---
title: Set up an IAM account for a ServiceNow user in AWS
description: AWSCreate an AWS CloudFormation Identity Access Manager \(IAM\) user in the management account using the CloudFormation template \(CFT\). This allows you to manage multiple AWS accounts with a centralized IAM user.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/cloud-account-management/set-up-iam-account-in-aws.html
release: australia
product: Cloud Account Management
classification: cloud-account-management
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 3
breadcrumb: [Setting up AWS cloud, Configuring cloud providers, Configure, Cloud Account Management, ITOM Cloud Accelerate, IT Operations Management]
---

# Set up an IAM account for a ServiceNow user in AWS

AWSCreate an AWS CloudFormation Identity Access Manager \(IAM\) user in the management account using the CloudFormation template \(CFT\). This allows you to manage multiple AWS accounts with a centralized IAM user.

## Before you begin

-   Role required: AWS admin
-   The ServiceNow IAM user account requires specific AWS IAM permissions to perform basic operations. To learn more about the permissions, see [About Amazon Web Services API permissions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/cloud-account-management/about-aws-api-permissions.md).


## Procedure

1.  Log in to the AWS Management console and enter `CloudFormation` in the search bar and then select it.

2.  On the CloudFormation console, select **Create Stack**.

    A stack is a collection of AWS resources that you can manage as a single unit.

3.  Copy the CloudFormation template \(CFT\) code into a file and save the file.

    The file extension should be `.yml`. For example, `CreateServiceNowUser.yml`.

    ```
    AWSTemplateFormatVersion: '2010-09-09'
    Description: This script is executed in Management Account where the  ServiceNow user is created.
    
    Metadata:
      AWS::CloudFormation::Interface:
        ParameterGroups:
          - Label:
              default: User Credentials
            Parameters:
              - SNUserName
        ParameterLabels:
          SNUserName:
            default: User Name
    
    Parameters:
      SNUserName:
        Type: String
        Description: User name for CW Service Account user
        MinLength: '6'
        MaxLength: '15'
        ConstraintDescription: The username must be between 6 and 15 characters
    
    Resources:
      SnowCWMemberAccountAccessGroup:
        Type: 'AWS::IAM::Group'
        Properties:
          GroupName: SnowCWMemberAccountAccessGroup
    
      SnowCWAccountAccessPolicy:
        Type: 'AWS::IAM::Policy'
        Properties:
          PolicyName: SnowCWAccountAccessPolicy
          PolicyDocument:
            Statement:
              - Sid: ServiceNowCWUserAccess
                Effect: Allow
                Action:
                  - 'organizations:ListRoots'
                  - 'organizations:ListTagsForResource'
                  - 'organizations:DescribeAccount'
                  - 'organizations:CreateAccount'
                  - 'organizations:ListAWSServiceAccessForOrganization'
                  - 'organizations:TagResource'
                  - 'organizations:ListAccounts'
                  - 'organizations:ListRoots'
                  - 'organizations:ListTagsForResource'
                  - 'organizations:DescribeAccount'
                  - 'organizations:CreateAccount'
                  - 'organizations:ListAWSServiceAccessForOrganization'
                  - 'organizations:TagResource'
                  - 'organizations:ListAccounts'
                  - 'organizations:CloseAccount'
                  - 'organizations:DescribeOrganization'
                  - 'organizations:DescribeOrganizationalUnit'
                  - 'organizations:ListParents'
                  - 'organizations:ListOrganizationalUnitsForParent'
                  - 'organizations:MoveAccount'
                  - 'organizations:DescribeCreateAccountStatus'
                  - 'organizations:AttachPolicy'
                  - 'organizations:DescribePolicy'
                  - 'organizations:ListAccounts'
                  - 'budgets:CreateBudgetAction'
                  - 'budgets:ModifyBudget'
                  - 'budgets:ViewBudget'
                  - 'budgets:ListTagsForResource'
                  - 'iam:GetAccountSummary'
                  - 'iam:GetAccountPasswordPolicy'
                  - 'budgets:DescribeBudgetAction'
                  - 'iam:ListAccountAliases'
                  - 'sts:AssumeRole'
                  - 'iam:GetRole'
                  - 'iam:ListAccountAliases'
                  - 'iam:GetAccountPasswordPolicy'
                  - 'organizations:DetachPolicy'
                  - 'iam:GetAccountAuthorizationDetails'              
                Resource: '*'
          Groups:
            - !Ref SnowCWMemberAccountAccessGroup
    
      CreateServicenowUser:
        Type: 'AWS::IAM::User'
        Properties:
          Path: /
          UserName: !Ref SNUserName
      AddSnowUserToSnowCWMemberAccountAccessGroup:
        Type: 'AWS::IAM::UserToGroupAddition'
        Properties:
          GroupName: SnowCWMemberAccountAccessGroup
          Users:
            - !Ref SNUserName
        DependsOn: CreateServicenowUser
    
    Outputs:
      ServiceNowUserARN:
        Description: ARN of ServiceNow user
        Value: !GetAtt 
          - CreateServicenowUser
          - Arn
    
      ServiceNowUser:
        Description: ServiceNow user
        Value: !Ref SNUserName
    
    ```

4.  On the **Create Stack** page, select **Choose an existing template** > **Upload a template file** > **Choose file** to choose a template file from your local computer.

5.  Select **Next** to continue and to validate the template.

6.  On the **Specify stack details** page, enter a name for the template in the **Stack name** field.

    Note the following format requirements for a stack name:

    -   Can contain only case-sensitive alphanumeric characters and hyphens
    -   Must start with an alphabetic character
    -   Can't be longer than 128 characters
7.  In the **User Name** field, enter a Cloud Account Management service account user name.

8.  Select **Next** to continue.

9.  On the **Configure stack options** page, select the **I acknowledge that AWS CloudFormation might create IAM resources with custom names** check box and select **Next**.

10. On the **Review and create** page, select **Submit** to launch your stack.

    The IAM account gets created.

11. Add security credentials.

    1.  Select **Resources**.

    2.  Select the user name link.

    3.  In the Access Keys section, select **Create access key**.

    4.  On the **Access key best practices & alternatives** page, choose the **Third-party service** option.

        This access key provides access for a third-party application or service that monitors or manages your AWS resources.

    5.  Select the **I understand the above recommendation and want to proceed to create an access key** check box and select **Next**.

    6.  Select **Create access key**.

    7.  On the **Review access keys** page, download the access key file and select **Done**.

        **Note:** Share the access key and secret key with the Terraform admin and ServiceNow AI Platform admin.


## What to do next

[Set up suspension of an AWS account using service control policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/cloud-account-management/configure-suspension-policy.md)