Setup AWS service accounts

Create and configure cloud service accounts at ServiceNow AI Platform for the corresponding Amazon Web Services (AWS) service accounts.

Verify the REST API permissions

Download the Cloud Discovery patterns spreadsheet so you can grant user permissions required for running the Discovery patterns. In addition to permissions, the spreadsheet also includes useful information such as pattern names, types, CI Classes, and links to vendor documentation. New patterns are available quarterly, so check periodically to be sure you have the latest version of the spreadsheet.

Ensure that you are familiar with the hierarchy of AWS service accounts in your environment. For example, if there are AWS Organizations, set up the management and member accounts at ServiceNow AI Platform to reflect that hierarchy. You can set up the AWS service accounts of the following types:

• Discrete account: Standalone account, with no management account.

• Management account: Management account that may or may not contain member accounts (subaccounts).

• Member account: Subaccount that belongs to the management account.

Account terminology in the UI

Some screens in the ServiceNow UI use different labels for the same account types. Use the following table to map UI labels to the terms used in this documentation.

UI label Term used in this documentation Master Management account Parent account Management account field Sub-account Member account

Set up AWS Discovery

After you understand the account hierarchy in your environment, complete the following steps to set up AWS Discovery:

1. Install and configure the MID Server. For more information, see Install and configure MID Servers to access cloud environments.

2. Configure the required IAM permissions. For more information, see Control AWS access and permissions using policies.

3. Choose an access method and configure credentials. For more information, see Access setup for AWS service accounts.

4. Create the AWS service account on the platform. For more information, see Create AWS service accounts.

5. Access setup for AWS service accounts
   Cloud Discovery and Cloud Provisioning and Governance need access to resources in the Amazon Web Services (AWS) service accounts. Learn about different methods of configuring such access.

6. Configure access to the AWS accounts using permanent AWS credentials
   To securely access data on your provider account, the Discovery process must present appropriate credentials. To make the credentials available to Discovery and Cloud Provisioning and Governance, you first create a user with programmatic access in the AWS Management Console. You then securely store the credentials in a service account at ServiceNow AI Platform.

7. Create AWS service accounts
   Create AWS service accounts on the ServiceNow AI Platform to access your AWS account during AWS discovery.

8. Configure temporary credential access for trusted AWS accounts
   Configure the trusting account whose resources need to be accessed, to rely on the trusted account using the Identity and Access Management (IAM) role.

9. Configure credential-less access using trusted AWS accounts
   Set up a trusted credential-less account that other AWS accounts can rely on for access.

10. Configure access for trusting AWS member accounts in trust chain
    Configure access for AWS member accounts by using a trust chain from the accessor through the management account.

11. Configure the MID Server for AWS IAM roles
    Configure the MID Server to retrieve the temporary security credentials associated with an IAM role.

12. Control AWS access and permissions using policies
    Configure policies with the necessary level of permissions to provide access to the AWS resources for Cloud Discovery and Cloud Provisioning and Governance.

Parent Topic:Set up a cloud service account