1. For the Configure the connection section of the Service Graph Connector for AWS page, select Get Started.
2. For the Configure the credentials task, select Configure.
3. In the Name field, enter a name for the authentication.

   SG-AWS-Credentials-Org is the default credential alias name. You can add multiple AWS instances. However, don’t modify the default connection alias.

4. Enter the access key ID and the secret access key in the Access Key ID and Secret Access Key fields respectively.

   The AWS access keys are long-term credentials for the IAM user and include two parts: an access key ID and a secret access key. You must use both the access key ID and the secret access key together to authenticate requests.

5. Return to the Configure the connection task page by selecting the back icon (<).
6. Set the Configure the credentials task to complete by selecting Mark as Complete.

1. For the Test the connection task in the Configure the connection section, select Configure.
2. Select the Test Connection related link.
3. When the Status field is set to Success, select the back icon (<) to return to the guided setup.
4. Set the Test the connection task to complete by selecting Mark as Complete.

1. For the Update configuration properties for instance task, select Configure.
2. On the SG-AWS Configuration Properties form that opens in a new tab, review, and modify the fields.

   Table 1. SG-AWS Configuration Properties form

   Field	Description
   Connection Details
   Connection Alias	Name to identify the AWS connection record. For example, SG_AWS_CredentialAlias_Org. You can add multiple AWS instances. However, don’t modify the name for the default connection alias SG_AWS_CredentialAlias_Org.
   Organization Details
   Organization Account	Numeric account identifier of the AWS organization.
   Organization Name	Name of the AWS organization.
   Organization Description	Description of the AWS organization.
   AWS Regions
   Regions	AWS regions to collect the CI data. By default, the Service Graph Connector for AWS runs through all the AWS regions to collect the CI data. You can enter AWS specific regions to speed up the CI data import process. For example, us-east1, us-east-2. If this field is left empty, the Service Graph Connector for AWS pulls the resources from all the AWS regions. However, for the AWS GovCloud regions, don’t leave the Regions field empty. The supported AWS GovCloud regions are us-gov-east-1 and us-gov-west-1. If you update the Regions field value later, clear the value of the Last run datetime field in all the data sources related to the Service Graph Connector for AWS to import a new set of data.
   STS Assume Role Name
   STS Role	AWS Identity and Access Management (IAM) role name that is obtained by the ServiceNow user by calling the AssumeRole API offered by the AWS Security Token Service (STS). The AssumeRole API returns a set of temporary security credentials for the ServiceNow user to access the AWS resources. Note: Enter the IAM role name but don’t prefix arn in the name. If you leave this field is empty, the value of this field is automatically set to SnowOrganizationAccountAccessRole, which is the default IAM role name for the ServiceNow user.
   S3 Account Details
   S3 Account Id	Numeric identifier of the AWS account that hosts the Amazon Simple Storage Service (Amazon S3) bucket.
   S3 Bucket Name	Name of the Amazon S3 bucket that collects the details from Amazon EC2 instances.
   S3 Region	Region where the Amazon S3 bucket resides.
   SSM SendCommand Document Details
   SSM Send Command Linux Name	Name of the document that defines the actions run by the AWS Systems Manager (SSM) on a Linux-based Amazon EC2 instance.
   SSM Send Command Windows Name	Name of the document that defines the actions run by the AWS SSM on a Windows-based Amazon EC2 instance.
   Management Account ID
   Management Account ID	Management account in the AWS organization. The account calls the ListAccounts API associated with the AWS organization to collect CI information from all the accounts. For more information, see ListAccounts on the AWS documentation site. Enter a value for this field when the ServiceNow user was created in an AWS member account.
   Standalone Account ID Details
   Standalone Account ID	ID of a member account in the AWS organization. Note: When specifying a standalone account, AWS organization-related data such as the organization name, organization units, organization ID, and service accounts are not imported. If you want to import the full data later, clear any value mentioned in the Standalone Account ID field. See the Service Graph Connector for AWS - Standalone Setup [KB1642159] article in the Now Support Knowledge Base.
   AWS Config Aggregator Details
   Config Aggregator Account	AWS account where the aggregator resource type in the AWS Config service has been configured. Enter a value in this field when you’re using an AWS Config aggregator.
   Config Aggregator Name	Name of the aggregator resource type. This field is available only when you enter a value in the Config Aggregator Account field.
   Config Aggregator Region	Region where the aggregator resource type resides. This field is available only when you enter a value in the Config Aggregator Account field.
   AWS Key Rotation Setup
   AWS Rotate Keys	Option to enable the key rotation process.
   AWS Key Rotation Date	Key rotation date. Set the value to the required key rotation date for the first run. For subsequent runs, this field is automatically set to the rotation date. This field is available only when you select the AWS Rotate Keys check box.
   AWS Key Rotation Period (in Days)	Key rotation period in days. This field is available only when you select the AWS Rotate Keys check box.
   AWS Key Rotation Status	Status message of a key rotation displaying whether the rotation was a success or a failure. This field is automatically set to display the key rotation status message. This field is available only when you select the AWS Rotate Keys check box. If the rotation status is a failure, an email notification is triggered, if configured.
   Email accounts for receiving error notifications	Comma-separated list of the email addresses of recipients who receive notifications about the AWS key rotation errors.
   Email account groups for receiving error notifications	Comma-separated list of the ServiceNow groups who receive notifications about the AWS key rotation errors.
   Gov Cloud Setup
   Is Gov Cloud	Option to indicate that the connection setup is for the AWS GovCloud.
   SSM EKS SendCommand Document Details
   EKS Cluster Names Document	Name of the AWS SSM document to discover EKS clusters associated with EC2 Bastion hosts.
   EKS Shell Script Document	Name of the AWS SSM document to fetch CIs related to Kubernetes components, such as pods, services, and deployments, from EKS clusters.

3. Select Save and then Close to close the tab and return to the guided setup tab.
4. Set the Update configuration properties for instance task to complete by selecting Mark as Complete.

1. Select the Global application scope by using the application picker.
2. For the Update Data Source Access task, select Configure.
3. In the Application Access related list, select the Can create, Can update, and Can delete check boxes, if not already selected.
4. Select Update to close the tab and return to the guided setup.
5. Modify the application scope again to Service Graph Connector for AWS by using the application picker.
6. Set the Update Data Source Access task to complete by selecting Mark as Complete.

1. Select the Global application scope by using the application picker.
2. For the Update Scheduled Data Import Access task, select Configure.
3. In the Application Access related list, select the Can create, Can update, and Can delete check boxes, if not already selected.
4. Select Update to close the tab and return to the guided setup tab.
5. Set the Update Scheduled Data Import Access task to complete by selecting Mark as Complete.
6. Modify the application scope again to Service Graph Connector for AWS by using the application picker.

1. For the Clear Cache for Data Source and Scheduled Data Imports tables task, select Configure.
2. In the Run script text box of the background script page, enter the following script:

   GlideTableManager.invalidateTable("sys_data_source");
         GlideCacheManager.flushTable("sys_data_source");
   
         GlideTableManager.invalidateTable("scheduled_import_set");
         GlideCacheManager.flushTable("scheduled_import_set");
   
         GlideTableManager.invalidateTable("sys_db_object");
         GlideCacheManager.flushTable("sys_db_object");

3. Select Run Script to run the background script in the global scope.

   The script may take several minutes to execute.

4. After the script is executed, select Close.
5. Set the Clear Cache for Data Source and Scheduled Data Imports tables task to complete by selecting Mark as Complete.
6. Modify the application scope again to Service Graph Connector for AWS by using the application picker.

1. For the Create new Connection & Credentials Alias Record task, select Configure.
2. On the Connection & Credential Aliases form that opens in a new tab, fill in the connection details.
3. Select Submit and close the tab and return to the guided setup tab.
4. Set the Create new Connection & Credentials Alias Record task to complete by selecting Mark as Complete.

1. For the Create new Connection & Credentials Alias Record task, select Configure.
2. On the Connections page of the Workflow Studio, select Add Connection.
3. In the Create Connection window, fill in the connection name, access key, and secret key details.
4. Select Create Connection.
5. Close the Workflow Studio and return to the guided setup tab.
6. Set the Create new Connection & Credentials Alias Record task to complete by selecting Mark as Complete.

When you're done updating the properties, set the Configure AWS environment for the new Instance task to complete by selecting Mark as Complete.

When you're done updating the properties, set the Update EKS Resource Details task to complete by selecting Mark as Complete.

1. For the Configure the Scheduled Imports task, select Configure.
2. In the Scheduled Data Imports list that opens in a new tab, select the organization of the AWS instance that you want to configure.
3. Select the scheduled data import that you want to activate.
4. On the Scheduled Data Import form, modify the field values for the scheduled job.
5. Select Update.
6. Repeat the steps 8.i.iii to 8.i.v for each scheduled job for data import.
7. Close the tab for the Scheduled Data Imports list and return to the guided setup tab.
8. Set the Configure the Scheduled Imports task to complete by selecting Mark as Complete in the guided setup.