--- title: Configure access for trusting AWS member accounts in trust chain description: Configure access for AWS member accounts by using a trust chain from the accessor through the management account. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/configure-iam-role-aws-member.html release: australia topic_type: task last_updated: "2026-03-12" reading_time_minutes: 3 breadcrumb: [Setup AWS service accounts, Set up a cloud service account, Access to cloud environments for ITOM products, IT Operations Management] --- # Configure access for trusting AWS member accounts in trust chain Configure access for AWS member accounts by using a trust chain from the accessor through the management account. ## Before you begin - Familiarize yourself with the Amazon documentation on [Creating a role to delegate permissions to an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html). - Ensure that you know which AWS member accounts are assigned to the same management account. You use the management account for configuring temporary credentials for cloud discovery using IAM roles. - Confirm that Discovery Admin Workspace is using at least version 1.10.0. The **Discovery** > **Cloud Service Accounts** navigation module isn't available with earlier versions. To access **Cloud Service Accounts** with an earlier version, enter in the navigation filter: `cmdb_ci_cloud_service_account.list`. Role required: - For Cloud Discovery: discovery\_admin - For Cloud Provisioning and Governance: admin or sn\_cmp.cloud\_admin ## About this task You can configure access for AWS member accounts by using a trust chain from the accessor through the management account. The accessor account either has AWS credentials or uses a credential-free method. \[Omitted image "aws-member-account-trusted-with-credentials.png"\] Alt text: Set up the IAM role of the trusting member accounts to trust their management account, which in turn trusts an accessor account ## Procedure 1. Create an IAM role for the member account and configure the trust relationship between the user assuming this role and the trusted management account. 1. Log into the AWS Management Console using the credentials of the member account for which you are configuring access. 2. Create and configure the IAM role specifying the management account ID in the **Account ID** field. For operational information about creating AWS roles, refer to the Amazon documentation. 3. On the **Summary** page for the IAM role, click the **Trust Relationships** tab. 4. Click **Edit trust relationship**. The Edit Trust Relationship page opens showing the policy document. 5. Edit the trust relationship as follows: - Set the **Action** parameter to `sts:AssumeRole` - Set the `AWS` parameter to the full role ARN of the management account. \[Omitted image "aws-edit-trust-relat-member-iam.png"\] Alt text: Editing trust relationship for the trusting account. 6. Click **Update Trust Policy**. 2. On the ServiceNow AI Platform, configure the trusting member's service account. 1. Navigate to **All** > **Discovery** > **Cloud Service Accounts**. 2. Select **New**. 3. In the **Parent account** field, enter the name of the management account. 4. On the form, fill in the remaining fields. For a description of the field values, see [Create AWS service accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/create-aws-service-accounts.md). 5. Select **Submit**. 3. On the ServiceNow AI Platform, assign the AWS IAM role to the member account. **Important:** Perform this step only if you created custom IAM roles. By default, the OrganizationAccountAccessRole role is assigned to the member’s trusting management account and you don't need to assign the OrganizationAccountAccessRole role to a service account. 1. Navigate to **All** > **Cloud Provisioning and Governance** > **Organization Access Parameters** > **AWS Org Assume Role Parameters**. 2. Select **New**. 3. On the form, configure only the following fields for the trusting member account:
Field Definition
Access role name Name of the IAM role created for the trusting account.- If IAM roles are the same across all member accounts: Enter the full ARN using an asterisk \(\*\) as a wildcard for the account ID in the format: `arn:aws:iam::*:role/MemberRoleName`. For example: `arn:aws:iam::*:role/SN_MEMBER_ACCOUNT_ROLE`. - If IAM roles are different across member accounts: Enter the full ARN of the specific IAM role for each member account in a separate entry.
Cloud service account Name of the trusting account for which you are providing access using the IAM role.- If IAM roles are the same across all member accounts: Enter the management account name. - If IAM roles are different across member accounts: Enter each member account in a separate entry.
4. Select **Submit**. ## What to do next Configure the trusting management account and the trusted accessor account. - For information on configuring accessor accounts with AWS credentials, see [Configure temporary credential access for trusted AWS accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/configure-iam-role-aws-account.md). - For information on configuring accessor accounts without AWS credentials, see [Configure credential-less access using trusted AWS accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/aws-trusted-credential-less.md). **Parent Topic:**[Setup AWS service accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/setup-aws-service-accounts.md)