Request new or enhanced Patterns on the ServiceNow® Store

Visit the ServiceNow Store to view all the available updates and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

Prerequisites

Verify that the applications are up to date

• AI Agent Topology Mapping
• Discovery and Service Mapping Patterns
• Visibility Content
• CMDB CI Class Models

Update the method used for pointed discovery for the AWS CloudFormation Template (CFT) stack

If you use Cloud Provisioning and Governance, you must update the getOperationGR(type) method. This update enables the pointed discovery to list the resources correctly for the AWS CFT stack after provisioning. For further information about the steps required to update this method, see the Knowledge Base article KB0858437.

Activate the cloud-related CI relationships

To include discovered components into service instances, enable CI relationships used in tag-based discovery by Service Mapping. These CI relationships are available from the 1.0.68 release on the ServiceNow Store. For operational steps, see Tag-based discovery configuration.

Set up service accounts on the AWS Management Console

An AWS Organization is a collection of AWS accounts under a single account. In AWS Organizations, parent accounts are called management accounts. The sub-accounts that belong to a management account are called member accounts.

The advantages of using management accounts in Discovery are:

Easy population of member accounts

After you configure the management account and supply the necessary credentials, you can test the connection to the account. If the test succeeds, Discovery returns a list of the member accounts in that management account. From this list, you can choose one or more member to include in the Discovery of the management account.

(Optional) Discover member resources using dynamically acquired credentials

When you run Discovery on your cloud resources, you don’t need separate credentials for each member account. The Cloud Discovery process handles credentials automatically by acquiring a temporary credential for each member via an AWS API. You can elect to use the default configuration or customize the MID Server to assume other roles for additional controls and security.

For more information, see Setting up AWS service accounts.

Use IAM user policy on the AWS Management Console

To use the IAM user policy instead of credentials during discovery, configure the MID Server for AWS IAM roles. For more information, see configure the MID Server for AWS IAM roles.

To create the IAM user policy for provisioning AWS resources, see Control AWS access and permissions using policies. Ensure that the IAM user policy covers the following AWS resources:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
        "elasticloadbalancing:DescribeLoadBalancerPolicyTypes",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeLoadBalancerPolicies",
        "elasticloadbalancing:DescribeInstanceHealth",
        "elasticloadbalancing:DescribeTags",
        "elasticloadbalancing:DescribeLoadBalancerAttributes",
        "account:ListRegions",
        "elasticloadbalancing:Describe*",
        "ec2:Describe*",
        "ec2:DescribeNetworkInterfaceAttribute",
        "ec2:DescribeInstanceStatus",
        "ec2:DescribeCustomerGateways",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeHosts",
        "ec2:DescribeImages",
        "ec2:DescribeVpcs",
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeInstanceAttribute",
        "ec2:DescribeInstanceCreditSpecifications",
       
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}

Configure access to the AWS resources

To discover a single account, create an IAM account in the AWS Management Console, and ensure that it has the "ReadOnlyAccess" policy applied. To discover several member or child accounts, configure the credentials as described in Access setup for AWS service accounts.

Configure the Discovery schedule to support GovCloud

Discovering AWS GovCloud (US) accounts requires using a datacenter URL when setting up an AWS service account. For more information, see Create AWS service accounts.

Configure a discovery schedule

Create an AWS Discovery schedule in Discovery Admin Workspace.

(Optional) Discover datacenters only for new members

Starting with Zurich Patch 2, you can discover datacenters only for new members added since the last discovery. For more information, see Discover datacenters only for new cloud accounts.

(optional) Optimize discovery by including only datacenters with resources

Starting with Discovery and Service Mapping Patterns version 1.29.0, you can optimize discovery by limiting it to only AWS datacenters with resources.

• Verify your service account has the following role permissions to access Config API:
  • config:GetDiscoveredResourceCounts
  • config:DescribeConfigurationRecorderStatus
• Verify AWS Config recorder is enabled and configured to record the all resource types.

  For instructions on configuring AWS Config recorder, go to the AWS Documentation and search for the "Recording resources in the AWS Config console" article.

• Enable discovery of only datacenters with resources by setting the mid.cloud.discovery.sonar.discover_all_aws_datacenters MID Server property to false. For more information, see Limit AWS discovery to datacenters with resources.

For more information, see the AWS resources discovery by datacenters section in AWS discovery using patterns.

(Optional) Populate Service Account and Logical Datacenter fields in cloud CIs

Starting with Discovery and Service Mapping Patterns version 1.30.0, you can improve query performance by populating Service Account and Logical Datacenter fields directly in cloud CIs. For more information, see Improved query performance with direct field population in CI tables.

Verify the REST API Permissions

Download the Cloud Discovery patterns spreadsheet so you can grant user permissions required for running the Discovery patterns. In addition to permissions, the spreadsheet also includes useful information such as pattern names, types, CI Classes, and links to vendor documentation. New patterns are available quarterly, so check periodically to be sure you have the latest version of the spreadsheet.

Data collection

The Amazon AWS - Bedrock Agents pattern collects AI System Digital Assets, AI Prompt Digital Assets, and Key Value information. You can view this information in the Related Links section of the CI record by navigating to All > Configuration > AWS > AWS Bedrock Agents and selecting the relevant record.

AI Agent Topology Mapping application populates data in both CMDB and non-CMDB tables.

Data stored in non-CMDB tables

The AI Agent Topology Mapping application populates data in non-CMDB tables when running the Amazon AWS - Bedrock Agents pattern.

If you have the AI Control Tower application, you can view the information in the AI Control Tower Workspace.

Data stored in CMDB tables

AI Agent Topology Mapping populates the data in the CMDB when running the Amazon AWS - Bedrock Agents pattern.

CI relationships

The Amazon AWS - Bedrock Agents pattern creates the following relationships to support Amazon Bedrock discovery.

AWS tag discovery

The Amazon AWS - Bedrock Agents pattern collects tags and populates them in the Key Value [cmdb_key_value] table.