--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Discovery for AWS # Discovery for AWS {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Discovery for AWS Discovery for AWS in ServiceNow enables automated, continuous identification and mapping of AWS cloud resources, populating this information into the Configuration Management Database (CMDB). This visibility supports key business outcomes such as cloud transformation, operational efficiency across ITOM, ITSM, and AIOps, and compliance adherence. Show full answer Show less Discovery can be performed via agent-based or agentless methods, cloud APIs, or IP-based OS-level discovery. It supports both near real-time event-driven discovery and scheduled scans. Discovery methods include horizontal discovery (identifying configuration items without dependencies) and top-down service mapping (identifying application dependencies and service impacts). ## Key outcomes and business value * **Regulatory compliance:** Supports frameworks like the Mutual Recognition Agreement (MRA) and Digital Operational Resilience Act (DORA) through accurate cloud data. * **Software Asset Management (SAM):** Enables visibility into cloud software deployments. * **Financial Operations (FinOps):** Provides comprehensive insight into AWS resource usage for cost optimization. * **Security Operations (SecOps):** Delivers continuous visibility into cloud configurations to enhance security posture. * **Certificate Management:** Tracks certificates, their expiry, and usage within AWS environments. * **Artificial Intelligence for IT Operations (AIOps):** Enhances automated operations by mapping all cloud resources and configurations. ## AWS discovery approaches * **Cloud metadata discovery:** Offers a high-level overview of AWS infrastructure. * **Cloud OS-level discovery:** Provides detailed state information such as installed software, active services, and system configurations. * **Event-driven discovery:** Monitors lifecycle and configuration changes in near real time. * **AWS Systems Manager (SSM):** Agent-based discovery focused on Amazon EC2 instances. * **Agent Client Collector (ACC-VC):** IP-based discovery capturing OS-level attributes and running processes. * **Service Graph Connectors:** Imports and integrates AWS data into CMDB and non-CMDB tables, especially for AWS Organizations. ## How to perform AWS cloud discovery ServiceNow ITOM Visibility applications support discovery, visualization, and monitoring of AWS resources. These include Discovery Admin Workspace, Discovery for Amazon Elastic Kubernetes Service (EKS), Service Mapping, and Certificate Inventory and Management. Successful discovery requires proper configuration of roles and permissions both in AWS and ServiceNow AI Platform. In AWS, Identity and Access Management (IAM) roles must be set up with appropriate permissions for discovery operations. User types include AWS Organizations master/member accounts, root users, and IAM users or groups with assigned roles. On the ServiceNow side, users must have the **discoveryadmin** role to run discovery processes. Discovery performs API queries and commands to AWS, so REST API permissions must be verified. ServiceNow provides a Cloud Discovery patterns spreadsheet outlining required permissions, pattern names, CI classes, and vendor documentation links. This spreadsheet is updated quarterly to ensure current discovery patterns and permissions. Amazon Web Services (AWS) cloud discovery enables visibility to your AWS cloud resources, to populate and update the Configuration Management Database (CMDB). Visibility into AWS supports business outcomes such as cloud transformation and optimizing efficiency for operations (ITOM/ITSM/AIOps). ## What is AWS cloud discovery {#understanding-aws-discovery__section_xjy_34q_mhc} AWS cloud discovery is an automated process that continuously identifies and maps AWS resources and populates the data in the Configuration Management Database (CMDB). AWS discovery can be performed by a combination of approaches such as agent-based or agentless, cloud APIs for metadata discovery, or IPs for OS-level discovery. The visibility can be provided near real time (using event-based discovery for example) or by timed discovery schedules. The Discovery and Service Mapping apps perform discovery by methods refereed to as horizontal discovery and top‑down mapping. Horizontal discovery identifies configuration items (CIs) without dependency mapping. Top‑down service mapping identifies application dependencies, connection paths, and service impact. ## Key outcomes and business value {#understanding-aws-discovery__section_icp_5vx_1hc} AWS discovery facilitates several vital business outcomes by populating the CMDB with essential cloud data: * Regulatory compliance enabled by the data support. Visibility can promote alignment with compliance frameworks such as the Mutual Recognition Agreement (MRA) or Digital Operational Resilience Act (DORA). * Software asset management (SAM) enabled by visibility into cloud software deployments. * Financial operations(FinOps) enabled by comprehensive visibility into AWS resources and their usage, * Security operations(SecOps) enabled by continuous visibility into cloud resources and their configurations. * Certificate management enabled by the discovery of certificates, their expiry, and usage. * Artificial intelligence for IT operations (AIOps) enabled by Identifying and mapping all cloud resources, and their configurations. {#understanding-aws-discovery__ul_a2s_gvx_1hc} ## AWS discovery approaches {#understanding-aws-discovery__section_s3n_svx_1hc} There are several approaches for discovering AWS environments. 1. Cloud metadata discovery: Provides a high-level view of the AWS cloud infrastructure. 2. Cloud OS-Level discovery: Provides a deeper level of discovery that indicates the state of the AWS cloud resources, such as installed software, active services, running processes, and system configurations. 3. Event‑driven cloud discovery: Tracks changes in the life-cycle state or the configuration of AWS cloud resources. For more information, see [AWS events-driven discovery](https://www.servicenow.com/docs/NM5ceF5UYIM3UN0qvO0Qxg "Use AWS events-driven discovery to keep your CMDB current automatically when AWS resource configurations change, without waiting for a scheduled Discovery run.") 4. Collecting data with AWS Systems Manager: Provides a streamlined, agent-based approach to discovering Amazon Elastic Compute Cloud (EC2). For more information, see [AWS SSM discovery](https://www.servicenow.com/docs/Ih32wBYGV~RleSy4J6~rzQ "AWS Systems Manager (SSM) Agent discovery introduces a streamlined, agent-based approach to discovering Amazon Elastic Compute Cloud (EC2) using AWS SSM. This integration enhances Discovery by leveraging SSM agents to reduce dependency on traditional MID Server configurations, simplify credential management, and improve scalability across multi-region environments.") 5. Collecting data with Agent Client Collector (ACC-VC): Performs horizontal IP-based discovery for OS-related attributes such as system configurations, network interfaces, and running process. For more information, see [Agent Client Collector Discovery](https://www.servicenow.com/docs/xafPexa00Lf9KGUlPNVM~Q "Discover CIs in your environment by using Agent Client Collector for Visibility Content (ACC-VC) Discovery. ACC-VC works with both horizontal IP-based Discovery, and you can also use push-based Discovery."). 6. Collecting data with Service Graph Connectors: Imports and integrates AWS data into CMDB and non-CMDB tables. Specializes in collecting the data for AWS Organizations. For more information, see [AWS discovery solutions comparison](https://www.servicenow.com/docs/dnF0sWLVav2SykJY8JqOOQ "ITOM Visibility applications discover a variety of AWS resources and populate the relevant configuration item (CI) classes in the Configuration Management Database (CMDB) with their attributes.") and [Service Graph Connector for AWS](https://www.servicenow.com/docs/access?context=cmdb-integration-aws-sg&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US). {#understanding-aws-discovery__ol_cmv_mmk_khc} For comparison of AWS cloud discovery methods and requirements, see [AWS cloud discovery methods and use cases](https://www.servicenow.com/docs/up53~GcjZAYeLhcsCsEMiA "Comparison of use cases and requirements for cloud discovery methods in AWS.") ## How to perform AWS cloud discovery {#understanding-aws-discovery__section_uh2_dpq_mhc} Multiple ITOM Visibility apps can collect (or discover) your data, visualize it, and help you monitor your AWS resources. * [Discovery Admin Workspace](https://www.servicenow.com/docs/uBbfCIaLAPvZqMp2HrhK2A "The Discovery Admin Workspace serves as a central location for monitoring, tracking, and completing discovery-related tasks. Experience a streamlined discovery process and greater efficiency with the integration of schedules, diagnostics, tuning, anomaly detection, and more within this single workspace.") * [Discovery for Amazon Elastic Kubernetes Service (EKS)](https://www.servicenow.com/docs/nzEBIa1cCTkSNZxPmAi9ag "The ServiceNow ITOM Visibility finds Kubernetes and OpenShift components using patterns and creates application services containing them. Discovery also finds Kubernetes events and frequently updates the CMDB to reflect the dynamic Kubernetes environment.") * [Service Mapping](https://www.servicenow.com/docs/Zgi~00Dquj6xQVsCJv10ow "Service Mapping in cloud environments provides critical visibility into application dependencies and connections. By identifying how different application components interact within IaaS and PaaS environments, your organization can gain better insight into its application services and improve overall service management.") * [Discovery and Service Mapping Patterns](https://www.servicenow.com/docs/NFaTlkGaSxMWb2bQPsCnCA "Discovery and Service Mapping Patterns uses patterns to discover components of the Amazon AWS Cloud deployment during horizontal discovery. Discovering some of these resources might require updating to the latest version of the Discovery and Service Mapping Patterns application from the ServiceNow Store.") * [Certificate Inventory and Management](https://www.servicenow.com/docs/fp~wSWPhKxdwAGjYiUQL2Q "Cloud Discovery uses Patterns to discover certificate data that the Amazon AWS Cloud Certificate Manager (ACM) manages. Discovering this data requires installing and updating Discovery and Service Mapping Patterns and Certificate Inventory and Management.") {#understanding-aws-discovery__ul_qzt_gqq_mhc} Enabling Discovery or other Visibility solutions to access your AWS infrastructure depends on roles and permissions configured both in AWS and in ServiceNow AI Platform. The discovery process requires configuration within AWS, like setting up Identity and Access Management roles. {#understanding-aws-discovery__table_ajm_35s_ghc__entry__2} | AWS Users | Discovery permissions | |-|-| | AWS Organizations with master and member accounts | Access is based on the IAM roles defined for the master and member accounts. | | AWS account root user | Has complete access to all AWS services and resources in the account. | | IAM users/IAM user group | Has access to specific resources and services based on IAM roles or temporary access based on assumed roles. | [Table 1. AWS user discovery permissions] {#understanding-aws-discovery__table_ajm_35s_ghc} For more information, see [Access to cloud environments for ITOM products](https://www.servicenow.com/docs/8~Tzrc38T830_67wTEgbhA "If your organization deploys IT assets on the cloud, ITOM products must access your cloud environment to collect information about the IT infrastructure.") In the ServiceNow AI Platform side, there are user configurations needed if you choose to use Discovery. * You must configure the discovery_admin role for a user, to be able to run the discovery. For more information, see [Managing roles](https://www.servicenow.com/docs/access?context=ua-creating-roles&version=australia&pubname=australia-platform-administration&ft:locale=en-US) * Discovery runs commands and API queries to access and discover your AWS infrastructure. Before starting to configure Discovery roles and permissions, review the Cloud discovery spreadsheet and verify the REST API permissions. {#understanding-aws-discovery__ul_vym_w5g_lhc} ## Verify the REST API permissions {#understanding-aws-discovery__id_wxp_lh3_chc} Download the [Cloud Discovery patterns spreadsheet](https://downloads.docs.servicenow.com/resource/enus/api/servicenow-discovery-patterns-api-details.xlsx) so you can grant user permissions required for running the Discovery patterns. In addition to permissions, the spreadsheet also includes useful information such as pattern names, types, CI Classes, and links to vendor documentation. New patterns are available quarterly, so check periodically to be sure you have the latest version of the spreadsheet.{#understanding-aws-discovery__cloud-discovery-api-ph-short-prereq}