the Claude Haiku inference profile in your AWS account and region
Environment variables:
  • FORMAL_CONTROL_PLANE_API_KEY: Satellite authentication token
  • DATA_DISCOVERY_LABELING_USE_BEDROCK: Set to true to use AWS Bedrock for prompt label classification instead of a linked AI Satellite
When DATA_DISCOVERY_LABELING_USE_BEDROCK=true, discovery bypasses satellite link lookup and calls Bedrock with the default AWS credential chain. The value must be the string true; any other value falls back to the linked AI Satellite.
On ECS or EKS, attach an IAM role with bedrock:InvokeModel (or equivalent) for the inference profile in your account.
Regex labels classify columns from inventory path alone and need no AI backend. Prompt labels need either AWS Bedrock or a linked AI Satellite. You do not need both.

Configuration

Environment variables:
  • FORMAL_CONTROL_PLANE_API_KEY: Satellite authentication token
  • DATA_DISCOVERY_LABELING_USE_BEDROCK: Set to true to classify prompt labels with AWS Bedrock instead of a linked AI Satellite (optional)

Schema Discovery Jobs

Configure discovery schedules per resource:
  • Frequency: None, every 6/12/18/24 hours, or custom cron
  • Deletion policy: Mark for deletion or auto-delete removed schemas
  • Native user: Which credentials to use for discovery

Policy Data Loader Satellite

Enables custom code to load data from external sources into your policies, extending policy evaluation with dynamic business logic.

Features

  • Custom code execution in Python 3.11 or Node.js 18
  • Scheduled runs with cron expressions
  • External API and database calls to fetch data
  • JSON output accessible in policies via data object

Supported Runtimes

Example: Load Zendesk Tickets for Contextual Data

This example fetches open Zendesk tickets and enriches them with user information for use in policies:

Using in Policies

The Policy Data Loader outputs JSON data that becomes available in policies via the data object. Here’s how to use the Zendesk tickets data in a policy:
This policy:
  • Filters database rows by checking if there are open Zendesk tickets for the email address
  • Allows access with contextual ticket data when tickets exist
  • Blocks access when no tickets are found for the email

Schedule Format

Policy Data Loaders use second-based cron expressions: Format: second minute hour day month year

Configuration

Environment variables:
  • FORMAL_CONTROL_PLANE_API_KEY: Satellite authentication token
  • Custom variables: Available to your code
The Satellite passes all its environment variables to worker processes, so you can use environment variables in your code (e.g., API keys, endpoints).

Deployment

Satellites are Docker containers deployed in your infrastructure, similar to Connectors.

Container Image Registries

You can pull satellite images from either AWS ECR or GCP Artifact Registry:

Prerequisites

  1. Create the Satellite in the Formal console
  2. Copy the API token
  3. Deploy the container with appropriate environment variables
See the AWS Satellite deployment example for Terraform configuration.
By default, the satellite communicates with the Connectors using a TLS certificate issued by the Control Plane.

Spaces and Satellites

Like Connectors and Resources, Satellites can be assigned to Spaces:
  • Satellite with a Space: Only communicates with Connectors and Resources in the same Space
  • Satellite without a Space: Can communicate with any Connector or Resource
Changing a Satellite’s Space requires restarting the Satellite container.

Managing Satellites

Creating a Satellite

1

Navigate to Satellites

Go to Satellites in the console
2

Create Satellite

Click Create Satellite
3

Configure settings

  • Name: Friendly identifier
  • Satellite Type: AI, Data Discovery, or Policy Data Loader
  • Space: (Optional) Logical grouping
4

Copy API token

Save the token for deployment
5

Deploy container

Use the token in your deployment (ECS, Kubernetes, Docker)

Policy Data Loader Status

  • Draft: Not running; code is being edited
  • Active: Running and loading data on schedule
Activate after testing your code to make data available to policies.

Next Steps

Deploy a Satellite

Run Satellites in your infrastructure

Use in Policies

Reference Satellite data in policy rules

Configure Spaces

Segment Satellite access

View Logs

Monitor Satellite activity in logs