---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Configure credential-less access using trusted AWS accounts

# Configure credential-less access using trusted AWS accounts {#ariaid-title1}

* Release version: Yokohama
* 
* Updated September 3, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read

Set up a trusted credential-less account that other AWS accounts can rely on for access.

## Before you begin

* Familiarize yourself with the Amazon documentation on [Creating a role to delegate permissions to an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html).
* Decide which AWS account is going to be the trusted account. You use the trusted account to configure temporary credentials for Cloud Discovery using IAM roles. The trusted account that you use to access other accounts using IAM roles is referred to as an accessor account.
* If you're setting up a trust chain, confirm that the member account trusts the management account. The management account must also trust the accessor account. For more information, see [Configure access for trusting AWS member accounts in trust chain](https://servicenow-prod.fluidtopics.net/PxepG0CfRHr~cJR77a3ilw "Configure access for AWS member accounts by using a trust chain from the accessor through the management account.").
* Confirm that Discovery Admin Workspace is using at least version 1.10.0. The DiscoveryCloud Service Accounts navigation module isn't available with earlier versions. To access Cloud Service Accounts with an earlier version, enter in the navigation filter: <kbd class="ph userinput">cmdb_ci_cloud_service_account.list</kbd>.

{#aws-trusted-credential-less__ul_k5s_zm5_zfc}  
Role required:

* For Cloud Discovery: discovery_admin
* For Cloud Provisioning and Governance: admin or sn_cmp.cloud_admin
{#aws-trusted-credential-less__ul_n3k_vyz_g5b}

## About this task

To use an account without AWS credentials, you must first configure that account with an IAM role and permissions to access the trusting service account. Then, you set up the IAM role of the trusting account to grant
access to the IAM role of the trusted account.
Figure 1. Setting up any AWS account to rely on a trusted account without AWS credentials   

## Procedure

1. Configure an IAM role for the trusting account.
   1. Log into the trusting account on the AWS Management Console.
   2. Create an IAM role for this account.  
      Use the account ID of the trusted account while creating this IAM role. For operational information about working with AWS roles, refer to the Amazon documentation. {#aws-trusted-credential-less__create-IAM-role-trusting-account}
   {#aws-trusted-credential-less__create-IAM-role-trusting-account}
   3. [Create a ReadOnlyAccess policy](https://servicenow-prod.fluidtopics.net/LQikZk4dqXG0SqXIyUOUGw "Configure policies with the necessary level of permissions to provide access to the AWS resources for Cloud Discovery and Cloud Provisioning and Governance.") and attach it to the newly created IAM role.
   {#aws-trusted-credential-less__substeps_ls1_bld_mpb}
2. Configure the IAM role for the trusted account.
   1. Log into the AWS Management Console using the credentials of the account that you want to set up as a trusted account.
   2. Create an IAM role by choosing the AWS service option.  

      <br />

      {#aws-trusted-credential-less__create-role-trusted-account}
   {#aws-trusted-credential-less__create-role-trusted-account}
   3. Create a read-only access policy for the trusted account IAM role.  
      For more information, see [Control AWS access and permissions using policies](https://servicenow-prod.fluidtopics.net/LQikZk4dqXG0SqXIyUOUGw "Configure policies with the necessary level of permissions to provide access to the AWS resources for Cloud Discovery and Cloud Provisioning and Governance.").
   4. Create an additional policy to grant this IAM role access to resources in trusting accounts:  
      * Set the Action parameter to `sts:AssumeRole`
      * Set the Resource parameter to the ARN of the trusting account role that you created in [1.b](https://servicenow-prod.fluidtopics.net/8Y0DgJeDNn0RUa5hrN1L5w#aws-trusted-credential-less__create-IAM-role-trusting-account).

      {#aws-trusted-credential-less__ul_psc_hrd_mpb}

   5. Attach the newly created role to the relevant Amazon EC2 instance.  
      By default, when you attach an IAM role to an EC2 instance, it creates a trust relationship between this role and the EC2 instance.  

   {#aws-trusted-credential-less__substeps_mbv_tld_mpb}
3. Configure the trusting service account to grant access to the IAM role belonging to the trusted account.
   1. Log into the trusting account on the AWS Management Console.
   2. Navigate to the IAM role you created for this account as described in [1.b](https://servicenow-prod.fluidtopics.net/8Y0DgJeDNn0RUa5hrN1L5w#aws-trusted-credential-less__create-IAM-role-trusting-account).
   3. Edit the Trust Relationship for this IAM role as follows:  
      * Set the Action parameter to `sts:AssumeRole`.
      * Set the AWS parameter to the ARN of the trusted account role that you created in [2.b](https://servicenow-prod.fluidtopics.net/8Y0DgJeDNn0RUa5hrN1L5w#aws-trusted-credential-less__create-role-trusted-account).

      {#aws-trusted-credential-less__ul_zth_n5d_mpb}
   {#aws-trusted-credential-less__substeps_klg_kmd_mpb}
4. Configure the MID Server for AWS IAM roles.  
   For more information, see [Configure the MID Server for AWS IAM roles](https://servicenow-prod.fluidtopics.net/lhMYkC6JaBaGV2hHTqPjcg "Configure the MID Server to retrieve the temporary security credentials associated with an IAM role.").
5. On the ServiceNow AI Platform, configure the trusted service account.
   1. Navigate to AllDiscoveryCloud Service Accounts.
   2. Selelct New.
   3. On the form, fill in the fields.  
      For a description of the field values, see [Create AWS service accounts](https://servicenow-prod.fluidtopics.net/CvTA68TY3ph_FRR49RbdPg "Create AWS service accounts on the ServiceNow AI Platform to access your AWS account during AWS discovery.").
   4. Select Submit.
   {#aws-trusted-credential-less__substeps_eq5_mg5_zfc}
6. On the ServiceNow AI Platform, configure the trusting service account.
   1. Navigate to AllDiscoveryCloud Service Accounts.
   2. Select New.
   3. In the Accessor account field, enter the name of the trusted account.
   4. On the form, fill in the remaining fields.  
      For a description of the field values, see [Create AWS service accounts](https://servicenow-prod.fluidtopics.net/CvTA68TY3ph_FRR49RbdPg "Create AWS service accounts on the ServiceNow AI Platform to access your AWS account during AWS discovery.").
   5. Select Submit.
   {#aws-trusted-credential-less__substeps_dkg_1h5_zfc}
7. On the ServiceNow AI Platform, assign the AWS IAM role to the trusting account, using the relevant form, based on the relationship to the trusted account.

   | Trusted account type | Steps |
   | Management account | 1. Navigate to AllCloud Provisioning and GovernanceOrganization Access ParametersAWS Org Assume Role Parameters. 2. Select New. 3. On the form, configure only the following fields for the trusting member account: {#aws-trusted-credential-less__aws-org-assume-member-trusts-management__entry__2} | Field | Definition | |-|-| | Access role name | Name of the IAM role created for the trusting account. * If IAM roles are the same across all member accounts: Enter the full ARN using an asterisk (\*) as a wildcard for the account ID in the format: <kbd class="ph userinput">arn:aws:iam::*:role/MemberRoleName</kbd>. For example: <kbd class="ph userinput">arn:aws:iam::*:role/SN_MEMBER_ACCOUNT_ROLE</kbd>. * If IAM roles are different across member accounts: Enter the full ARN of the specific IAM role for each member account in a separate entry. {#aws-trusted-credential-less__ul_njf_fxl_bgc} | | Cloud service account | Name of the trusting account for which you are providing access using the IAM role. * If IAM roles are the same across all member accounts: Enter the management account name. * If IAM roles are different across member accounts: Enter each member account in a separate entry. {#aws-trusted-credential-less__ul_gvl_txl_bgc} | [Table 1. Cloud Service Account AWS Org Assume Role Params form] {#aws-trusted-credential-less__aws-org-assume-member-trusts-management} 4. Select Submit. {#aws-trusted-credential-less__ol_msk_kk5_zfc} |
   | Member or discrete account | 1. Navigate to AllCloud Provisioning and GovernanceOrganization Access ParametersAWS Cross Assume Role Parameters. 2. Select New. 3. On the form, configure only the following fields for the trusting account: {#aws-trusted-credential-less__table_vx5_qj5_zfc__entry__2} | Field | Description | |-|-| | Access role name | Name of the IAM role created for the trusting account. | | Cloud service account | Name of the trusting account for which you are providing access using the IAM role. | [Table 2. Cloud Service Account AWS Cross Assume Role Params form] {#aws-trusted-credential-less__table_vx5_qj5_zfc} 4. Select Submit. {#aws-trusted-credential-less__ol_nmz_n35_zfc} |
   |-|-|

   {#aws-trusted-credential-less__choicetable_g1z_335_zfc}

## What to do next

Verify that ServiceNow applications can access the trusting service account using the IAM role:

1. Navigate to AllDiscoveryCloud Service Accounts.
2. Select the trusting AWS service account.
3. Under Related Links, select Create Discovery Schedule.
4. In the Discovery Manager Cloud Discovery page, select Test Account.
   * If the connection is successful, a message displays indicating the account validation is successful.
   * If the connection isn't successful, an error message displays indicating the cause of failure.
   {#aws-trusted-credential-less__ul_aq2_5yt_2gc}
{#aws-trusted-credential-less__aws-testing-credentials}

*[\>]: and then