The Service Graph Connector for AWS is designed to connect directly with AWS APIs without using MID Server. However, for some clients, they may need to use MID Server for security reasons as a proxy. The steps described below needs to be performed after installing Service Graph Connector for AWS.

Please note: We have seen from customers seeing slowness/timeout in getting data. It would be good to whitelist the AWS URLs and get data faster into the SN CMDB.

Assumptions:

• MID Server is already setup
• MID server is able to ping AWS APIs

Required Components:

• IntegrationHub Flow Designer

Steps:

1. Navigate to MID Server --> Applications.

2. Give a name and select the MID server as shown below.

*Note: SD Lab Mid is the mid server used for this demonstration. You may have different naming for your MID Server and you need to select appropriate MID Server.

3. Navigate to MID Server --> Capabilities. Create a new MID Server Capability. Select the MID Server as shown below and save.

4. Navigate to IntegrationHub --> Connections & Credentials --> Authentication Algorithms. Select “SG-AWS Auth Algo”.

5. In the Mid Authentication Script, select “RequestAuthAWSV4MIDSigner

6. Navigate to Flow Designer  Actions and search for the SG-AWS Components.

7. Check on Use MID, and select the MID selections as shown below. Repeat for each of the APIs listed for AWS.

Please note that the Credential Alias should be present only for these Flow Actions.

#	Flow Action Name	Internal Name
1	SG-AWS-Organizations-DescribeOrganization	sgawsorganizationsdescribeorganization
2	SG-AWS-EC2-DescribeRegions	sgawsdsec2describeregions
3	SG-AWS-STS-AssumeRole	sgawsstsassumerole
4	SG-AWS-EC2-DescribeInstanceTypes-Action	sgawsec2describeinstancetypesaction
5	SG-AWS-Organizations-ListAccounts	sgawsorganizationslistaccounts

For other flow actions, the Credential Alias field should be empty. You need to set these values in flow action for using MID server.

1. Use MID - Enabled
2. MID Selection
3. MID Application
4. Capabilities.

Note: Do not change Connection (Define Connection Inline), Base URL.

If other flow actions is set with Credential Alias, you may get the following error message and integration will not work as expected.

InvalidSignatureException","message":"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.

8. The below sample test shows, the API is using SG-AWS-Mid-Application.

Diagnostic Tool:

Once you complete the setup, you need to run the Diagnostic Tool in the guided setup to ensure the setup is working as expected. For more details, refer to this article.

Service Graph Connector for AWS - Diagnostic Tool

https://community.servicenow.com/community?id=community_article&sys_id=668651e71bde4150c465ece6b04bc...

Related Links:

Service Graph Connector for AWS - Introduction

https://community.servicenow.com/community?id=community_article&sys_id=13aa801f1b1ec910c465ece6b04bc...

Service Graph Connector for AWS - Functional Spec and CI

https://community.servicenow.com/community?id=community_article&sys_id=64e2949f1b9ec910c465ece6b04bc...