---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# AWS Certificate Manager discovery

# AWS Certificate Manager discovery {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read

Cloud Discovery uses Patterns to discover certificate data that the Amazon AWS Cloud Certificate Manager (ACM) manages. Discovering this data requires installing and updating Discovery and Service Mapping Patterns and Certificate Inventory and Management.

## Request apps on the Store {#aws-certificate-manager-discovery-pattern__section_sv2_vw5_5mb}

Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/r/store-release-notes/sn-store-release-notes.html).{#aws-certificate-manager-discovery-pattern__inline-send-to-store}

## Prerequisites {#aws-certificate-manager-discovery-pattern__section_x4f_zrd_f4b}

Verify the configuration of an AWS account
:   For more information, see [Discovery for cloud environment](https://servicenow-prod.fluidtopics.net/iXC8jdgXIVXh9T_QHi7P_g "ITOM Visibility cloud discovery solutions enable you to collect detailed information about your cloud-based infrastructure and your resources in major cloud service providers: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), IBM Cloud Platform, Oracle Cloud Infrastructure (OCI), and Alibaba Cloud.")

Verify the installation of the plugins
:   Certificate Inventory and Management (sn_disco_certmgmt) at least 3.4.0
:   Discovery and Service Mapping Patterns (sn_itom_pattern) at least 1.12.0

Verify that Cloud Discovery has permissions to discover AWS
:   Run the following commands with AWS CLI to check the permissions and policies attached to your active IAM role:

    * List Certificates`AWS_PAGER='' aws acm list-certificates --region <region>`

    * Describe Certificates `AWS_PAGER='' awsacm describe-certificate --certificate-arnarn:aws:acm:<region>:<accout_id>:certificate/<certificate_id>`

    * Get Certificates `AWS_PAGER='' awsacm get-certificate --certificate-arnarn:aws:acm:<region>:<account_id>:certificate/<certificate_id>`

    * Get tags `AWS_PAGER='' awsresourcegroupstaggingapi get-resources --tags-per-page 100 --resource-type-filters 'acm:certificate'`

    {#aws-certificate-manager-discovery-pattern__ul_zhn_2qj_wzb}

Set the configuration of the system property
:   When the system property sn_itom_pattern.issuer_certificate_search_by_idn is set to false, Discovery uses the certificate fingerprints to find issuers and root issuers.

Verify the MID Server requirements
:   The MID Server must have either ALL capability or AWS capability.

Verify the configuration of Cloud Discovery schedule
:   For more information, see [Create a discovery schedule in Cloud Discovery Workspace](https://servicenow-prod.fluidtopics.net/4egAp8rafm6~FSeRVUzHTg "Create schedules for discovering cloud resources based on the discovery method that you choose: service accounts or IP ranges. The discovery schedule defines the various settings for the cloud discovery.")

## Verify the REST API Permissions {#aws-certificate-manager-discovery-pattern__id_jc1_3yb_f1c}

Download the [Cloud Discovery patterns spreadsheet](https://downloads.docs.servicenow.com/resource/enus/api/servicenow-discovery-patterns-api-details.xlsx) so you can grant user permissions required for running the Discovery patterns. In addition to permissions, the spreadsheet also includes useful information such as pattern names, types, CI Classes, and links to vendor documentation. New patterns are available
quarterly, so check periodically to be sure you have the latest version of the spreadsheet.{#aws-certificate-manager-discovery-pattern__cloud-discovery-api-paragraph}

## Data collected by Discovery during horizontal discovery {#aws-certificate-manager-discovery-pattern__section_t1y_mxd_f4b}

The Amazon AWS - Certificates Manager pattern and Amazon AWS - Collect Certificates Tags shared library support the discovery of the following table and fields.{#aws-certificate-manager-discovery-pattern__table_w2j_l53_2nb__entry__2}

| Field | Description |
|-|-|
| Unique Certificates \[cmdb_ci_certificate\] ​ ||
| Name | The host name/domain associated with the certificate. For example, <var class="keyword varname">*.service-now.com</var> |
| Fingerprint | The hash value of the certificate. For example, <var class="keyword varname">d708c8583c78c176d5df1a4f01aac746294 e390a03038f280b0d8f5efbc8a0f</var> |
| Fingerprint algorithm | The algorithm that's being used to hash the certificate. For example, Discovery calculates fingerprints by the SHA-256 algorithm, so the value that is populated is: <var class="keyword varname">SHA-256</var> |
| Serial Number | The serial number of the certificate. For example, <var class="keyword varname">70 d8 c9 52 77 1c 2d 54 97 00 0e 21 05 84 dd 76 b5 e8 c1 73</var> |
| Subject common name | The host name/domain associated with the certificate. For example, <var class="keyword varname">*.service-now.com</var> |
| Subject distinguished name | The distinguished name of the entity that the certificate is issued to.​ The subject distinguished name consists of the following * Common name (CN). * Organization (O)- The organization that owns the domain that the certificate is issued to. * organizational unit (OU)- The organizational unit that owns the domain that the certificate is issued to. {#aws-certificate-manager-discovery-pattern__ul_phj_qtj_wzb} |
| Issuer common name | The common name of the certificate issuer. For example, Entrust Certification Authority. |
| Issuer distinguished name | The distinguished name of the certificate issuer. The issuer distinguished name consists of the following * Common Name (CN)- the authority that issued the certificate. For example, <var class="keyword varname">Entrust Certification Authority</var>. * Organization (O)- The organization that issued the certificate. For example, <var class="keyword varname"> "Entrust", Inc</var>. * Organizational Unit (OU)- The unit that has the legal rights to issue the certificate. {#aws-certificate-manager-discovery-pattern__ul_gwg_q5j_wzb} |
| Renewal tracking | Indicates whether to create any priority 1 or priority 3 tasks for the expiring certificates. Discovery sets Renewal tracking to <var class="keyword varname">priority3</var> when the system property <var class="keyword varname">glide.discovery.certs.enable_renewal_task_creation_for_discovered_certificates</var> is set to true. |
| Valid From | The certificate is valid from this date (UTC). For example, <var class="keyword varname">2023-09-25 10:43:03</var> |
| Valid To | The expiry date of the certificate (UTC). For example, 2024-09-24 10:43:03 |
| Subject organization | The organization (O) that the certificate is issued to. |
| Subject organizational unit | The organizational unit (OU) that the certificate is issued to. |
| Subject country | The country (C) of the organization that the certificate is issued to. Populated in a two-letter country code. |
| Subject state | The region, state (ST), or province of the organization that the certificate is issued to. Populated with two-letter code. |
| Subject locality | The city, location (L) of the organization that the certificate is issued to. |
| Subject email | The email address of the organization that the certificate is issued to. |
| Issuer | A reference to the entity that signed and issued the certificate. The reference is available if the issued certificate is a part of the same payload. |
| Root Issuer | A reference to the root certificate. The reference is available if the issued certificate is a part of the same payload. |
| Subject alternative name | The name of the certificate domain record. |
[ ]

{#aws-certificate-manager-discovery-pattern__table_w2j_l53_2nb}

## CI relationships {#aws-certificate-manager-discovery-pattern__section_s3r_15ss_52b}

The Amazon AWS - Certificates Manager pattern and Amazon AWS - Collect Certificates Tags shared library support the discovery of the following relationships:  
{#aws-certificate-manager-discovery-pattern__table_inw_cvj_wzb__entry__3}

| CI | Relationship | CI |
|-|-|-|
| Unique Certificate​ \[cmdb_ci_certificate\] | Hosts::Hosted on | AWS Datacenter​ \[cmdb_ci_aws_datacenter\] |
| Unique Certificate ​\[cmdb_ci_certificate\]​ | Hosts::Hosted on | Cloud Service Account​ \[cmdb_ci_cloud_service_account\]​ |
| Key Value​ \[cmdb_key_value\]​ | Reference​ | Unique Certificate​ \[cmdb_ci_certificate\]​ |
[ ]

{#aws-certificate-manager-discovery-pattern__table_inw_cvj_wzb}