[Music] so today servicenow is going to present to you one of our most common customer questions how to integrate with aws using our best practice of a credential list assume role based integration i'm zach sargent i'm a product manager in the itom space governing some of our our cloud products and cloud integrations and i'm here with brian quinn brian you want to introduce yourself hello i'm brian quinn i'm with the itom product success team focusing on our cloud products so the first step that we have to do is to set up a role or a policy for a mid server inside of aws you want to go over that a little bit brad sure so first we'll take a look at my overall organization so i have a demon demo organization here with a management account and then two member accounts underneath it um today we'll be setting up member account one with this role that the mid server will eventually use uh so in my member account one i've created a role called servicenow ec2 role and i have granted it two policies one policy is the read-only access and the other role is a custom policy that allows us to assume role into other accounts in this case i have i have the policy set up to allow me to assume role into any other account and i'm always going to assume role to this servicenow assumed role and you're using that label as a as a common label across multiple accounts right so if customers have like 100 accounts they're using that same label here yes so this this uh this role name would be created in all hundred accounts uh if you were trying to assume roll into all hundred accounts okay and so then the next thing they would do is to set up the actual mid server right and that's a regular ec2 instance they would size that to meet whatever their expected discovery or provisioning demands were how does this attach to that instance so in ec2 if you're looking at your instances there should be a section for iam role this can be specified when you first provision it or it can be added attached to the ec2 instance uh after the fact but here i have i make sure to attach this role to the ec2 instance running the mid server uh one thing to to note uh when you when you when i created this role it's important to make sure that trust relationship is to the identity provider ec2 um which will allow this role to be attached to an ec2 instance and will allow this ec2 instance to then have those permissions okay now this is set up in one of the member accounts right so this is a regular vpc a regular ec2 instance uh nothing terribly special here to get the whole organization though we're going to have to have some trust from the master account right can you can you show us what that looks like sure so in our master account or the management account uh i also have a role and as we were talking about before uh i'm using this label servicenow assumed role so i have this role created with a trust relationship back to the ec2 role that from the midst account running the mid server um so this will trust back to that that role and allow us to assume roll into the master account and for this particular role i've granted read-only access so i can discover all the resources within this account and i've also attached the aws organization's read-only access which will allow servicenow to discover all the member accounts underneath in the organization so for the member accounts once we've discovered those is there something else that needs to happen here from within the server on the aws console yeah so then each of our additional member accounts will also need the same iam role uh so again we're using the label servicenow assumed role in this case with the same trust relationship back to the account running the mid server and the role that's attached to that ec2 instance for this particular member account i have read only access which is required anytime you want to discover the resources within the account in this case i also have another custom policy to allow provisioning which you could build upon as needed if you're using the cloud provision and governance product cool so that would allow us to deploy things into this account yes all right i guess from here let's go back to the service now instance so if i've freshly set up my mid server in ec2 where would i find that so you find it under your normal mid server list you'd have to validate it as normal you make sure you have the aws capability attached to it and then under configuration parameters we want to add a new configuration parameter for mid.aws.instanceprofilename and this we want to make sure it's set to the role that is attached to the ec2 instance um that we assigned all the policies to okay and so that's our cue for this mid server to understand that we can assume role then from within servicenow yes okay so from here how do we move forward towards discovery if we're setting up some kind of service account i guess that's using this yeah so at this point we would create service accounts um we would create uh at the very least we will create the member account uh that has the the aws mid server running in it um we would create this we would leave the credentials blank since we're going to use the delegated permissions and assume roles the parent account at this point you can leave blank we will eventually auto discover that and the accessor account should be blank so and the is master account should be false after creating the member account you can create the master account as well uh and again discovery credentials that we're going to leave blank because we're going to assume role uh parent account uh is is empty and is master is true and the important part is setting the accessor account to point to the service account that has the mid server running in it okay so once we have our our first two accounts here the sub account where the mid server lives and the master account can we discover the the remaining accounts what uh what what do we do next so before we can discover uh the other member accounts we do need to set up one other piece and that is under [Music] the cross assume roles table so we will set up a record here that says when i am trying to access the uh master account or the management account i am going to assume use this role name to assume into so i'll create a record here in the cross assume role table uh so servicenow knows what role to assume and then once this is created now i should be able to go to my service account and i should be able to do both the discover data centers and a refresh sub accounts and the refresh sub accounts here should discover uh all of my other member accounts okay so we should see that second sub account here then yeah so now if you look at the cloud service accounts now there are both uh both member account one and member account two now can i just create a discovery schedule for member account two from here is there something else that i need to link in so at this point we've created this service account for member account two but we do need to go back and create the process zoom uh cross-assume role uh parameter for the member account too so i can go in here uh select new uh cloud service account will be my member account too and this access role name will be the service now assumed role and now we should be ready to set up discovery um for all three accounts uh this process right now is manual but it could be automated through business rules if there's a a logic that you can apply to automatically uh create these records so like we were saying before if a customer had a hundred sub accounts they could use a business rule here to you know automatically fill that in for those sub accounts as long as they're using the same label yep yep so you could have a business rule anytime a new service account is created to also create a record in this table as well awesome so let's go create some discovery schedules all right so from here we can go to discovery schedules and cloud discovery which will launch our wizard we can select the provider it's aws schedule name or discovery we will select the account we will select the management account we will leave credentials blank we should be able to test the moment of truth right so we should be able to show that it was validated we should already have the member accounts discovered here but we could always do a refresh again if there were any accounts that we missed they would pop up here but you would have to go create the cross assume role record again um we go to next we can select data centers we do want to do a refresh data centers here to make sure that all of the member accounts have the logical data centers discovered so you just want to make sure you click on that button in this case i want my discovery schedule to discover all my data centers so i'll leave this toggled on we have the option to kick off a horizontal discovery afterwards in this case i don't want that so i'm going to turn this off and now i can create the schedule finish and run for the first time cool so from here if we had more that we were going to do once we have discovery done let's say that we had cloud provisioning and governance we could then once this completes go set up our cloud accounts and set up our permissions for permission provisioning into that correct yes so we would have to make sure like i showed before we'd have to make sure our member accounts that we're provisioning into have an appropriate policy with all the appropriate permissions and then you would go through the normal uh cpg setup for creating a cloud account and choosing what logical data centers um are associated with that cloud account great hey thanks brian i think this is going to be a big help for folks thank you