---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Set up an Identity Access Manager account for a ServiceNow user in AWS

# Set up an Identity Access Manager account for a ServiceNow user in AWS {#ariaid-title1}

* Release version: Yokohama
* 
* Updated August 13, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

Create an AWS CloudFormation Identity Access Manager (IAM) user in the management account using the CloudFormation template (CFT) so you can manage multiple AWS accounts with a centralized IAM user.

## Before you begin

* Role required: AWS admin
* The ServiceNow IAM user account requires specific AWS IAM permissions to perform basic operations. To learn more about the permissions, see [About Amazon Web Services API permissions](https://servicenow-prod.fluidtopics.net/AuiEAq9UWChKGeYLVIk15A "Cloud Account Management interacts with Amazon Web Services to create and manage subscription accounts.").

{#set-up-iam-account-in-aws__ul_rf4_yzt_hdc}

## Procedure

1. Log in to the AWS Management console and enter <kbd class="ph userinput">CloudFormation</kbd> in the search bar and then select it.
2. On the CloudFormation console, select Create Stack.  
   A stack is a collection of AWS resources that you can manage as a single unit.
3. Copy the CloudFormation template (CFT) code into a file and save the file.  
   The file extension should be `.yml`. For example, `CreateServiceNowUser.yml`.

       AWSTemplateFormatVersion: '2010-09-09'
       Description: This script is executed in Management Account where the  ServiceNow user is created.

       Metadata:
         AWS::CloudFormation::Interface:
           ParameterGroups:
             - Label:
                 default: User Credentials
               Parameters:
                 - SNUserName
           ParameterLabels:
             SNUserName:
               default: User Name

       Parameters:
         SNUserName:
           Type: String
           Description: User name for CW Service Account user
           MinLength: '6'
           MaxLength: '15'
           ConstraintDescription: The username must be between 6 and 15 characters

       Resources:
         SnowCWMemberAccountAccessGroup:
           Type: 'AWS::IAM::Group'
           Properties:
             GroupName: SnowCWMemberAccountAccessGroup

         SnowCWAccountAccessPolicy:
           Type: 'AWS::IAM::Policy'
           Properties:
             PolicyName: SnowCWAccountAccessPolicy
             PolicyDocument:
               Statement:
                 - Sid: ServiceNowCWUserAccess
                   Effect: Allow
                   Action:
                     - 'organizations:ListRoots'
                     - 'organizations:ListTagsForResource'
                     - 'organizations:DescribeAccount'
                     - 'organizations:CreateAccount'
                     - 'organizations:ListAWSServiceAccessForOrganization'
                     - 'organizations:TagResource'
                     - 'organizations:ListAccounts'
                     - 'organizations:ListRoots'
                     - 'organizations:ListTagsForResource'
                     - 'organizations:DescribeAccount'
                     - 'organizations:CreateAccount'
                     - 'organizations:ListAWSServiceAccessForOrganization'
                     - 'organizations:TagResource'
                     - 'organizations:ListAccounts'
                     - 'organizations:CloseAccount'
                     - 'organizations:DescribeOrganization'
                     - 'organizations:DescribeOrganizationalUnit'
                     - 'organizations:ListParents'
                     - 'organizations:ListOrganizationalUnitsForParent'
                     - 'organizations:MoveAccount'
                     - 'organizations:DescribeCreateAccountStatus'
                     - 'organizations:AttachPolicy'
                     - 'organizations:DescribePolicy'
                     - 'organizations:ListAccounts'
                     - 'budgets:CreateBudgetAction'
                     - 'budgets:ModifyBudget'
                     - 'budgets:ViewBudget'
                     - 'budgets:ListTagsForResource'
                     - 'iam:GetAccountSummary'
                     - 'iam:GetAccountPasswordPolicy'
                     - 'budgets:DescribeBudgetAction'
                     - 'iam:ListAccountAliases'
                     - 'sts:AssumeRole'
                     - 'iam:GetRole'
                     - 'iam:ListAccountAliases'
                     - 'iam:GetAccountPasswordPolicy'
                     - 'organizations:DetachPolicy'
                     - 'iam:GetAccountAuthorizationDetails'              
                   Resource: '*'
             Groups:
               - !Ref SnowCWMemberAccountAccessGroup

         CreateServicenowUser:
           Type: 'AWS::IAM::User'
           Properties:
             Path: /
             UserName: !Ref SNUserName
         AddSnowUserToSnowCWMemberAccountAccessGroup:
           Type: 'AWS::IAM::UserToGroupAddition'
           Properties:
             GroupName: SnowCWMemberAccountAccessGroup
             Users:
               - !Ref SNUserName
           DependsOn: CreateServicenowUser

       Outputs:
         ServiceNowUserARN:
           Description: ARN of ServiceNow user
           Value: !GetAtt 
             - CreateServicenowUser
             - Arn

         ServiceNowUser:
           Description: ServiceNow user
           Value: !Ref SNUserName

4. On the Create Stack page, select Choose an existing templateUpload a template fileChoose file to choose a template file from your local computer.
5. Select Next to continue and to validate the template.
6. On the Specify stack details page, enter a <kbd class="ph userinput">CloudFormation stack name</kbd> in the Stack name field.  
   The stack name is an identifier that helps you find a particular stack from a list of stacks. A stack name can contain only alphanumeric characters (case-sensitive) and hyphens. It must start with an alphabetic
   character and can't be longer than 128 characters.
7. In the User Name field, enter a Cloud Account Management service account user name.
8. Select Next to continue.
9. On the Configure stack options page, select the I acknowledge that AWS CloudFormation might create IAM resources with custom names check box and select Next.
10. On the Review and create page, select Submit to launch your stack.  
    The IAM account gets created.
11. To add security credentials:
    1. Select Resources.
    2. Select the user name link.
    3. In the Access Keys section, select Create access key.
    4. On the Access key best practices \& alternatives page, choose the Third-party service option.  
       You plan to use this access key to enable access for a third-party application or service that monitors or manages your AWS resources.
    5. Select the I understand the above recommendation and want to proceed to create an access key check box and select Next.
    6. Select Create access key.
    7. In the Review access keys page, download the access key file and select Done.  
       Note:  
       Share the access key and secret key with the Terraform admin and ServiceNow AI Platform admin.
    {#set-up-iam-account-in-aws__substeps_exj_g1w_12c}

## What to do next

[Set up suspension of an AWS account using service control policy](https://servicenow-prod.fluidtopics.net/5HkM6~t57JB4nO2qq6C_7A "Set up a restriction on cloud account creation. For example, when the account owner isn’t in the organization or if there are budget constraints. Using Cloud Account Management, admin adds the account number to the AWS organization's service control policy, promoting existing accounts to continue to function normally while blocking new account creation.")

*[\>]: and then