AWS tag discovery with Patterns

  • Release version: Zurich
  • Updated July 31, 2025
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of AWS tag discovery with Patterns

    ServiceNow Discovery and Service Mapping applications leverage specialized patterns to identify AWS resource tags and associated configuration item (CI) types, then update the CMDB accordingly. These tag-specific discovery patterns complement existing AWS discovery patterns available on the ServiceNow Store and extend the capabilities to enrich the CMDB with detailed tag information for numerous AWS resources.

    Show full answer Show less

    Key Features

    • Supports discovery of tags for a wide range of AWS CI types including network ACLs, API Gateways, load balancers, Cognito, DynamoDB, Lambda, S3, security groups, virtual servers, and more.
    • Patterns filter resource tags by resource type and make targeted Cloud API calls to collect and parse tag data.
    • Parsing of resource names from Amazon Resource Names (ARNs) is implemented when ARN directly does not provide identification, enabling accurate CI linkage.
    • Uses a "Cloud Rest Call" API to retrieve tag data from AWS Tagging API endpoints with precise URL construction and headers designed for AWS.
    • Collected data is stored primarily in the cmdbkeyvalue table, capturing tag keys, values, and unique AWS resource identifiers (objectid).
    • Includes EVAL scripts to extract resource names for efficient CI identification and relationship mapping.

    Prerequisites and Configuration

    • Configure AWS credentials on the ServiceNow AI Platform using AWS access and secret keys, and obtain the correct Amazon Account ID as shown in the AWS Management Console.
    • Set read-only permissions on the AWS Tagging API endpoint for the relevant AWS region (https://tagging.<region>.amazonaws.com).
    • Create discovery schedules for AWS service accounts to automate tag discovery processes.
    • Ensure the latest version of Discovery and Service Mapping Patterns application is installed from the ServiceNow Store to support tag discovery.

    Practical Outcomes for Customers

    • Enables customers to maintain a more comprehensive and accurate CMDB by automatically importing AWS resource tags.
    • Improves visibility into AWS resource metadata, facilitating better asset management, governance, and automation within ServiceNow.
    • Supports more granular service mapping and impact analysis by linking tags directly to their corresponding AWS CIs.
    • Reduces manual effort in tracking AWS resource metadata and ensures up-to-date configuration data through scheduled discovery.

    The ServiceNow Discovery and Service Mapping applications can use patterns to discover the tags for AWS resources and configuration item (CI) types, and then populate the CMDB with these discoveries. Discovering some of these resources may require updating to the latest version of the Discovery and Service Mapping Patterns application from the ServiceNow Store.

    This tag-specific discovery pattern is in addition to the other AWS patterns available on the ServiceNow Store.This pattern extends the ones used for discovering the respective AWS resources.

    Discovery populates the CMDB with tags for the following AWS patterns and CI types:
    • Amazon AWS - ACL (LP) [cmdb_ci_network_acl]
    • Amazon AWS API Gateway [cmdb_ci_cloud_gateway]
    • Amazon AWS - Application and Network LB (LP) [cmdb_ci_cloud_load_balancer]
    • Amazon AWS Application and Network LBs Events
    • Amazon AWS - Classic LB (LP) [cmdb_ci_cloud_load_balancer]
    • Amazon AWS Classic LB Events
    • Amazon AWS Cognito [cmdb_ci_cloud_authentication]
    • Amazon AWS - Customer Gateway (LP) [cmdb_ci_customer_gateway]
    • Amazon AWS DB Cluster
    • Amazon AWS DynamoDB [cmdb_ci_dynamodb_table]
    • Amazon AWS ElastiCache
    • Amazon AWS - ECS [cmdb_ci_cloud_service_account]
    • Amazon AWS - Executable Template (LP) [cmdb_ci_os_template]
    • Amazon AWS - Host (LP)
    • Amazon AWS - Internet Gateway (LP)
    • Amazon AWS keyspace
    • Amazon AWS - Key Pair (LP)
    • Amazon AWS Lambda [cmdb_ci_cloud_function]
    • Amazon AWS - LB Pool (LP)
    • Amazon AWS - NAT Gateway (LP)
    • Amazon AWS - Network (LP)
    • Amazon AWS Network Events
    • Amazon AWS - NIC (LP)
    • Amazon AWS - Owned Template (LP)
    • Amazon AWS - Public IP Address (LP)
    • Amazon AWS Redshift
    • Amazon AWS Relational Database Service [cmdb_ci_cloud_database]
    • Amazon AWS Resource Inventory
    • Amazon AWS - Route Table (LP)
    • Amazon AWS S3 [cmdb_ci_cloud_object_storage]
    • Amazon AWS - Security Group (LP)
    • Amazon AWS Security Group Events
    • Amazon AWS Serverless Database
    • Amazon AWS - Storage (LP)
    • Amazon AWS Storage Events
    • Amazon AWS sub account discovery
    • Amazon AWS - Subnet (LP)
    • Amazon AWS - Virtual Server (LP)
    • Amazon AWS Virtual Server Events
    • Amazon AWS - VPN Connections (LP)
    • Amazon AWS - VPN Gateway (LP)
    Note:
    For more information about the tags and patterns for each of these resources, see the documentation for the specific AWS resource.

    Request apps on the Store

    Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

    Prerequisites

    AWS Credentials
    • On the ServiceNow AI Platform, configure AWS credentials, using a secret key and an access key.
    • Have an Amazon Account ID. Use the Account ID as it appears in the AWS Management Console. You can run Discovery from the service account form.
    • Set read-only permissions for the following URL: https//tagging.<region>.amazonaws.com.
    Discovery schedule
    Create a schedule for the relevant AWS service account. For more information, see Create a discovery schedule in Cloud Discovery Workspace.

    Pattern tasks

    When discovering AWS tags, the pattern completes the following high-level tasks:
    • Sets the Resource Type filter: Filters the tags to only those tags related to the pattern CI type.
    • Initiates the Cloud API call: The API call to the cloud environment that collects the tags and parses their attributes in the Tags table.
    • Parses the resource name from the Amazon Resource Name (ARN). Each Amazon resource is assigned a name and a unique identifier.
      Note:
      Parsing the resource name is needed only for patterns where the main identification section does not work with the ARN of the AWS resource. When that is the case, a relation attribute has to be parsed from the AWS ARN.
    • Includes references to cloud resource type. Establishes the relationship between the tag and the cloud resource type.

    Cloud Rest Call

    The pattern includes an API called "Cloud Rest Call” Post Call used to collect the following data:

    • API URL used to retrieve the data — "https://tagging." + $ldc[1].object_id + ".amazonaws.com/“
    • API Body — "{\"ResourceTypeFilters\":[\"" + $resource_type + "\"]}“
    • Headers — "Content-Type:application/x-amz-json-1.1,X-Amz-Target:ResourceGroupsTaggingAPI_20170126.GetResources"

    This data displays as shown in the following window.

    Figure 1. Data from Cloud Rest Call
    Data from Cloud Rest Call

    Data collected by Discovery during horizontal discovery

    The pattern collects the following data during horizontal discovery:

    Table and field Additional information
    CI type [cmdb_key_value]
    Key Tag key
    Value Tag value
    Object_id

    Unique resource ID that identifies the resource in the AWS console.
    Class model [cmdb_key_value]
    Extends table Not applicable
    Identifier – Object_id Related entries to cloud resources
    Metadata rules Not applicable

    This data is displayed as shown in the following window:

    Figure 2. Data collected during horizontal discovery
    Data collected during horizontal discovery
    AWS discovery pattern uses the following EVAL:
    var rtrn;
var name = ${cmdb_key_value[].object_id}
name = name.substring(name.lastIndexOf("restapis/")+9,name.lastIndex);
name = name.substring(0,name.indexOf("/"));
rtrn = name;
    Similar EVALS are available for patterns where the main identification section does not include ARN information in the main CI type table. When this information is not available, the Tag Extension section must parse a unique ARN used to establish the relationship to the related cloud resource.