---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management
Release :
- yokohama
ft:locale :
- en-US
ft:publication_title :
- Yokohama IT Operations Management
ft:clusterId :
- itom
bundleId :
- itom
workflow :
- Technology
---
# Configure access for trusting AWS member accounts in trust chain
# Configure access for trusting AWS member accounts in trust chain {#ariaid-title1}
* Release version: Yokohama
*
* Updated September 3, 2025
*
*  3 minutes to read
Configure access for AWS member accounts by using a trust chain from the accessor through the management account.
## Before you begin
* Familiarize yourself with the Amazon documentation on [Creating a role to delegate permissions to an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html).
* Ensure that you know which AWS member accounts are assigned to the same management account. You use the management account for configuring temporary credentials for cloud discovery using IAM roles.
* Confirm that Discovery Admin Workspace is using at least version 1.10.0. The DiscoveryCloud Service Accounts navigation module isn't available with earlier versions. To access Cloud Service Accounts with an earlier version, enter in the navigation filter: cmdb_ci_cloud_service_account.list.
{#configure-iam-role-aws-member__ul_ic2_djt_ypb}
Role required:
* For Cloud Discovery: discovery_admin
* For Cloud Provisioning and Governance: admin or sn_cmp.cloud_admin
{#configure-iam-role-aws-member__ul_n3k_vyz_g5b}
## About this task
You can configure access for AWS member accounts by using a trust chain from the accessor through the management account. The accessor account either has AWS credentials or uses a credential-free method.
Figure 1. Configuring member accounts to use their management account for access
## Procedure
1. Create an IAM role for the member account and configure the trust relationship between the user assuming this role and the trusted management account.
1. Log into the AWS Management Console using the credentials of the member account for which you are configuring access.
2. Create and configure the IAM role specifying the management account ID in the Account ID field.
For operational information about creating AWS roles, refer to the Amazon documentation.
3. On the Summary page for the IAM role, click the Trust Relationships tab.
4. Click Edit trust relationship.
The Edit Trust Relationship page opens showing the policy document.
5. Edit the trust relationship as follows:
* Set the Action parameter to `sts:AssumeRole`
* Set the `AWS` parameter to the full role ARN of the management account.
{#configure-iam-role-aws-member__ul_vm3_5cm_mpb}
6. Click Update Trust Policy.
{#configure-iam-role-aws-member__substeps_bh2_zz2_kpb}
2. On the ServiceNow AI Platform, configure the trusting member's service account.
1. Navigate to AllDiscoveryCloud Service Accounts.
2. Select New.
3. In the Parent account field, enter the name of the management account.
4. On the form, fill in the remaining fields.
For a description of the field values, see [Create AWS service accounts](https://servicenow-prod.fluidtopics.net/CvTA68TY3ph_FRR49RbdPg "Create AWS service accounts on the ServiceNow AI Platform to access your AWS account during AWS discovery.").
5. Select Submit.
{#configure-iam-role-aws-member__substeps_eby_pbf_kpb}
3. On the ServiceNow AI Platform, assign the AWS IAM role to the member account.
Important:
Perform this step only if you created custom IAM roles. By default, the OrganizationAccountAccessRole role is assigned to the member's trusting management account and you don't need to assign the OrganizationAccountAccessRole role to a service account.
1. Navigate to AllCloud Provisioning and GovernanceOrganization Access ParametersAWS Org Assume Role Parameters.
2. Select New.
3. On the form, configure only the following fields for the trusting member account:
{#configure-iam-role-aws-member__id_m4q_pq2_ngc__entry__2}
| Field | Definition |
|-|-|
| Access role name | Name of the IAM role created for the trusting account. * If IAM roles are the same across all member accounts: Enter the full ARN using an asterisk (\*) as a wildcard for the account ID in the format: arn:aws:iam::*:role/MemberRoleName. For example: arn:aws:iam::*:role/SN_MEMBER_ACCOUNT_ROLE. * If IAM roles are different across member accounts: Enter the full ARN of the specific IAM role for each member account in a separate entry. {#configure-iam-role-aws-member__ul_njf_fxl_bgc} |
| Cloud service account | Name of the trusting account for which you are providing access using the IAM role. * If IAM roles are the same across all member accounts: Enter the management account name. * If IAM roles are different across member accounts: Enter each member account in a separate entry. {#configure-iam-role-aws-member__ul_gvl_txl_bgc} |
[Table 1. Cloud Service Account AWS Org Assume Role Params form]
{#configure-iam-role-aws-member__id_m4q_pq2_ngc}
4. Select Submit.
{#configure-iam-role-aws-member__substeps_m4h_4hf_kpb}
## What to do next
Configure the trusting management account and the trusted accessor account.
* For information on configuring accessor accounts with AWS credentials, see [Configure temporary credential access for trusted AWS accounts](https://servicenow-prod.fluidtopics.net/tnnDDMp~UwhC6f0GVUN4xg "Configure the trusting account whose resources need to be accessed, to rely on the trusted account using the Identity and Access Management (IAM) role.").
* For information on configuring accessor accounts without AWS credentials, see [Configure credential-less access using trusted AWS accounts](https://servicenow-prod.fluidtopics.net/8Y0DgJeDNn0RUa5hrN1L5w "Set up a trusted credential-less account that other AWS accounts can rely on for access.").
{#configure-iam-role-aws-member__ul_ljj_lhr_bgc}
*[\>]: and then