post AWS Cloud Discovery with ServiceNow's Paris in ITOM blog

AWS Cloud Discovery with ServiceNow's Paris

Harsh Kumar1 — Mon, 12 Oct 2020 04:24:50 GMT

Amazon Web Services (AWS) is a cloud service provided by Amazon.com. AWS enables virtualized computing platforms accessible through the internet. ServiceNow's ITOM Discovery enables you to discover cloud services in AWS. Since the London release of the ServiceNow platform, our AWS Cloud Discovery offering has evolved. The major challenge our customers had with previous releases is that they need to share AWS account credentials to Servicenow for discovery and sharing credentials is a big no-no from a security standpoint. Now with the Paris release of ServiceNow's ITOM, customers can do much more without sharing AWS account credentials. Moreover, customers can do self account discovery, member to member discovery, member to master discovery, cross-organization discovery, and recursive discovery. Also, customers need fewer AWS resources to do the discovery and fewer resources mean less cost and less cost mean more savings for customers.

In this blog, I will explain to you step by step to setup Servicenow and AWS to enable AWS Cloud Discovery with Cross Assume Role and this blog does not cover how our discovery finds AWS resources, Magic..!

Step 1: Setup Servicenow's MID server on one of your EC2 instances or any other resources of your AWS account [eg: Account X ].

Step 2: Create a custom role [ eg: Role X] with the below sample policy/permissions [attached] and assign this to the EC2's IAM profile. Note: The permissions need to be modified to suit needs. E.g. if customers want to add a discovery pattern for getting some other cloud resource types, more permissions would be needed - the attached read/list permissions are typically enough.

Step 3: Create a trust relationship of this custom role [ eg: Role X] in other AWS accounts [ Account Y & Z ] where you want to discover AWS resources. This can be done by creating custom roles [ eg: Role Y & Z ] in other account and by establishing trust relationships from account X [ eg: Role X]

Step 4: Let's make sure the MID server is connected to the ServiceNow instance and validated. Once validated, enable the MID server to assume the role of the discovery by adding this configuration parameter with the value of the custom role [ eg: Role X] that you created. With this setup, you can do self-account discovery.

Step 5: Add AWS accounts to ServiceNow's to Service Accounts [eg: Account X, Y & Z ]. and during the setup add of accounts [ eg: Account Y & Z ] add the accessor account as [eg: Account X ] where the MID server is present.

Step 6: Disclose all the custom roles that you have created in AWS to Servicenow by creating one on one relationship in Cross Assume Role section of Servicenow, [ eg: Role Y & Z ] mapped to [ eg: Account Y & Z ]

Step 7: Go to Discovery Schedule to trigger a Cloud Discovery for accounts [ eg: Account X, Y or Z ].

You are all set to do the AWS cloud Discovery in accounts [ eg: Account X, Y & Z ] without sharing credentials to Servicenow, isn't that magic. This solution is an industry first and available on ServiceNow's ITOM.

More details can be found here...

AWS Cloud Discovery

Cloud Discovery Setup (AWS) - New York

Re: AWS Cloud Discovery with ServiceNow's Paris

Vivektietsood — Mon, 19 Oct 2020 16:44:16 GMT

https://community.servicenow.com/community?id=community_article&sys_id=59924273dbac941023f4a345ca961984

Thanks. nice article. I created a similar article.

Re: AWS Cloud Discovery with ServiceNow's Paris

Kiran Venkatesa — Wed, 11 Nov 2020 05:43:29 GMT

Thanks Harsha. Here is how am planning to use it, summarizing it for everyone's benefit and let me know if you see any issues.

Install MID-Server on a EC2 instance part of a VPC, let us say in AWS Account "NSOC"
The VPC should be attached to Transit Gateway
Create a custom role Role CMDBDiscoveryMidServerRole with AmazonEC2FullAccess permission and assign this to the EC2's IAM profile.
Create a trust relationship of this custom role in other AWS accounts where we want to discover AWS resources. This can be done by creating custom role [CMDBDiscoveryRole ] in other account and by establishing trust relationships from account NSOC [Role CMDBDiscoveryMidServerRole].
Validate the MID-Server and is connected to SNOW SaaS
Once validated, enable the MID-Server to assume the role of the discovery by adding this configuration parameter (mid.aws.instance.profile.name) with the value of the custom role [CMDBDiscoveryMidServerRole] that we created. With this setup, we can do self account discovery of the NSOC AWS Account.
Now, create Service Accounts for all AWS Accounts (NSOC, other accounts) that is attached to the TGW and accessible via the NSOC MID-Server.
When creating other service accounts, add the accessor account as "NSOC" account where the MID Server is present
Disclose all the custom roles that you have created in AWS to Servicenow by creating one on one relationship in Cross Assume Role section of Servicenow, [ CMDBDiscoveryRole ] mapped to [ eg: other AWS Accounts ]
Now, go ahead and create Discovery schedule and trigger discovery for NSOC and other AWS Accounts.

Re: AWS Cloud Discovery with ServiceNow's Paris

Marca — Sun, 02 May 2021 17:54:03 GMT

Hi @Harsh Kumar

Thanks for putting together this step-by-step guide.

I am trying to set up AWS Discovery with a single AWS account as a POC. The organization has multiple AWS accounts but at this point I am just trying to discover a single member(?) account.

I don't have access to Access Key ID & Secret Access Key to create credentials and still want to use the new IAM role based access. How should I go about creating the Service Account (step 5 & 6) in this case?
I created the service account with just the Account Name, Account ID and Datacenter type. No parent, no accessor account, no master account. But this fails with the following error:

AWS was not able to validate the provided access credentials (Service: AmazonEC2; Status Code: 401; Error Code: AuthFailure; Request ID:

Any help on this is much appreciated,
Thank you

Re: AWS Cloud Discovery with ServiceNow's Paris

stephchif — Tue, 22 Feb 2022 14:27:57 GMT

I love that you've shared this information. It could be useful for many managers who have to deal with this kind of problem. Nowadays, many companies are using different cloud services to stock their information and give access to the database to all employees. I love this tendency as I have tried it myself with https://www.clearscale.com/services/cloud-migration, and this type of modernization in companies makes the work a lot easier and gives it a lot of new opportunities. I hope more companies will start introducing this system in their work because it would help a lot in saving the information.