---
sourceDocument: Yokohama ServiceNow AI Platform Capabilities
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/servicenow-platform

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama ServiceNow AI Platform Capabilities

ft:clusterId :

    - platcap

bundleId :

    - platcap

workflow :

    - Platform


---

# Executing scripts required for setting up AWS

# Executing scripts required for setting up AWS {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Executing scripts required for setting up AWS

To set up the AWS environment for importing configuration items (CIs) data into the ServiceNow CMDB using the Service Graph Connector for AWS, you must execute specific AWS scripts provided with the connector.
These scripts configure AWS resources and are categorized based on setup requirements: basic environment configuration, deep discovery for EC2 instances, and Amazon EKS cluster setup.
Completing prerequisite steps before executing these scripts is essential.
Show full answer Show less  

## Basic Scripts

Basic scripts configure the AWS environment to enable data import through the connector. Execution typically involves creating AWS CloudFormation stacks or StackSets in management or member accounts. Key scripts include:

* **EnableAWSConfig.yml:** Enables AWS Config recorder across accounts and regions.
* **CreateServiceNowUser.yml:** Creates the ServiceNow IAM user with specified usernames and roles.
* **CreateSnowOrganizationAccountAccessRoleInMemberAccount.yml:** Sets up read-only IAM policies, roles, and groups for the ServiceNow IAM user across accounts.
* **SnowDesignatedAccountAccessRoleInManagementAccount.yml:** Creates the ServiceNow IAM role in the management account when the IAM user exists in a member account.
* **AWS-SystemsManager-AutomationExecutionRole.yml and AWS-SystemsManager-AutomationAdministrationRole.yml:** Provision roles necessary for AWS Systems Manager Automation across accounts.

## Deep Discovery Scripts

Use these scripts only if deep discovery on Amazon EC2 instances is required. They enable detailed data collection from EC2 instances by creating IAM roles and AWS Systems Manager (SSM) documents:

* **AmazonSSMForInstancesRoleSetup.yml:** Creates an IAM instance profile role attached to EC2 instances, referencing an S3 bucket for collected data.
* **SG-AWS-RunShellScript-Setup.yml:** Creates SSM documents to fetch middleware and application version details from Linux EC2 instances.
* **SG-AWS-RunPowerShellScript-Setup.yml:** Creates SSM documents for gathering deep discovery data from Windows EC2 instances.

## Amazon EKS Scripts

Execute these scripts only if managing Amazon Elastic Kubernetes Service (EKS) clusters is necessary. They create AWS SSM documents for discovery and data collection related to Kubernetes components:

* **SG-AWS-RunKubeCtlEKSNamesShellScript.yml:** Discovers EKS clusters associated with EC2 Bastion hosts.
* **SG-AWS-RunKubeCtlShellScript.yml:** Fetches CIs related to Kubernetes pods, services, and deployments from EKS clusters.

Both scripts require execution across relevant AWS accounts and regions via CloudFormation StackSets.  
You must execute scripts provided with the Service Graph Connector for AWS to set up the AWS environment for importing data.  
Important:  
Before executing an AWS script, ensure that you have completed the prerequisites. See [Prerequisites for executing scripts](https://www.servicenow.com/docs/O~0rI97KStc7cSAVXm8xgw#sgc-cmdb-aws-scripts-prereq "Complete the prerequisites before you execute the AWS scripts.").

The AWS scripts provided with the connector configure AWS resources to import the configuration items (CIs) data into the CMDB. To learn more, see [AWS resources used by the Service Graph Connector for AWS](https://www.servicenow.com/docs/~QrKQzACRBjNtCmue550kA "Get familiar with the AWS concepts to learn how the Service Graph Connector for AWS is integrated with Amazon Web Services (AWS).").

Based on the AWS environment requirements, the scripts provided with the Service Graph Connector for AWS are categorized as described in the following table.

|-|-|-|
| [Basic scripts Scripts for configuring the AWS environment to import data by using the connector.](https://www.servicenow.com/docs/QjFh4h__b_2N_aCCbqfQvQ#sgc-cmdb-aws-script-op__section_vfh_wyf_4zb) | [Deep discovery scripts Scripts for setting up deep discovery on Amazon Elastic Compute Cloud (Amazon EC2) instances.](https://www.servicenow.com/docs/QjFh4h__b_2N_aCCbqfQvQ#sgc-cmdb-aws-script-op__section_ahc_jwf_4zb) | [Amazon EKS scripts Scripts for setting up Amazon Elastic Kubernetes Service (EKS) clusters.](https://www.servicenow.com/docs/QjFh4h__b_2N_aCCbqfQvQ#sgc-cmdb-aws-script-op__section_osh_4zf_4zb) |
[ ]

{#sgc-cmdb-aws-script-op__table_w2k_kkm_4zb}

## Basic scripts {#sgc-cmdb-aws-script-op__section_vfh_wyf_4zb}

Use the basic scripts to configure the AWS environment for importing data using the Service Graph Connector for AWS.

The following table describes the basic AWS scripts available with the connector, the input parameters entered when executing a script, the conditions to execute the scripts, and the script execution results.
{#sgc-cmdb-aws-script-op__table_jw4_yyf_4zb__entry__4}

| Script | Input parameters | Execution condition | Result |
|-|-|-|-|
| EnableAWSConfig.yml | None | Execute the script in all the AWS accounts and AWS regions by creating a CloudFormation StackSet in the management account. See [Create a stack set](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create.html) on the AWS documentation site. | Enables the AWS Config recorder. |
| CreateServiceNowUser.yml | SNUserName :   Name of the ServiceNow IAM user that was created as part of the setup. See [Prerequisites for executing scripts](https://www.servicenow.com/docs/O~0rI97KStc7cSAVXm8xgw#sgc-cmdb-aws-scripts-prereq "Complete the prerequisites before you execute the AWS scripts."). Default value: `NOWSGCUser` MbrActRoleName :   Name of the ServiceNow IAM role that was created as part of the setup. See [Prerequisites for executing scripts](https://www.servicenow.com/docs/O~0rI97KStc7cSAVXm8xgw#sgc-cmdb-aws-scripts-prereq "Complete the prerequisites before you execute the AWS scripts."). Default value: `SnowOrganizationAccountAccessRole` | Execute the script by creating a stack either in the management account or in a designated member account. See [Creating a stack on the AWS CloudFormation console](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-create-stack.html) on the AWS documentation site. | Creates the ServiceNow IAM user. |
| CreateSnowOrganizationAccountAccessRoleInMemberAccount.yml | ACNNBR :   Management account ID when the ServiceNow IAM user is in a management account Or Designated member account ID when the ServiceNow IAM user is in a designated member account. S3Bucket :   Amazon S3 bucket name to get the `SendCommand` output. ServiceNowUserName :   Name of the ServiceNow IAM user that was created as part of the setup. See [Prerequisites for executing scripts](https://www.servicenow.com/docs/O~0rI97KStc7cSAVXm8xgw#sgc-cmdb-aws-scripts-prereq "Complete the prerequisites before you execute the AWS scripts."). Default value: `NOWSGCUser` | Execute the script in all the AWS accounts by creating a CloudFormation StackSet in the management account. See [Create a stack set](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create.html) on the AWS documentation site. | Enables read-only IAM policies, roles, and groups for the ServiceNow IAM user. |
| SnowDesignatedAccountAccessRoleInManagementAccount.yml | MEMBERACTNBR :   Member account ID where the ServiceNow IAM user was created. | Execute the script by creating a stack in the management account. See [Creating a stack on the AWS CloudFormation console](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-create-stack.html) on the AWS documentation site. Note: Use the `SnowDesignatedAccountAccessRoleInManagementAccount.yml` script only when the ServiceNow IAM user was created in a member account. | Creates the ServiceNow IAM role in the management account. |
| AWS-SystemsManager-AutomationExecutionRole.yml | None | Execute the script in all the AWS accounts by creating a CloudFormation StackSet in the management account. See [Create a stack set](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create.html) on the AWS documentation site. | Provisions the execution role necessary to run automations in member accounts. A prerequisite for configuring Systems Manager Automation. |
| AWS-SystemsManager-AutomationAdministrationRole.yml | None | Execute the script by creating a stack in the management account. See [Creating a stack on the AWS CloudFormation console](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-create-stack.html) on the AWS documentation site. | Provisions the administrator role in the management account necessary to run cross-account automation across multiple accounts. A prerequisite for configuring Systems Manager Automation. |
[Table 1. Basic script details]

{#sgc-cmdb-aws-script-op__table_jw4_yyf_4zb}

## Deep discovery scripts {#sgc-cmdb-aws-script-op__section_ahc_jwf_4zb}

Use the deep discovery scripts to set up deep discovery on Amazon EC2 instances.  
Note:  
Execute the deep discovery scripts only when you want to perform deep discovery on EC2 instances.
The following table describes the deep discovery scripts, the input parameters entered when executing a script, the conditions to execute the scripts, and the script execution results.
{#sgc-cmdb-aws-script-op__table_fjg_vs4_jzb__entry__4}

| Script | Input parameters | Execution condition | Result |
|-|-|-|-|
| AmazonSSMForInstancesRoleSetup.yml | S3Bucket :   S3 bucket name that collects the details from EC2 instances. See [Prerequisites for executing scripts](https://www.servicenow.com/docs/O~0rI97KStc7cSAVXm8xgw#sgc-cmdb-aws-scripts-prereq "Complete the prerequisites before you execute the AWS scripts."). | Execute the script in all the AWS accounts by creating a CloudFormation StackSet in the management account. See [Create a stack set](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create.html) on the AWS documentation site. | Creates the AmazonSSMForInstancesRole IAM instance profile role to be attached to the EC2 instances. |
| SG-AWS-RunShellScript-Setup.yml | None | Execute the script in all the AWS accounts and the AWS regions by creating a CloudFormation StackSet in the management account. AWS administrators must update SSM documents and verify that EC2 instances can execute relevant commands for proper integration. See [Create a stack set](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create.html) on the AWS documentation site. | Creates AWS Systems Manager (SSM) documents to fetch deep discovery data from a Linux EC2 instance. Retrieves version details for middleware applications, including Apache HTTP server, Nginx server, Apache Tomcat server, and MySQL instance. |
| SG-AWS-RunPowerShellScript-Setup.yml | None | Execute the script in all the AWS accounts and the AWS regions by creating a CloudFormation StackSet in the management account. See [Create a stack set](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create.html) on the AWS documentation site. | Creates AWS SSM documents to fetch deep discovery data from a Windows EC2 instance. |
[Table 2. Deep discovery script details]

{#sgc-cmdb-aws-script-op__table_fjg_vs4_jzb}

## Amazon EKS scripts {#sgc-cmdb-aws-script-op__section_osh_4zf_4zb}

Use the Amazon EKS scripts to set up Amazon Elastic Kubernetes Service (EKS) clusters.  
Note:  
Execute the Amazon EKS scripts only when the Amazon EKS service for Kubernetes clusters is required.

The following table describes the Amazon EKS scripts, the conditions to execute the scripts, and the script execution results.
{#sgc-cmdb-aws-script-op__table_psh_4zf_4zb__entry__3}

| Script | Execution condition | Result |
|-|-|-|
| SG-AWS-RunKubeCtlEKSNamesShellScript.yml | Execute the script in all the AWS accounts and the AWS regions where the EC2 Bastion hosts are located by creating a CloudFormation StackSet in the management account. See [Create a stack set](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create.html) on the AWS documentation site. | Creates an AWS SSM document to discover EKS clusters associated with EC2 Bastion hosts. Note: An AWS Cloud administrator can update the SSM document in their AWS setup. |
| SG-AWS-RunKubeCtlShellScript.yml | Execute the script in all the AWS accounts and the AWS regions where the EC2 Bastion hosts are located by creating a CloudFormation StackSet in the management account. See [Create a stack set](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create.html) on the AWS documentation site. | Creates an AWS SSM document to fetch CIs related to Kubernetes components, such as pods, services, and deployments, from EKS clusters. Note: An AWS Cloud administrator can update the SSM document in their AWS setup. |
[Table 3. Amazon EKS script details]

{#sgc-cmdb-aws-script-op__table_psh_4zf_4zb}