---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Access setup for AWS service accounts

# Access setup for AWS service accounts {#ariaid-title1}

Release version: Australia  
Updated October 1, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 6 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Access setup for AWS service accounts

ServiceNow's Cloud Discovery and Cloud Provisioning and Governance require access to AWS service accounts to discover and manage cloud resources.
Access is established primarily via MID Servers, which connect to AWS environments by using either permanent or temporary AWS credentials.
Proper configuration of AWS Identity and Access Management (IAM) roles and permissions is essential for secure and efficient access.
Show full answer Show less  

## Types of AWS Credentials

* **Permanent Credentials:** These are static AWS credentials added to the ServiceNow AI Platform's Connections and Credentials module. They simplify setup but require manual management.
* **Temporary Credentials:** Generated dynamically using AWS Security Token Service (STS) AssumeRole API calls on IAM roles. Temporary credentials enhance security and simplify management in large AWS organizations by reducing the need for multiple permanent credentials.

## IAM Roles and Permissions

By default, MID Servers assume the AWS `OrganizationAccountAccessRole` role to obtain temporary credentials for member accounts. This role provides broad access without additional restrictions. ServiceNow customers can customize IAM roles and permissions to enhance security and tailor access controls. Proper IAM role trust relationships must be configured between accounts for trusted access.

## Methods of Granting Access

* **Single Account Access:** Configure permanent AWS credentials directly on the ServiceNow AI Platform for individual accounts.
* **Access via Trusted Accounts with AWS Credentials:** Configure IAM roles in trusting accounts to allow access through a trusted accessor account with credentials, enabling one set of credentials to access multiple accounts.
* **Access via Trusted Accounts without AWS Credentials:** Establish IAM role trust relationships allowing accounts without credentials to access others by assuming roles, supporting credential-less access.
* **Trust Chain via Management Account:** Member accounts trust their AWS management account's IAM role, which in turn trusts the accessor account, streamlining access across an organization.

## How Cloud Discovery Selects Credentials

Cloud Discovery determines credentials based on the following priority:

1. Use permanent credentials defined in the `cmdbcicloudserviceaccount` table for the account.
2. If none, check for temporary credential parameters (custom AssumeRole settings) in the `cloudserviceaccountawsorgassumeroleparams` or `cloudserviceaccountawscrossassumeroleparams` tables.
3. If no custom parameters exist, default to temporary credentials from the `OrganizationAccountAccessRole`.

## Practical Implications for ServiceNow Customers

Understanding and choosing the appropriate access method is critical for securely and efficiently integrating AWS accounts with ServiceNow Cloud Discovery and Provisioning. Customers should:

* Evaluate whether permanent or temporary credentials best suit their organizational scale and security policies.
* Configure IAM roles and trust policies carefully to enable seamless cross-account access.
* Use MID Server properties to control temporary credential caching behavior to optimize discovery performance.
* Maintain accurate service account records in the ServiceNow CMDB to support credential management and discovery operations.  
Cloud Discovery and Cloud Provisioning and Governance need access to resources in the Amazon Web Services (AWS) service accounts. Learn about different methods of configuring such access.

Before you configure access, understand the AWS service account types in your environment. For more information, see [Setup AWS service accounts](https://www.servicenow.com/docs/Ne9_EUn4j5vmLXgoJrnYnQ "Create and configure cloud service accounts at ServiceNow AI Platform for the corresponding Amazon Web Services (AWS) service accounts."). Configure the required IAM permissions before selecting an access method. For more information, see [Control AWS access and permissions using policies](https://www.servicenow.com/docs/YQiEOCVl1XQSfYYJB75sPA "Configure policies with the necessary level of permissions to provide access to the AWS resources for Cloud Discovery and Cloud Provisioning and Governance.").

Cloud Discovery and Cloud Provisioning and Governance access resources in AWS service accounts through MID Servers. You must authorize inbound traffic to Amazon EC2 instances from the MID Server for setting up initial communication. For more information, see [Configure security group inbound rules using the AWS Management Console](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-security-group-rules.html).

## Types of AWS credentials {#access-aws-accounts__section_uzm_dgl_mpb}

There are permanent and temporary AWS credentials that you can use for configuring access to AWS service accounts.

Permanent
:   The permanent credentials are the actual AWS credentials for the service account that you add to the Connections and Credentials module of ServiceNow AI Platform. While it might be time consuming to manage credentials on ServiceNow AI Platform, you avoid the complex configurations involved in using temporary credentials.

Temporary

:   The temporary credentials are generated by the AWS Security Token Service (AWS STS) for IAM roles. After you configure IAM roles for AWS accounts, the MID Server accesses AWS resources with these temporary credentials. You can use the default IAM role, OrganizationAccountAccessRole, or create custom IAM roles.

    Assuming IAM roles in a large AWS organization is more convenient and offers better security than using large numbers of permanent credentials for all AWS accounts. Temporary credentials are only acquired on behalf of a service account when there's no permanent credential specified for that service account in the Service Accounts
    \[cmdb_ci_cloud_service_account\] table.

    The MID Server uses the [AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) action in the [AWS Security Token Service API](https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html) to assume a member account role. Parameters passed to this API determine which additional security restrictions are applied to the role when it accesses the AWS resources.

    By default, the MID Server is configured to assume the OrganizationAccountAccessRole, which grants temporary credentials to all the members of a primary account. This action occurs automatically if no permanent credentials exist for the member accounts. This configuration doesn't apply any additional security or restrict access to any resources in member accounts.

    By default, the ServiceNow instance caches temporary credentials for member accounts for 60 minutes. This interval enables the horizontal discovery process to run multiple times without generating new
    credentials during each discovery. You can avoid credential caching or modify the caching period using [MID Server properties](https://www.servicenow.com/docs/access?context=r_MIDServerProperties&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US).

## IAM roles and permissions {#access-aws-accounts__section_vch_wyh_nkb}

To enhance security provided by the default AWS
OrganizationAccountAccessRole role, you can customize the AWS roles that MID Servers can assume to receive temporary credentials for member accounts. You can configure additional permissions to improve security and customize the way that the member account's role is assumed
when discovering cloud resources.

For a list of required API permissions for Cloud Discovery, including org-level permissions required for management account discovery, see [Control AWS access and permissions using policies](https://www.servicenow.com/docs/YQiEOCVl1XQSfYYJB75sPA "Configure policies with the necessary level of permissions to provide access to the AWS resources for Cloud Discovery and Cloud Provisioning and Governance.").

## Methods of granting access {#access-aws-accounts__section_oyq_md5_kpb}

For the purposes of configuring access for AWS accounts, the following terms are used:

Trusting accounts
:   The trusting accounts don't have permanent AWS credentials. You configure the trust relationship for IAM roles in these accounts to rely on other accounts for access.

Trusted accounts
: The trusted accounts are used by the trusting accounts for access. The ServiceNow UI refers to the trusted accounts as accessor accounts.  
Typically, you set up access to the AWS accounts in your organization using the following methods:

Configuring access for a single account
:
    * Configure AWS credentials on the ServiceNow AI Platform to avoid the complexity of creating and setting up IAM roles. For more information, see [Configure access to the AWS accounts using permanent AWS credentials](https://www.servicenow.com/docs/W8oV7Kk58J0rP1Kq9ji06g "To securely access data on your provider account, the Discovery process must present appropriate credentials. To make the credentials available to Discovery and Cloud Provisioning and Governance, you first create a user with programmatic access in the AWS Management Console. You then securely store the credentials in a service account at ServiceNow AI Platform.").
    * Create an AWS service account on the ServiceNow AI Platform. For more information, see [Create AWS service accounts](https://www.servicenow.com/docs/vpueuFRHMWLNi6dzsJv94A "Create AWS service accounts on the ServiceNow AI Platform to access your AWS account during AWS discovery.").
    {#access-aws-accounts__ul_lrx_kht_zfc}

Configuring access for an account that trusts an accessor account with AWS credentials
:
    Figure 1. Setting up any AWS account to rely on a trusted account with AWS credentials   


:
    * Configure any type of account---discrete (independent), management, or member---to rely on a trusted account with AWS credentials for access.
    * Configure an IAM role in each trusting account to trust the user of the trusted account. This lets you use one set of AWS credentials to access multiple AWS accounts.

    {#access-aws-accounts__ul_rc5_mht_zfc} For more information, see [Configure temporary credential access for trusted AWS accounts](https://www.servicenow.com/docs/ZTq8m7Nto4uglX1yWYgA2w "Configure the trusting account whose resources need to be accessed, to rely on the trusted account using the Identity and Access Management (IAM) role.").

Configuring access for an account that trusts an accessor account without AWS credentials
:
    Figure 2. Setting up any AWS account to rely on a trusted account without AWS credentials   


:
    * Configure any type of account---discrete (independent), management, or member---to rely on a trusted account without AWS credentials for access.
    * Configure an account without AWS credentials using an IAM role and permissions to access the trusting service account.
    * Set up the IAM role of the trusting account to grant access to the IAM role of the trusted account.

    {#access-aws-accounts__ul_bhf_pht_zfc}For more information, see [Configure credential-less access using trusted AWS accounts](https://www.servicenow.com/docs/FVdZQYBug55RbRVehyo78g "Set up a trusted credential-less account that other AWS accounts can rely on for access.").

Configuring access for AWS member accounts by using a trust chain from the accessor through the management account.
:
    Figure 3. Configuring member accounts to use their management account for access   


:
    * Configure the IAM roles of the member accounts to trust the IAM role of their management account. For more information, see [Configure access for trusting AWS member accounts in trust chain](https://www.servicenow.com/docs/DOZzyJNgyvbd3PrY2QgGJA "Configure access for AWS member accounts by using a trust chain from the accessor through the management account.").
    * Configure the management accounts to trust the accessor accounts with or without AWS credentials. For more information, see:
      * [Configure temporary credential access for trusted AWS accounts](https://www.servicenow.com/docs/ZTq8m7Nto4uglX1yWYgA2w "Configure the trusting account whose resources need to be accessed, to rely on the trusted account using the Identity and Access Management (IAM) role.").
      * [Configure credential-less access using trusted AWS accounts](https://www.servicenow.com/docs/FVdZQYBug55RbRVehyo78g "Set up a trusted credential-less account that other AWS accounts can rely on for access.").
      {#access-aws-accounts__ul_erm_5ft_zfc}
    {#access-aws-accounts__ul_yz2_yht_zfc}

## How Cloud Discovery determines which credentials to use {#access-aws-accounts__section_vqm_mbn_phb}

Member account trusts management account
:
    Cloud Discovery uses the following logic to determine which credentials to use to discover AWS cloud resources in member accounts:

    1. If permanent credentials are defined for the member account in the Cloud Service Account \[cmdb_ci_cloud_service_account\] table, Discovery uses those credentials. The Cloud Service Accounts \[cmdb_ci_cloud_service_account\] table contains the information on the service account types, like management or member, and their credentials.
    2. If no permanent credentials are defined for the member account, Discovery checks the Cloud Service Account AWS Org Assume Role Params \[cloud_service_account_aws_org_assume_role_params\] table for special parameters associated with the member account. If parameters exist in that table, Discovery uses the temporary credentials acquired from specifying a role and its parameters in the AWS Security Token Service API AssumeRole action.
    3. If no special parameters are associated with the member account in the \[cloud_service_account_aws_org_assume_role_params\] table, Discovery checks that table for parameters associated with the management account. If parameters exist that define a role for the management account, Discovery uses the temporary credentials provided by that role.
    4. If no special parameters are present in the \[cloud_service_account_aws_org_assume_role_params\] table for either management or member accounts, Discovery uses the defaults defined for the OrganizationAccountAccessRole role.
    {#access-aws-accounts__ol_onb_5bn_phb}

Member or management account trusts accessor account
:
    1. If permanent credentials are defined for the member or management account in the Cloud Service Account \[cmdb_ci_cloud_service_account\] table, Discovery uses those credentials. The Cloud Service Accounts \[cmdb_ci_cloud_service_account\] table contains the information on the service account types, like management or member, and their credentials.
    2. If no permanent credentials are defined for the account, Discovery checks the Cloud Service Account AWS Cross Assume Role Params \[cloud_service_account_aws_cross_assume_role_params\] table for special parameters associated with the account. If parameters exist in that table, Discovery uses the temporary credentials acquired from specifying a role and its parameters in the AWS Security Token Service API AssumeRole action.
    {#access-aws-accounts__ol_ovp_pvl_bgc}
**Related concepts**   

* [Setup AWS service accounts](https://www.servicenow.com/docs/Ne9_EUn4j5vmLXgoJrnYnQ "Create and configure cloud service accounts at ServiceNow AI Platform for the corresponding Amazon Web Services (AWS) service accounts.")  
**Related tasks**   

* [Control AWS access and permissions using policies](https://www.servicenow.com/docs/YQiEOCVl1XQSfYYJB75sPA "Configure policies with the necessary level of permissions to provide access to the AWS resources for Cloud Discovery and Cloud Provisioning and Governance.")
* [Create AWS service accounts](https://www.servicenow.com/docs/vpueuFRHMWLNi6dzsJv94A "Create AWS service accounts on the ServiceNow AI Platform to access your AWS account during AWS discovery.")  
**Related topics**   

* [Step-by-Step Guide to Configure AWS Cloud Discovery in ServiceNow Using Patterns \[KB2184482\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2184482)
* [AWS Cloud Discovery Setup -- Use Case Guide with CloudFormation Templates \[KB2221157\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2221157)