--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # AWS SSM discovery # AWS SSM discovery {#ariaid-title1} Release version: Australia Updated November 5, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of AWS SSM discovery AWS Systems Manager (SSM) Agent discovery integrates with ServiceNow Discovery to provide an efficient, agent-based method for discovering Amazon EC2 instances. This approach reduces reliance on traditional MID Server configurations, simplifies credential management, and enhances scalability across multiple AWS regions. The process involves the ServiceNow AI Platform® sending commands via the MID Server to AWS SSM agents, which execute commands on target devices and return results through AWS S3. These results are then processed and used to update the CMDB. Show full answer Show less ## Key Features * Eliminates the need for local operating system credentials on target instances. * Simplifies deployment by removing the requirement for Agent Client Collector (ACC) or Virtual Private Cloud (VPC) access. * Reduces the number of MID Servers and direct network access needed for discovery. * Uses AWS services for secure credential management and command execution. * Supports output redirection to S3 buckets to bypass SSM output size limits and facilitate file transfers. * Allows optional use of custom AWS KMS keys to encrypt sensitive credentials for enhanced security. ## Requirements and Configuration * Ensure Discovery Cloud Discovery Workspace 1.7.1+, CMDB CI Class Models 1.74.0+, and Discovery and Service Mapping Patterns 1.27.0+ are installed. * Install and configure the MID Server with AWS SSM capabilities enabled. * Have AWS IAM roles and permissions configured for SSM operations, including EC2 instance roles, S3 bucket setup, and optionally custom KMS keys for encryption. * Import ServiceNow-provided custom SSM YAML documents into each AWS region where discovery will run. * Configure ServiceNow system properties to enable AWS SSM discovery and set up MID Server properties for accessing KMS keys and S3 buckets. * Define root or non-root credentials appropriately, with the option to fallback to root user for Linux instances. * Set up Cloud Discovery schedules to use AWS SSM as the discovery method within the Discovery Admin Workspace. ## Unsupported Features * File-based discovery * Certificate-based discovery * Top-down discovery * Enhanced ADM Change/Unchange user steps in patterns * SSM only supports sudo for privileged commands and defaults to the sh shell without alternative shell support. ## Benefits for ServiceNow Customers This integration streamlines AWS EC2 discovery by reducing complexity in credential management and network configuration. Customers can achieve more scalable and secure discovery across multiple AWS regions without deploying additional MID Servers or managing direct network access. The use of AWS-native services such as S3 and KMS enhances data handling and security during discovery. Ultimately, this leads to more accurate and efficient CMDB updates with less operational overhead. ## Troubleshooting and Next Steps For diagnosis and resolution of AWS SSM discovery issues, refer to the Amazon SSM Discovery diagnosis guide available in the Now Support Knowledge Base. Follow the AWS environment and ServiceNow AI Platform configuration instructions carefully to ensure a successful deployment. AWS Systems Manager (SSM) Agent discovery introduces a streamlined, agent-based approach to discovering Amazon Elastic Compute Cloud (EC2) using AWS SSM. This integration enhances Discovery by leveraging SSM agents to reduce dependency on traditional MID Server configurations, simplify credential management, and improve scalability across multi-region environments. ## Workflow {#aws-ssm-discovery__section_a5l_ljl_yfc} The overall process from a high level is as follows: 1. The ServiceNow AI Platform® sends discovery commands to the MID Server. 2. The MID interacts with AWS services (SSM, Simple Storage Service (S3), Parameter Store) to execute commands on target devices. 3. The SSM agents run the commands and return results to S3. 4. The MID retrieves and processes results. 5. The MID sends the results back to the ServiceNow AI Platform® via the ECC queue, which updates the CMDB. {#aws-ssm-discovery__ol_qx5_fym_bgc} ## Benefits and usage {#aws-ssm-discovery__section_thf_lj2_yfc} The following examples highlight the primary advantages and practical uses of AWS SSM Agent discovery: * Execute discovery without needing additional credentials local to the operating system. * Simplify deployment without the need of Agent Client Collector (ACC) or Virtual Private Cloud (VPC) access. * Minimize the need for multiple MID Servers and direct network access to target devices. * Securely manage credentials and command execution using AWS services. {#aws-ssm-discovery__ul_uhf_lj2_yfc} ## Requirements {#aws-ssm-discovery__section_etx_dpx_xfc} Confirm that you have the required versions of the following applications and plugins: * Discovery * Cloud Discovery Workspace version 1.7.1 or later. * CMDB CI Class Models version 1.74.0 or later. * Discovery and Service Mapping Patterns version 1.27.0 or later. Install the MID Server. For more information, see [Install and configure the MID Servers](https://www.servicenow.com/docs/4ajIDq_DzDGU3O~Gc8V_gg "Install and configure the MID Servers correctly to enable ITOM products to access to the cloud resources."). Verify that you have an AWS user account with administrative access. Verify that you have a ServiceNow AI Platform® user account with the discovery_admin role. ## Unsupported features {#aws-ssm-discovery__section_ndf_wlg_bgc} Currently, the following features don't support AWS SSM discovery: * File-based discovery * Certificate-based discovery * Top-down discovery * Enhanced ADM * Change/Unchange user step in patterns {#aws-ssm-discovery__ul_rwf_mmg_bgc} Note: SSM supports only sudo for privileged command execution and defaults to the sh shell, with no support for alternate command or shell types. ## AWS environment configuration {#aws-ssm-discovery__section_jb5_rks_tfc} Create IAM roles and permissions : Define Identity and Access Management (IAM) roles to support AWS SSM operations, specifying the required permissions for executing Read, Write, and List commands. For more information, see [IAM Policies](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2150362#iampolicies) Configure EC2 roles and instances : Create EC2 roles and assign the necessary permissions for these roles to interact with SSM. For more information about setting up an EC2 instance, see [EC2 Instances](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2150362#ec2instances). Create S3 Buckets : Create S3 buckets to support large data transfers and configure appropriate bucket policies and life cycle rules. To overcome SSM's 24,000-character output limit, command output is redirected to S3, enabling full payload capture. Additionally, S3 facilitates file transfers to EC2 instances. For more information about creating S3 buckets, see [Setting up an S3 Bucket](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2150362#s3bucket). (Optional) Configure KMS keys : Create a custom AWS Key Management Service (KMS) key to encrypt sensitive credentials stored as SecureString parameters in the AWS Systems Manager Parameter Store. Using a dedicated key enhances security by verifying that credentials are encrypted and securely retrieved at runtime, without exposing them in plain text. For more information about creating KMS keys, see [Create a Customer Managed AWS KMS Key](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2150362#awskey). Important: If you're using applicative credentials in Discovery, you must create a custom KMS key. Import custom SSM documents : SSM command execution depends on the availability of required documents. Before initiating SSM-based discovery, verify that all YAML files provided by ServiceNow have been successfully deployed to each AWS region where the discovery process will run. For more information on this process, see [Import Custom AWS Documents](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2150362#awsdocs). You can download the YAML files directly from this article. For more information on AWS Management Console configuration, see the [Amazon SSM Discovery - AWS Environment Setup Instructions](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2150362) article in the Now Support Knowledge Base. ## ServiceNow AI Platform® instance configuration {#aws-ssm-discovery__section_wfb_sls_tfc} Configure System Properties : Enable the following Discovery system properties: * glide.discovery.enable_ssm * glide.discovery.ssm.enable_windows {#aws-ssm-discovery__ul_utw_rlg_5fc} The AWS SSM Agent runs with root (Linux) or SYSTEM (Windows) privileges, meaning any command sent through it can execute with full system access. Due to this high level of access, SSM is turned off by default for security reasons. For more information, see [Enable AWS SSM-based discovery](https://www.servicenow.com/docs/EBIz93weWI1yx8a~WibU2Q "Configure Discovery to use AWS Systems Manager (SSM) Agent."). Define root and non-root credentials : The MID Server property mid.discovery.aws_ssm.linux.fallback_root_user enables EC2 instances to default to the root user. By default, this setting is false, but if you don't want to set up alternate user credentials, you can enable it to run commands as root. If you leave this setting turned off, you must create a credential record in the AWS SSM Instance Users \[aws_ssm_instance_user_credentials\] table. In this table, you provide the user name that should be used to run commands on the instance. For more information, [Enable root fallback](https://www.servicenow.com/docs/K9B_XzLXUe9FSPM_jqDMaQ "Enable the fallback root user property to allow AWS SSM discovery to run commands as root on Linux systems when alternate user credentials aren’t configured.") and [Configure custom user credentials](https://www.servicenow.com/docs/kiXnsrdgJs_jKwUhej9COA "Define a non-root user for AWS SSM discovery by creating a credential record that specifies a user name with sufficient privileges to execute discovery commands on Linux targets."). Configure MID Server properties : After you set up KMS keys or S3 buckets in the AWS Management Console, configure the following MID Server system properties on the ServiceNow AI Platform®: * mid.discovery.aws_ssm.kms_key_name * mid.discovery.aws_ssm.kms_key_region * mid.discovery.aws_ssm.s3_bucket_name * mid.discovery.aws_ssm.s3_bucket_region {#aws-ssm-discovery__ul_m4t_nts_tfc} : For more information, see [Configure MID Server for AWS S3 access](https://www.servicenow.com/docs/GC97sd7Y3ZXl0XmQKP0kpw "Configure MID Server properties to enable Simple Storage Service (S3) access from the ServiceNow AI Platform when performing Systems Manager (SSM) Agent discovery.") and [Configure MID Server for AWS KMS access](https://www.servicenow.com/docs/wxYQSePGp2c~qp0wycaDkA "Configure MID Server properties to enable Key Management Service (KMS) key access from the ServiceNow AI Platform when performing Systems Manager (SSM) Agent discovery."). Enable MID Server capability : You must enable the new MID Server capability for AWS SSM so the MID Server can support running SSM discovery. By default, this capability is included if you're using the **ALL** capability. However, if you're using individual capabilities, you must manually add the new **AWS SSM** capability to your MID Servers. For information about adding a capability, see [Configure MID Server capabilities](https://www.servicenow.com/docs/access?context=t_ConfigureCapabilities&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US). ## Cloud Discovery schedule configuration {#aws-ssm-discovery__section_umh_d5s_tfc} Create a Cloud Discovery schedule : SSM discovery can be deployed within an AWS-based Cloud Discovery schedule in the Discovery Admin Workspace. To do this, go to the Deep discovery step, enable the Create an IP-based discovery schedule toggle, and select Discover servers though AWS Systems Manager (SSM) Agent as the Discovery method. For more information, see [Create an AWS Discovery schedule in Discovery Admin Workspace](https://www.servicenow.com/docs/_q25r~sjoXX0atnOAhlwbA "Use the Discovery Admin Workspace dashboard to create an Amazon Web Services (AWS) Discovery schedule."). ## Diagnose issues {#aws-ssm-discovery__section_diagnose_issues} For help identifying and resolving AWS SSM discovery issues, see the [Amazon SSM Discovery diagnosis guide](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2325108) article in the Now Support Knowledge Base.