{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":29941,"path":"it-operations-management/discovery-and-service-mapping-patterns/aws-s3-discovery.md","title":"Amazon Simple Storage Service \\(Amazon S3\\) discovery with Patterns","bundle":null,"doc_type":null,"release":"australia","body":"\n# Amazon Simple Storage Service \\(Amazon S3\\) discovery with Patterns\n\nThe ServiceNow Discovery application uses the Amazon AWS S3 pattern to find public and non-public storage buckets of Amazon Simple Storage Service. The pattern uses a set of REST API calls to find these resources. Discovering some of these resources might require updating to the latest version of the Discovery and Service Mapping Patterns application from the ServiceNow Store.\n\nIn addition to the discovery schedule, the ServiceNow instance triggers the Amazon AWS S3 pattern when AWS Config sends an event to the ServiceNow instance. Config is a service that continuously monitors AWS resources and sends events to the ServiceNow every time it senses that a resource configuration has changed.\n\nAmazon AWS S3 pattern can also discover AWS S3 buckets located in the AWS GovCloud \\(US\\) region. For AWS S3 located in the AWS GovCloud \\(SU\\), the pattern cannot discover AWS S3 outgoing connections to other cloud resources like Lambda function. Discovery of outgoing connections for AWS S3 will be supported in future releases.\n\nYou can use this pattern on the ServiceNow platform using Jakarta Patch 10, Kingston Patch 8, or London Patch 1.\n\n## Request apps on the Store\n\nVisit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/r/store-release-notes/sn-store-release-notes.html).\n\n## Prerequisites\n\n-   If you use Identity and Access Management \\(IAM\\) to manage users in Amazon Web Services \\(AWS\\) platform, ensure that you created a user policy for the AWS user. For more information, refer to Create an IAM user policy for Cloud Provisioning and Governance in the ServiceNow Cloud Provisioning and Governance documentation.\n-   Configure the AWS service account.\n-   Configure AWS credentials, using a secret key and an access key.\n-   AmazonS3ReadOnlyAccess policy user permissions.\n-   Discover Logical Datacenters hosting S3 buckets as described in Run Discovery on an AWS cloud service account in the ServiceNow Cloud Provisioning and Governance documentation.\n-   Create a schedule for the relevant AWS service account as described in Schedule Discovery on a service account in the ServiceNow Cloud Provisioning and Governance documentation.\n-   To enable alert-based discovery, configure the AWS event service as described in Set up AWS event processing for Discovery and Service Mapping in the ServiceNow Cloud Provisioning and Governance documentation.\n-   For Cloud Discovery, download the Discovery and Service Mapping Patterns from the ServiceNow Store.\n-   When installing the MID Server, ensure that the host machine meets or exceeds the [MID Server system requirements](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/servicenow-platform/r_MIDServerSystemRequirements.md) published on the ServiceNow documentation site.\n\n## Verify the REST API permissions\n\nDownload the [Cloud Discovery patterns spreadsheet](https://downloads.docs.servicenow.com/resource/enus/api/servicenow-discovery-patterns-api-details.xlsx) so you can grant user permissions required for running the Discovery patterns. In addition to permissions, the spreadsheet also includes useful information such as pattern names, types, CI Classes, and links to vendor documentation. New patterns are available quarterly, so check periodically to be sure you have the latest version of the spreadsheet.\n\n**Note:** You can test the AWS REST APIs using Postman API platform. For more information, see the [How to test AWS REST API using POSTMAN \\[KB0782183\\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0782183) article in the Now Support Knowledge Base.\n\n## Data collected by Discovery during horizontal discovery\n\n<table id=\"table_td3_psz_42b\"><thead><tr><th>\n\nTable and field\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td colspan=\"2\">\n\nCloud Object Storage \\[cmdb\\_ci\\_cloud\\_object\\_storage\\]\n\n</td></tr><tr><td>\n\nBucket name \\[bucket\\_name\\]\n\n</td><td>\n\nThe name of the AWS S3 bucket. You can discover all buckets hosted on a Logical Datacenter during one discovery process.\n\n</td></tr><tr><td>\n\nCreation date \\[creation date\\]\n\n</td><td>\n\nCreation date of the AWS S3 bucket.\n\n</td></tr><tr><td>\n\nCloud provider \\[cloud\\_provider\\]\n\n</td><td>\n\nAmazon AWS\n\n</td></tr><tr><td>\n\nObject ID \\[object\\_id\\]\n\n</td><td>\n\nThe Amazon Resource Name \\(ARN\\), expressed in this format: **arn:aws:s3:::&lt;bucket name&gt;**\n\n</td></tr><tr><td>\n\nService name \\[service\\_name\\]\n\n</td><td>\n\nSet to **S3** by default.\n\n</td></tr><tr><td>\n\nOwner \\[owner\\]\n\n</td><td>\n\nAccount ID in which the bucket exists.\n\n</td></tr><tr><td>\n\nEncryption type \\[encryption\\_type\\]\n\n</td><td>\n\nType of encryption for this bucket. The choices are:-   None\n-   AES-256\n-   AWS-KMS\n\n</td></tr><tr><td>\n\nACL access type \\[acl\\_access\\_type\\]\n\n</td><td>\n\nThe choices for access control types are:-   Public\n-   Not Public\n\n</td></tr><tr><td>\n\nPolicy access type \\[policy\\_access\\_type\\]\n\n</td><td>\n\nThe choices for policy access types are:-   Public\n-   Not Public\n\n</td></tr><tr><td>\n\nReplication destination \\[replication\\_destination\\]\n\n</td><td>\n\nBucket ARN of the Replication Destination bucket.\n\n</td></tr></tbody>\n</table>**Note:** In Discovery and Service Mapping Patterns versions before 1.30.2, the Owner field displays the bucket owner's name.\n\nOn the Dependency Views map you can see all discovered S3 buckets in your organization, including S3 buckets that you configured as replicas. In this example, Cloud Object Storage 1, Cloud Object Storage 2, and Cloud Object Storage 3 replicate Cloud Object Storage 2. In its turn, Cloud Object Storage 2 replicates Cloud Object Storage 1.\n\n\\[Omitted image \"AWS-S3-dependency-views.png\"\\] Alt text: Result of horizontal discovery of AWS S3 as appears in Dependency Views\n\n## CI relationships\n\nThese relationships are created to support AWS S3 discovery:\n\n|CI|Relationship|CI|\n|---|------------|---|\n|cmdb\\_ci\\_cloud\\_object\\_storage|Replicates to::Replicated By|cmdb\\_ci\\_cloud\\_object\\_storage|\n|cmdb\\_ci\\_cloud\\_object\\_storage|Hosted on::Hosts|cmdb\\_ci\\_logical\\_datacenter|\n\n## Data discovered by Service Mapping during top-down discovery\n\nService Mapping can discover AWS S3 outgoing connections to cloud resources, for example Lambda function.\n\n\\[Omitted image \"AWS-S3-top-down-map.png\"\\] Alt text: Service Mapping map showing a service with discovered S3 buckets.\n\n## Troubleshooting\n\nIf the mapping process does not proceed as you expected, follow the following suggestions.\n\n<table id=\"table_ggn_ypj_yhb\"><thead><tr><th>\n\nSymptom\n\n</th><th>\n\nCause\n\n</th><th>\n\nSolution\n\n</th></tr></thead><tbody><tr><td>\n\nDiscovery fails. The discovery message contains the information about an error caused by the REST timeout.\n\n</td><td>\n\nThere are many CIs sending the REST call response in the deployment. The MID Server cannot process the REST call response without exceeding the time limit controlled by the **mid.sa.cloud.request\\_timeout** parameter.\n\n</td><td>\n\nBy default, the **mid.sa.cloud.request\\_timeout** parameter is set to 30000 milliseconds. Increase the value of this parameter on the relevant MID Server and run discovery again.\n\n**Note:** If the **Configuration Parameters** related list for the relevant MID Server does not show this parameter, you may need to add it.\n\n</td></tr><tr><td>\n\nPattern Designer fails during a debug session. The Pattern Designer message contains information about an error caused by a timeout.\n\n</td><td>\n\nThe Pattern Designer fails because of a timeout during pattern debugging \\(and not during discovery\\).\n\n</td><td>\n\nBy default, the **sa.debugger.max\\_timeout**parameter is set to 240 seconds.Increase the value of this parameter on the relevant MID Server.\n\n</td></tr></tbody>\n</table>**Parent Topic:**[AWS discovery using patterns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/discovery-and-service-mapping-patterns/data-discovered-aws-patterns.md)\n\n"}}