Refresh member accounts fails with 'Failed running "Amazon AWS Organizations" pattern. Please check Pattern Log for more information'

[Stuart26]

Hi,

I've just built a new mid server in our AWS cloud and tried to discover cloud. When I click on Refresh Member Accounts I get this error:

The pattern log looks like this:

The pattern log text is below. I've verified that the IAM credentials I have work using AWS Powershell on the mid server (AWS powershell also returns data from the get-accountlist command). Any help identifying why the mid server is returning an error would be appreciated.

{
  "name" : "Discovery Log",
  "status" : "FAILURE",
  "children" : [ {
    "name" : "Pre Pattern Execution",
    "id" : "pre_pattern_execution_script",
    "status" : "SUCCESS",
    "level" : 2,
    "messages" : [ {
      "message" : "2019-10-30 17:09:01: Getting pre pattern execution data generated by script."
    }, {
      "message" : "2019-10-30 17:09:01: setAttribute(serviceAccountId,<<REDACTED>>)",
      "severity" : "DEBUG"
    }, {
      "message" : "2019-10-30 17:09:01: setAttribute(credentialSysId,<<REDACTED>>)",
      "severity" : "DEBUG"
    }, {
      "message" : "2019-10-30 17:09:01: Getting pre pattern execution data generated by script."
    }, {
      "message" : "2019-10-30 17:09:01: setAttribute(serviceAccountId,<<REDACTED>>)",
      "severity" : "DEBUG"
    }, {
      "message" : "2019-10-30 17:09:01: setAttribute(credentialSysId,<<REDACTED>>)",
      "severity" : "DEBUG"
    } ],
    "type" : "NONE"
  }, {
    "name" : "Selecting Pattern for Execution",
    "id" : "set_pattern_name",
    "status" : "SUCCESS",
    "level" : 2,
    "messages" : [ {
      "message" : "2019-10-30 17:09:01: Pattern: Amazon AWS Organizations"
    }, {
      "message" : "2019-10-30 17:09:01: setAttribute(pattern,Amazon AWS Organizations)",
      "severity" : "DEBUG"
    }, {
      "message" : "2019-10-30 17:09:01: Pattern: Amazon AWS Organizations"
    }, {
      "message" : "2019-10-30 17:09:01: setAttribute(pattern,Amazon AWS Organizations)",
      "severity" : "DEBUG"
    } ],
    "type" : "NONE"
  }, {
    "name" : "Identification for Organizations",
    "status" : "GRACEFUL_TERMINATION",
    "children" : [ {
      "name" : "Get discovery type",
      "status" : "SUCCESS",
      "level" : 3,
      "messages" : [ {
        "message" : "2019-10-30 17:09:01: setAttribute(hd_or_td,horizontal)",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: Execution time: 0 ms",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: setAttribute(hd_or_td,horizontal)",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: Execution time: 0 ms",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: Execution time: 0 ms",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: setAttribute(service_account,[{discovery_credentials=<<REDACTED>>}])",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: Execution time: 0 ms",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: setAttribute(headers,X-Amz-Target:AWSOrganizationsV20161128.DescribeOrganization,Content-Type:application/x-amz-json-1.1,Accept:application/json)",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: setAttribute(method,POST)",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: setAttribute(formatted,false)",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: setAttribute(body,{})",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: setAttribute(url,https://organizations.us-east-1.amazonaws.com/)",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:04: Execution time: 3188 ms",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:04: Execution time: 0 ms",
        "severity" : "DEBUG"
      } ],
      "type" : "STEP_TYPE"
    }, {
      "name" : "Match HD is running",
      "status" : "SUCCESS",
      "level" : 3,
      "messages" : [ {
        "message" : "2019-10-30 17:09:01: Execution time: 0 ms",
        "severity" : "DEBUG"
      } ],
      "type" : "STEP_TYPE"
    }, {
      "name" : "Create Service Account table",
      "status" : "SUCCESS",
      "level" : 3,
      "messages" : [ {
        "message" : "2019-10-30 17:09:01: setAttribute(service_account,[{discovery_credentials=<<REDACTED>>}])",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: Execution time: 0 ms",
        "severity" : "DEBUG"
      } ],
      "type" : "STEP_TYPE"
    }, {
      "name" : "Get Master Account ID",
      "status" : "SUCCESS",
      "level" : 3,
      "messages" : [ {
        "message" : "2019-10-30 17:09:01: setAttribute(headers,X-Amz-Target:AWSOrganizationsV20161128.DescribeOrganization,Content-Type:application/x-amz-json-1.1,Accept:application/json)",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: setAttribute(method,POST)",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: setAttribute(formatted,false)",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: setAttribute(body,{})",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:01: setAttribute(url,https://organizations.us-east-1.amazonaws.com/)",
        "severity" : "DEBUG"
      }, {
        "message" : "2019-10-30 17:09:04: Execution time: 3188 ms",
        "severity" : "DEBUG"
      } ],
      "type" : "STEP_TYPE"
    }, {
      "name" : "Match master account",
      "status" : "GRACEFUL_TERMINATION",
      "level" : 3,
      "messages" : [ {
        "message" : "2019-10-30 17:09:04: Execution time: 0 ms",
        "severity" : "DEBUG"
      } ],
      "type" : "STEP_TYPE"
    } ],
    "level" : 2,
    "type" : "IDENTIFICATION_SECTION_TYPE"
  } ],
  "level" : 0,
  "messages" : [ {
    "message" : "2019-10-30 17:09:01: Task is running on MID server <<REDACTED>>",
    "severity" : "DEBUG"
  }, {
    "message" : "2019-10-30 17:09:01: setAttribute(cmdb_ci_cloud_service_account,[{}])",
    "severity" : "DEBUG"
  }, {
    "message" : "2019-10-30 17:09:01: setAttribute(cmdb_ci_cloud_service_account,[{}])",
    "severity" : "DEBUG"
  }, {
    "message" : "2019-10-30 17:09:01: setAttribute(cmdb_ci_cloud_service_account,[{}])",
    "severity" : "DEBUG"
  }, {
    "message" : "2019-10-30 17:09:01: setAttribute(cmdb_ci_cloud_service_account,[{}])",
    "severity" : "DEBUG"
  }, {
    "message" : "2019-10-30 17:09:01: Task is running on MID server <<REDACTED>>",
    "severity" : "DEBUG"
  }, {
    "message" : "2019-10-30 17:09:01: setAttribute(cmdb_ci_cloud_service_account,[{}])",
    "severity" : "DEBUG"
  }, {
    "message" : "2019-10-30 17:09:01: setAttribute(cmdb_ci_cloud_service_account,[{}])",
    "severity" : "DEBUG"
  }, {
    "message" : "2019-10-30 17:09:01: setAttribute(cmdb_ci_cloud_service_account,[{}])",
    "severity" : "DEBUG"
  }, {
    "message" : "2019-10-30 17:09:01: setAttribute(cmdb_ci_cloud_service_account,[{}])",
    "severity" : "DEBUG"
  } ],
  "type" : "NONE"
}

[Varshith Kuraga]

Hi,

Please see this https://community.servicenow.com/community?id=community_question&sys_id=c7851f58db6d3f4013b5fb243996...

[Stuart26]

Thanks Varshith - I had seen this before and checked it. The AWS account was also used in my test environment and worked sucessfully there, so I'm reasonably confident that the AWS creds are correct.

[Varshith Kuraga]

I believe its not because of credentials. It is because of permission policy. Your AWS team should give Assume role to the master aws account 

See this:

https://hi.service-now.com/kb_view.do?sysparm_article=KB0755210

[Stuart26]

It is the same AWS credentials and policy that works sucessfully in my non-prod environment.