{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":31603,"path":"it-operations-management/setup-aws-service-accounts.md","title":"Setup AWS service accounts","bundle":null,"doc_type":null,"release":"australia","body":"\n# Setup AWS service accounts\n\nCreate and configure cloud service accounts at ServiceNow AI Platform for the corresponding Amazon Web Services \\(AWS\\) service accounts.\n\n## Verify the REST API permissions\n\nDownload the [Cloud Discovery patterns spreadsheet](https://downloads.docs.servicenow.com/resource/enus/api/servicenow-discovery-patterns-api-details.xlsx) so you can grant user permissions required for running the Discovery patterns. In addition to permissions, the spreadsheet also includes useful information such as pattern names, types, CI Classes, and links to vendor documentation. New patterns are available quarterly, so check periodically to be sure you have the latest version of the spreadsheet.\n\nEnsure that you are familiar with the hierarchy of AWS service accounts in your environment. For example, if there are AWS Organizations, set up the management and member accounts at ServiceNow AI Platform to reflect that hierarchy. You can set up the AWS service accounts of the following types:\n\n-   **Discrete account**: Standalone account, with no management account.\n-   **Management account**: Management account that may or may not contain member accounts \\(subaccounts\\).\n-   **Member account**: Subaccount that belongs to the management account.\n\n## Account terminology in the UI\n\nSome screens in the ServiceNow UI use different labels for the same account types. Use the following table to map UI labels to the terms used in this documentation.\n\n|UI label|Term used in this documentation|\n|--------|-------------------------------|\n|**Master**|Management account|\n|**Parent account**|Management account field|\n|**Sub-account**|Member account|\n\n## Set up AWS Discovery\n\nAfter you understand the account hierarchy in your environment, complete the following steps to set up AWS Discovery:\n\n1.  Install and configure the MID Server. For more information, see [Install and configure MID Servers to access cloud environments](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/mid-server-configuration-cloud.md).\n2.  Configure the required IAM permissions. For more information, see [Control AWS access and permissions using policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/aws-create-user-policy-cloud-mgt.md).\n3.  Choose an access method and configure credentials. For more information, see [Access setup for AWS service accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/access-aws-accounts.md).\n4.  Create the AWS service account on the platform. For more information, see [Create AWS service accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/create-aws-service-accounts.md).\n\n-   **[Access setup for AWS service accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/access-aws-accounts.md)**  \nCloud Discovery and Cloud Provisioning and Governance need access to resources in the Amazon Web Services \\(AWS\\) service accounts. Learn about different methods of configuring such access.\n-   **[Configure access to the AWS accounts using permanent AWS credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/aws-create-creds-cloud-mgt.md)**  \nTo securely access data on your provider account, the Discovery process must present appropriate credentials. To make the credentials available to Discovery and Cloud Provisioning and Governance, you first create a user with programmatic access in the AWS Management Console. You then securely store the credentials in a service account at ServiceNow AI Platform.\n-   **[Create AWS service accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/create-aws-service-accounts.md)**  \nCreate AWS service accounts on the ServiceNow AI Platform to access your AWS account during AWS discovery.\n-   **[Configure temporary credential access for trusted AWS accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/configure-iam-role-aws-account.md)**  \nConfigure the trusting account whose resources need to be accessed, to rely on the trusted account using the Identity and Access Management \\(IAM\\) role.\n-   **[Configure credential-less access using trusted AWS accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/aws-trusted-credential-less.md)**  \nSet up a trusted credential-less account that other AWS accounts can rely on for access.\n-   **[Configure access for trusting AWS member accounts in trust chain](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/configure-iam-role-aws-member.md)**  \nConfigure access for AWS member accounts by using a trust chain from the accessor through the management account.\n-   **[Configure the MID Server for AWS IAM roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/config-mid-iam-roles.md)**  \nConfigure the MID Server to retrieve the temporary security credentials associated with an IAM role.\n-   **[Control AWS access and permissions using policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/aws-create-user-policy-cloud-mgt.md)**  \nConfigure policies with the necessary level of permissions to provide access to the AWS resources for Cloud Discovery and Cloud Provisioning and Governance.\n\n**Parent Topic:**[Set up a cloud service account](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/setup-cloud-service-account.md)\n\n"}}