--- sourceDocument: Zurich IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/it-operations-management Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # AWS SSM discovery # AWS SSM discovery {#ariaid-title1} * Release version: Zurich * * Updated August 11, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of AWS SSM discovery AWS Systems Manager (SSM) discovery in ServiceNow introduces an agent-based method to discover Amazon EC2 instances by leveraging AWS SSM Agents. This approach minimizes the need for traditional MID Server configurations, simplifies credential management, and improves scalability across multiple AWS regions. It enables discovery commands to be executed on target devices through SSM agents, with results securely processed and updated in the ServiceNow CMDB. Show full answer Show less ## Workflow * ServiceNow AI Platform sends discovery commands to the MID Server. * MID Server interacts with AWS services (SSM, S3, Parameter Store) to execute commands on EC2 instances. * SSM agents run commands and store outputs in S3. * MID Server retrieves results from S3, processes them, and sends them back to the ServiceNow AI Platform via eccqueue. * CMDB is updated with discovered information. ## Benefits and Practical Usage * Eliminates the need for additional credentials on target operating systems. * Removes dependency on Agent Client Collector (ACC) and VPC access. * Reduces the number of MID Servers and direct network access requirements. * Secures credential and command execution management using AWS native services. ## Requirements * ServiceNow applications and plugins: Cloud Discovery Workspace ≥ 1.7.1, CMDB CI Class Models ≥ 1.74.0, Discovery and Service Mapping Patterns ≥ 1.27.0. * Installed and configured MID Server. * AWS user account with administrative access. * ServiceNow AI Platform user with discoveryadmin role. ## Unsupported Features * File-based discovery. * Certificate-based discovery. * Top-down discovery. * Enhanced ADM Change/Unchange user steps in patterns. * Privileged command execution supports only sudo and defaults to the sh shell. ## AWS Environment Configuration * Create IAM roles with appropriate permissions for SSM operations. * Assign EC2 roles with permissions to interact with SSM. * Create S3 buckets for large data transfer and to capture command outputs exceeding SSM limits. * Optionally, configure AWS KMS keys to encrypt sensitive credentials stored as SecureString parameters, enhancing security. * Import ServiceNow-provided custom SSM documents (YAML files) into each AWS region where discovery is run. ## ServiceNow AI Platform Configuration * Enable Discovery system properties: **glide.discovery.enablessm** and **glide.discovery.ssm.enablewindows**. * Configure root and non-root credentials for EC2 instances via MID Server properties or credential records. * Set MID Server system properties to specify AWS KMS key and S3 bucket details for secure access. * Enable the AWS SSM capability on MID Servers to support SSM-based discovery. ## Cloud Discovery Schedule Configuration Deploy SSM discovery within an AWS-based Cloud Discovery schedule by enabling the IP-based discovery schedule toggle and selecting "Discover servers through AWS Systems Manager (SSM) Agent" as the discovery method in the Discovery Admin Workspace. AWS Systems Manager (SSM) Agent discovery introduces a streamlined, agent-based approach to discovering Amazon Elastic Compute Cloud (EC2) using AWS SSM. This integration enhances Discovery by leveraging SSM agents to reduce dependency on traditional MID Server configurations, simplify credential management, and improve scalability across multi-region environments. ## Workflow {#aws-ssm-discovery__section_a5l_ljl_yfc} The overall process from a high level is as follows: 1. The ServiceNow AI Platform® sends discovery commands to the MID Server. 2. The MID interacts with AWS services (SSM, Simple Storage Service (S3), Parameter Store) to execute commands on target devices. 3. The SSM agents run the commands and return results to S3. 4. The MID retrieves and processes results. 5. The MID sends the results back to the ServiceNow AI Platform® via the ecc_queue, which updates the CMDB. {#aws-ssm-discovery__ol_qx5_fym_bgc} ## Benefits and usage {#aws-ssm-discovery__section_thf_lj2_yfc} The following examples highlight the primary advantages and practical uses of AWS SSM Agent discovery: * Execute discovery without needing additional credentials local to the operating system. * Simplify deployment without the need of Agent Client Collector (ACC) or Virtual Private Cloud (VPC) access. * Minimize the need for multiple MID Servers and direct network access to target devices. * Securely manage credentials and command execution using AWS services. {#aws-ssm-discovery__ul_uhf_lj2_yfc} ## Requirements {#aws-ssm-discovery__section_etx_dpx_xfc} Confirm that you have the required versions of the following applications and plugins: * Discovery * Cloud Discovery Workspace version 1.7.1 or later. * CMDB CI Class Models version 1.74.0 or later. * Discovery and Service Mapping Patterns version 1.27.0 or later. Install the MID Server. For more information, see [Install and configure the MID Servers](https://www.servicenow.com/docs/GQW0uQE4eOrZuGS0eqXpqQ "Install and configure the MID Servers correctly to enable ITOM products to access to the cloud resources."). Verify that you have an AWS user account with administrative access. Verify that you have a ServiceNow AI Platform® user account with the discovery_admin role. ## Unsupported features {#aws-ssm-discovery__section_ndf_wlg_bgc} Currently, the following features don't support AWS SSM discovery: * File-based discovery * Certificate-based discovery * Top-down discovery * Enhanced ADM * Change/Unchange user step in patterns {#aws-ssm-discovery__ul_rwf_mmg_bgc} Note: SSM supports only sudo for privileged command execution and defaults to the sh shell, with no support for alternate command or shell types. ## AWS environment configuration {#aws-ssm-discovery__section_jb5_rks_tfc} Create IAM roles and permissions : Define Identity and Access Management (IAM) roles to support AWS SSM operations, specifying the required permissions for executing Read, Write, and List commands. For more information, see [IAM Policies](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2150362#iampolicies) Configure EC2 roles and instances : Create EC2 roles and assign the necessary permissions for these roles to interact with SSM. For more information about setting up an EC2 instance, see [EC2 Instances](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2150362#ec2instances). Create S3 Buckets : Create S3 buckets to support large data transfers and configure appropriate bucket policies and life cycle rules. To overcome SSM's 24,000-character output limit, command output is redirected to S3, enabling full payload capture. Additionally, S3 facilitates file transfers to EC2 instances. For more information about creating S3 buckets, see [Setting up an S3 Bucket](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2150362#s3bucket). (Optional) Configure KMS keys : Create a custom AWS Key Management Service (KMS) key to encrypt sensitive credentials stored as SecureString parameters in the AWS Systems Manager Parameter Store. Using a dedicated key enhances security by verifying that credentials are encrypted and securely retrieved at runtime, without exposing them in plain text. For more information about creating KMS keys, see [Create a Customer Managed AWS KMS Key](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2150362#awskey). Important: If you're using applicative credentials in Discovery, you must create a custom KMS key. Import custom SSM documents : SSM command execution depends on the availability of required documents. Before initiating SSM-based discovery, please verify that all YAML files provided by ServiceNow have been successfully deployed to each AWS region where the discovery process will run. For more information on this process, see [Import Custom AWS Documents](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2150362#awsdocs). You can download the YAML files directly from this article. For more information on AWS Management Console configuration, see the [Amazon SSM Discovery - AWS Environment Setup Instructions](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2150362) article in the Now Support Knowledge Base. ## ServiceNow AI Platform® instance configuration {#aws-ssm-discovery__section_wfb_sls_tfc} Configure System Properties : Enable the following Discovery system properties: * glide.discovery.enable_ssm * glide.discovery.ssm.enable_windows {#aws-ssm-discovery__ul_utw_rlg_5fc} The AWS SSM Agent runs with root (Linux) or SYSTEM (Windows) privileges, meaning any command sent through it can execute with full system access. Due to this high level of access, SSM is turned off by default for security reasons. For more information, see [Enable AWS SSM-based discovery](https://www.servicenow.com/docs/wVJ5yjvtIuiirth4Yf2dfQ "Configure Discovery to use AWS Systems Manager (SSM) Agent."). Define root and non-root credentials : The MID Server property mid.discovery.aws_ssm.linux.fallback_root_user enables EC2 instances to default to the root user. By default, this setting is false, but if you don't want to set up alternate user credentials, you can enable it to run commands as root. If you leave this setting turned off, you must create a credential record in the AWS SSM Instance Users \[aws_ssm_instance_user_credentials\] table, where you simply provide the user name that should be used to run commands on the instance. For more information, [Enable root fallback](https://www.servicenow.com/docs/NLlxM0vVycn27aP8C_xC5w "Enable the fallback root user property to allow AWS SSM discovery to run commands as root on Linux systems when alternate user credentials aren’t configured.") and [Configure custom user credentials](https://www.servicenow.com/docs/528Wz8e0xbfnz0qc86mYGQ "Define a non-root user for AWS SSM discovery by creating a credential record that specifies a user name with sufficient privileges to execute discovery commands on Linux targets."). Configure MID Server properties : After you set up KMS keys or S3 buckets in the AWS Management Console, configure the following MID Server system properties on the ServiceNow AI Platform®: * mid.discovery.aws_ssm.kms_key_name * mid.discovery.aws_ssm.kms_key_region * mid.discovery.aws_ssm.s3_bucket_name * mid.discovery.aws_ssm.s3_bucket_region {#aws-ssm-discovery__ul_m4t_nts_tfc} : For more information, see [Configure MID Server for AWS S3 access](https://www.servicenow.com/docs/QPJt7bn9ZGsShZ7FfJoWZw "Configure MID Server properties to enable Simple Storage Service (S3) access from the ServiceNow AI Platform when performing Systems Manager (SSM) Agent discovery.") and [Configure MID Server for AWS KMS access](https://www.servicenow.com/docs/oCIbmvUXKdc0HBT0YupJtQ "Configure MID Server properties to enable Key Management Service (KMS) key access from the ServiceNow AI Platform when performing Systems Manager (SSM) Agent discovery."). Enable MID Server capability : You must enable the new MID Server capability for AWS SSM so the MID Server can support running SSM discovery. By default, this capability is included if you're using the **ALL** capability. However, if you're using individual capabilities, you must manually add the new **AWS SSM** capability to your MID Servers. For information about adding a capability, see [Configure MID Server capabilities](https://www.servicenow.com/docs/access?context=t_ConfigureCapabilities&version=zurich&pubname=zurich-servicenow-platform&ft:locale=en-US). ## Cloud Discovery schedule configuration {#aws-ssm-discovery__section_umh_d5s_tfc} Create a Cloud Discovery schedule : SSM discovery can be deployed within an AWS-based Cloud Discovery schedule in the Discovery Admin Workspace. To do this, go to the Deep discovery step, enable the Create an IP-based discovery schedule toggle, and select Discover servers though AWS Systems Manager (SSM) Agent as the Discovery method. For more information, see [Create an AWS Discovery schedule in Discovery Admin Workspace](https://www.servicenow.com/docs/0LbSnipUH7LYudtvRyAL3g "Use the Discovery Admin Workspace dashboard to create an Amazon Web Services (AWS) Discovery schedule.").