---
sourceDocument: Australia ServiceNow AI Platform Capabilities
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/servicenow-platform

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia ServiceNow AI Platform Capabilities

ft:clusterId :

    - platcap

bundleId :

    - platcap

workflow :

    - Platform


---

# Prerequisites for executing scripts

# Prerequisites for executing scripts {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 30. Juni 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 Minuten Lesedauer

Complete the prerequisites before you execute the AWS scripts.  
Wichtig:  
Ensure that you have downloaded the scripts available within the Service Graph Connector for AWS. See [Download the AWS scripts](https://servicenow-prod.fluidtopics.net/xRBp7W9~TadTCw8DbXnQ7g "Download the AWS scripts included within the guided setup of the Service Graph Connector for AWS.").  
Decide the following details to be used later during the execution of the AWS scripts:

* [ServiceNow IAM role](https://servicenow-prod.fluidtopics.net/us40J_zw_pVe0IIm6yb6rA#sgc-cmdb-aws-scripts-prereq__section_mxv_3l3_pzb)
* [ServiceNow IAM username](https://servicenow-prod.fluidtopics.net/us40J_zw_pVe0IIm6yb6rA#sgc-cmdb-aws-scripts-prereq__section_sf3_rl3_pzb)
* [S3 bucket for the ServiceNow IAM role](https://servicenow-prod.fluidtopics.net/us40J_zw_pVe0IIm6yb6rA#sgc-cmdb-aws-s3-setup "Set up an S3 bucket with read and delete privileges for the ServiceNow IAM role to store and delete the SendCommand API responses when importing AWS data.")  
  Hinweis:  
  Define an S3 bucket only when you are using [deep discovery scripts](https://servicenow-prod.fluidtopics.net/aJmQP3_kDYW02z90NoVhpg#sgc-cmdb-aws-script-op__section_ahc_jwf_4zb).
{#sgc-cmdb-aws-scripts-prereq__ul_ylp_x1s_jzb}

## Determine the ServiceNow IAM role {#sgc-cmdb-aws-scripts-prereq__section_mxv_3l3_pzb}

Determine the identity and access management (IAM) role that performs read-only operations in member accounts to fetch the configuration items (CIs) from the AWS environment.

By default, the CreateSnowOrganizationAccountAccessRoleInMemberAccount.yml script creates the SnowOrganizationAccountAccessRole IAM role. You can use the default name created by the script or create a new
IAM role. However, when required as an input parameter, you must enter the same IAM role across scripts. See [Executing scripts required for setting up AWS](https://servicenow-prod.fluidtopics.net/aJmQP3_kDYW02z90NoVhpg "You must execute scripts provided with the Service Graph Connector for AWS to set up the AWS environment for importing data.").

## Determine the ServiceNow IAM username {#sgc-cmdb-aws-scripts-prereq__section_sf3_rl3_pzb}

Determine the name of the IAM user that assumes the ServiceNow IAM role in the member accounts.

By default, the CreateServiceNowUser.yml script creates the NOWSGCUser IAM user. You can use the default name created by the script or create a new IAM user. However, when required as an input parameter,
you must enter the same IAM username across scripts. See [Executing scripts required for setting up AWS](https://servicenow-prod.fluidtopics.net/aJmQP3_kDYW02z90NoVhpg "You must execute scripts provided with the Service Graph Connector for AWS to set up the AWS environment for importing data.").

## Define the S3 bucket for deep discovery {#ariaid-title2}

Set up an S3 bucket with read and delete privileges for the ServiceNow IAM role to store and delete the SendCommand API responses when importing AWS data.

### Vorbereitungen

Role required: Application administrator

### Warum und wann dieser Vorgang ausgeführt wird

Create an S3 bucket for the Service Graph Connector for AWS application and enable the ServiceNow IAM role to have access to this bucket in the organization.  
Hinweis:  
Use an S3 bucket only when you want to perform deep discovery on EC2 instances.

### Prozedur

1. Create an S3 bucket in an AWS account region.  
   See [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/create-bucket-overview.html) on the AWS documentation site.  
   Hinweis:  
   The S3 bucket must have the following permission settings. {#sgc-cmdb-aws-s3-setup__table_cmg_bx2_lzb__entry__2}

   | Permission | Setting |
   |-|-|
   | Access | Bucket and objects not public |
   | S3 Block Public Access | Block public access to S3 buckets and objects |
   [Tabelle : 1. S3 bucket permissions and their settings]

   {#sgc-cmdb-aws-s3-setup__table_cmg_bx2_lzb}

   For more information, see [S3 Block Public Access](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html)
   on the AWS documentation site.
   {#sgc-cmdb-aws-s3-setup__creates3bucket}
{#sgc-cmdb-aws-s3-setup__creates3bucket}
2. Add a bucket policy.  
   See [Bucket policies](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-policies.html)
   on the AWS documentation site.  
   To access the S3 bucket you created in [step 1](https://servicenow-prod.fluidtopics.net/us40J_zw_pVe0IIm6yb6rA#sgc-cmdb-aws-s3-setup__creates3bucket), its bucket policy must allow the IAM instance profile role attached to the managed EC2 instances. You can either create a bucket policy or grant access to your AWS member account in the bucket access control list (ACL). The member account must include the EC2 instances.  
   Hinweis:  
   Adding an AWS member account to the bucket ACL allows all users and roles in the member account to access the S3 bucket.  
   Refer to the following sample code when adding a bucket policy.

       {
           "Version": "2012-10-17",
           "Id": "S3PolicyforServiceNowIAMrole",
           "Statement": [
               {
                   "Sid": "EC2S3Access",
                   "Effect": "Allow",
                   "Principal": {
                       "AWS": "arn:aws:iam::<var class="keyword varname">AWS-ACCOUNT</var>:role/<var class="keyword varname">INSTANCE-PROFILE-ROLE-NAME</var>"
                   },
                   "Action": [
                       "s3:GetObject",
                       "s3:PutObject",
                       "s3:PutObjectAcl"
                   ],
                   "Resource": "arn:aws:s3:::<var class="keyword varname">DOC-EXAMPLE-BUCKET</var>/*"
               }
           ]
       }

   Where
   * <var class="keyword varname">SOURCE-AWS-ACCOUNT</var> is the AWS account ID of the member account that includes the EC2 instances.
   * <var class="keyword varname">INSTANCE-PROFILE-ROLE-NAME</var> is the IAM instance profile that is attached to the EC2 instances.

     By default, the AmazonSSMForInstancesRoleSetup.yml script creates the
     AmazonSSMForInstancesRole IAM instance profile role and attaches the role to the AmazonSSMManagedInstanceCore bucket policy. See [Executing scripts required for setting up AWS](https://servicenow-prod.fluidtopics.net/aJmQP3_kDYW02z90NoVhpg "You must execute scripts provided with the Service Graph Connector for AWS to set up the AWS environment for importing data.").
   * <var class="keyword varname">DOC-EXAMPLE-BUCKET</var> is the S3 bucket name.
   {#sgc-cmdb-aws-s3-setup__ul_ktr_cny_mzb}  
   The following example bucket policy shows the effect, principal, action, and resource elements. The policy allows AmazonSSMRoleForInstances, an IAM instance profile role in an account with ID `123456789000`, `s3:GetObject`, `s3:PutObject`, and `s3:PutObjectAcl` S3 permissions on the `myS3Bucket` bucket.

       {
           "Version": "2012-10-17",
           "Id": "S3PolicyforServiceNowIAMrole",
           "Statement": [
               {
                   "Sid": "EC2S3Access",
                   "Effect": "Allow",
                   "Principal": {
                       "AWS": [
                           "arn:aws:iam::123456789000:role/AmazonSSMRoleForInstances",
                           "arn:aws:iam::123456789001:role/AmazonSSMRoleForInstances",
                           "arn:aws:iam::123456789002:role/AmazonSSMRoleForInstances",
                           "arn:aws:iam::123456789003:role/AmazonSSMRoleForInstances",
                           "arn:aws:iam::123456789004:role/AmazonSSMRoleForInstances"
                       ]
                   },
                   "Action": [
                       "s3:GetObject",
                       "s3:PutObject",
                       "s3:PutObjectAcl"
                   ],
                   "Resource": "arn:aws:s3:::myS3Bucket/*"
               }
           ]
       }

   {#sgc-cmdb-aws-s3-setup__bucket-policy}
{#sgc-cmdb-aws-s3-setup__bucket-policy}
3. Attach IAM permissions to the instance profile role for EC2 instances to publish the SendCommand API responses to the S3 bucket you created in [step 1](https://servicenow-prod.fluidtopics.net/us40J_zw_pVe0IIm6yb6rA#sgc-cmdb-aws-s3-setup__creates3bucket).  
   See [Using instance profiles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) and [Attach an IAM role to an instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#attach-iam-role) on the AWS documentation site.  
   The IAM instance profile role attached to the managed EC2 instances must have the `s3:GetObject`, `s3:PutObject`, and `s3:PutObjectAcl` S3 permissions to allow access to the S3 bucket as shown in the following sample policy.

       {
           "Version": "2012-10-17",
           "Statement": [
               {
               "Sid": "PublishTerminalOutputToS3",
                   "Effect": "Allow",
                   "Action": [
                       "s3:PutObject",
                       "s3:GetObject",
                       "s3:PutObjectAcl"
                   ],
                   "Resource": "arn:aws:s3:::<var class="keyword varname">DOC-EXAMPLE-BUCKET</var>/*"
               }
           ]
       }

   Where, <var class="keyword varname">DOC-EXAMPLE-BUCKET</var> is the S3 bucket name.  
   Hinweis:  
   Make sure you add the suffix `/*` at the end of the bucket name to enable creating files under the bucket name.