How to Remove/Add New/Old Cloud Service Account in AWS Cloud Discovery Job

[balaji_prusty1]

Hi All,

We have configured AWS Cloud Discovery in our organisation and it is working fine. Now I need to remove some Old Cloud Service Accounts which have already been added to the current Cloud discovery job to discover. Like Other discovery jobs (CI Based) we are removed from the Discovery Range but for the cloud, I am not finding any option to remove the configured Service Account.  Only I can see the Cloud Service Account (cmdb_ci_cloud_service_account) where we define the master and child.

Can someone please help with this?

Thanks

Balaji

[Ram Devanathan1]

you can set up deny rules for these accounts in your IAM permissions - that way the service account will not pick it up. there's no filter or so today.

[balaji_prusty1]

Thanks, Ram for the Quick and prompt response. 

Still, I doubt, why ServiceNow is providing the option to select which region/account needs to be discovered while creating the AWS Cloud Discovery job if it will pull all the AC from the AWS console. 

Thanks

Balaji Prusty

[Ram Devanathan1]

Hi Balaji, I am the Product Manager for the product - the feature is well known to me.

sure you can do this too.

the reason i didn't suggest it is - next time on if another account needs to be filtered out or becomes non-operational, you will have to come back to this configuration and manually update it.

[balaji_prusty1]

Hi Ram,

Thanks for helping me with this, Yes Sir I know you and met last time in the Bangalore office during the ITOM seminar last month.

Instead of denying the policy, we have removed/deleted the IAM roles for that AC which is not needed from the AWS console but still it is fetching/updating in ServiceNow.

Also as I mentioned in my previous conversion, I already tried to remove from Discovery Job as below. But no luck. Need to fix this issue today due to the license cost issue. If you have any document related to removing from the ServiceNow Discovery job please provide it. Meantime I am going to raise a vendor ticket for the same.

Thanks

Balaji Prusty

[Ram Devanathan1]

The account is not charged as a CI. only resources like VM, Database etc present in each account is charged. You have setup trust from child account to the parent account so the master is allowed to assume role to the child - here for these specific member accounts you can set deny rules maybe for these accounts so the 'assume-role' does not happen, then discovery also won't be done for these. try that.

in any case, please share case ID with me once you log it.

Ram