Set up AWS service accounts

  • Release version: Washingtondc
  • Updated January 30, 2025
  • 3 minutes to read

    • Create and configure cloud service accounts at ServiceNow AI Platform for the corresponding Amazon Web Services (AWS) service accounts.

    Verify the REST API Permissions

    Download the Cloud Discovery patterns spreadsheet so you can grant user permissions required for running the Discovery patterns. In addition to permissions, the spreadsheet also includes useful information such as pattern names, types, CI Classes, and links to vendor documentation. New patterns are available quarterly, so check periodically to be sure you have the latest version of the spreadsheet.

    Before you begin

    Ensure that you are familiar with the hierarchy of AWS service accounts in your environment. For example, if there are AWS Organizations, set up the management and member accounts at ServiceNow AI Platform to reflect that hierarchy. You can set up the AWS service accounts of the following types:
    • Discrete account: Standalone account, with no management account.
    • Management account: Management account that may or may not contain member accounts (subaccounts).
      Note:
      Some ServiceNow UI screens may refer to management accounts as master accounts.
    • Member account: Subaccount that belongs with the (management) account.

    Role required: admin or discovery_admin

    About this task

    A service account is a secure record on your instance that stores the credential and access information for your provider account. Discovery uses the information to access your provider account to get data on each resource in each specified datacenter. A cloud account is the logical representation in cloud management of all or part of your managed cloud infrastructure. A cloud account can include multiple service accounts—even service accounts from different providers. For each service account, you specify which datacenter to include in the cloud account.

    Procedure

    1. In the navigation filter, enter cmdb_ci_cloud_service_account.list.
    2. Select New.
    3. Fill in the fields.
      Table 1. Cloud Service Account form
      Field Description
      Name The unique and meaningful name for this service account.
      Account ID 12-digit user account number. Expand the list under the AWS account name on the AWS Management Console to view the number.
      Important:
      In the Account ID field, remove the hyphen characters (-) from the number.
      Figure 1. IAM user account number
      Determine the IAM user account number to fill in the Account ID field
      Discovery credentials

      The credentials needed for ServiceNow applications to access this account. You may configure this field at a later stage, while configuring access to AWS accounts.

      • If you configured AWS credentials at ServiceNow AI Platform , select the magnifying glass icon, and then select the name of the relevant AWS credential.
      • To use other AWS accounts to access this account, leave the field blank. For example, you don't need to specify the AWS credentials for accounts assuming IAM roles or member accounts using their management account for access.
      Datacenter URL

      URL of the datacenter.

      This field is required for AWS China region and AWS GovCloud (US) accounts.

      For example:
      • AWS China region: https://organizations.cn-northwest-1.amazonaws.com.cn
      • AWS GovCloud (US): https://ec2.us-gov-west-1.amazonaws.com
      Datacenter type Type of the datacenter where the account is hosted.

      Select AWS datacenter.
      Datacenter discovery status Auto-generated value: Status and timestamp of the last execution of Discovery on the datacenter.
      Parent account Name of the management account that represents the organization in AWS that this member account belongs to.

      It appears when you select AWS datacenter.

      Leave the field empty if this account is not part of an AWS organization.
      Is master account Management account flag.

      It appears when you select AWS datacenter from the Datacenter Type drop-down. Select the check box to associate the AWS service account with the management account. Select this check box only for accounts that you previously configured in the AWS Management Console as management accounts with some member accounts belonging to them. See the AWS documentation for information on AWS Organizations.

      Note:
      You will need to setup the correct permission in AWS or the Organization role for a standard credential. For more information, see Control AWS access and permissions using policies.
      Accessor account Name of the trusted account.

      Configure this field only for accounts that don't use permanent AWS credentials and rely on IAM roles for access.