Setting up AWS service accounts

Create and configure cloud service accounts at ServiceNow AI Platform for the corresponding Amazon Web Services (AWS) service accounts.

Verify the REST API Permissions

Download the Cloud Discovery patterns spreadsheet so you can grant user permissions required for running the Discovery patterns. In addition to permissions, the spreadsheet also includes useful information such as pattern names, types, CI Classes, and links to vendor documentation. New patterns are available quarterly, so check periodically to be sure you have the latest version of the spreadsheet.

Ensure that you are familiar with the hierarchy of AWS service accounts in your environment. For example, if there are AWS Organizations, set up the management and member accounts at ServiceNow AI Platform to reflect that hierarchy. You can set up the AWS service accounts of the following types:

• Discrete account: Standalone account, with no management account.

• Management account: Management account that may or may not contain member accounts (subaccounts).

  Note: Some ServiceNow UI screens may refer to management accounts as master accounts.

• Member account: Subaccount that belongs with the (management) account.

• Access setup for AWS service accounts
  Cloud Discovery and Cloud Provisioning and Governance need access to resources in the Amazon Web Services (AWS) service accounts. Learn about different methods of configuring such access.

• Configure access to the AWS accounts using permanent AWS credentials
  To securely access data on your provider account, the Discovery process must present appropriate credentials. To make the credentials available to Discovery and Cloud Provisioning and Governance, you first create a user with programmatic access in the AWS Management Console. You then securely store the credentials in a service account at ServiceNow AI Platform.
• Create AWS service accounts
  Create AWS service accounts on the ServiceNow AI Platform to access your AWS account during AWS discovery.
• Configure temporary credential access for trusted AWS accounts
  Configure the trusting account whose resources need to be accessed, to rely on the trusted account using the Identity and Access Management (IAM) role.
• Configure credential-less access using trusted AWS accounts
  Set up a trusted credential-less account that other AWS accounts can rely on for access.
• Configure access for trusting AWS member accounts in trust chain
  Configure access for AWS member accounts by using a trust chain from the accessor through the management account.
• Configure the MID Server for AWS IAM roles
  Configure the MID Server to retrieve the temporary security credentials associated with an IAM role.
• Control AWS access and permissions using policies
  Configure policies with the necessary level of permissions to provide access to the AWS resources for Cloud Discovery and Cloud Provisioning and Governance.

Parent Topic:Set up a cloud service account