Question: ServiceNow AWS Integration – Difference Between OrgAssumeRole and Cross-Assume role

[AvinashU]

Hi Community,

I am working on integrating ServiceNow with AWS and would like to understand the recommended approach for AWS Organizations and cross AssumeRole setup.

I have some questions regarding the difference and implementation of the following approaches:

1. What is the difference between Accessor Role, OrgAssumeRole, and Cross-Account AssumeRole?
   • What is the purpose of each role?
   • In which AWS account should each role be created?
   • How does the trust relationship work between ServiceNow, Accessor Role, and member accounts?
2. ServiceNow Cloud Account configuration
   • If we use AWS Organizations with OrgAssumeRole:
     • How do we configure the AWS Cloud Account in ServiceNow?
     • Do we need to create a manual Cloud Account record?
     • What role ARN should be configured in ServiceNow?
     • Is one Cloud Account enough to discover all member accounts?
3. AWS Discovery scope
   • If we use OrgAssumeRole:
     • Can ServiceNow discover all member accounts automatically?
     • How do we restrict discovery to only a specific AWS member account?
     • What is the recommended configuration for discovering multiple AWS accounts?

4. Comparison between approaches

   Option 1: AWS Organizations + OrgAssumeRole

   ServiceNow → Accessor Role → OrgAssumeRole → Member Accounts

   Option 2: Cross-account AssumeRole

   ServiceNow → Role in each AWS Account

   What are the advantages and disadvantages of each approach from a ServiceNow Cloud Discovery perspective?

5. Manual Cloud Account creation
   • If we choose AWS Organizations/OrgAssumeRole, should we manually create Cloud Accounts in ServiceNow for each AWS member account?
   • Or does ServiceNow automatically create/manage member accounts after organization discovery?
6. Best practice recommendation
   • For an enterprise AWS Organization with multiple member accounts, what is the recommended ServiceNow setup:
     • OrgAssumeRole?
     • Cross-account roles?
     • ServiceNow AWS Service Management Connector?
     • Cloud Discovery?

Any examples, architecture diagrams, or implementation experience would be highly appreciated.

Thanks!