--- title: Configure Service Graph Connector for AWS using the guided setup description: Set up the AWS environment and scheduled jobs to pull in AWS data into the CMDB. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/servicenow-platform/service-graph-connectors/configure-aws-integration.html release: australia product: Service Graph Connectors classification: service-graph-connectors topic_type: task last_updated: "2026-03-12" reading_time_minutes: 16 breadcrumb: [AWS, Service Graph Connectors, Integrating third-party data into CMDB, Configuration Management, Extend ServiceNow AI Platform capabilities] --- # Configure Service Graph Connector for AWSusing the guided setup Set up the AWS environment and scheduled jobs to pull in AWS data into the CMDB. ## Before you begin **Important:** Unless there are configuration issues, use the SGC Central view in the Service Graph Workspace or CMDB Workspace to configure the connection for the connector, as the guided setup method is planned for deprecation. To use this Service Graph Connector, you need a subscription to a Subscription Unit that is based in the IT Operations Management \(ITOM\) Visibility application or in the ITOM Discovery application. As defined in the section titled "Managed IT Resource Types" in [ServiceNow Subscription Unit Overview](https://www.servicenow.com/products/entitlements-packages.html) for your subscription, for managed IT resources that are created or modified in the CMDB by this Service Graph Connector, but that aren’t yet managed by [ITOM Visibility or ITOM Discovery](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/it-operations-management/itom-license-module.md), these resources will increase Subscription Unit consumption from that application. Review your current Subscription Unit consumption within ITOM Visibility or ITOM Discovery to ensure available capacity. Dependencies and requirements: - The [Integration Commons for CMDB](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/servicenow-platform/cmdb-integration-commons/integration-commons-for-cmdb.md) store app, which is automatically installed. - The CMDB CI class models store app, which is automatically installed. See [CMDB CI Class Models app](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/servicenow-platform/cmdb-ci-class-models/cmdb-ci-class-models.md). - Discovery Core plugin \(com.snc.discovery.core\), which is automatically installed by Discovery. - The ITOM Discovery License plugin \(com.snc.itom.discovery.license\). You must activate this plugin. - ITOM Licensing plugin \(com.snc.itom.license\). For more information, see [Request Discovery](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/it-operations-management/t_ActivateTheDiscoveryPlugin.md). Ensure that you’ve completed the prerequisites for setting up AWS. See [Configure the AWS environment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/servicenow-platform/service-graph-connectors/sgc-cmdb-aws-task-overview.md). **Note:** When upgrading from an earlier version, ensure that you’ve updated the SSM documents and IAM permissions in your AWS instance. - For updating SSM documents, run the `SG-AWS-RunShellScript-Setup.yml`, `SG-AWS-RunPowerShellScript-Setup.yml`, and `SG-AWS-RunKubeCtlShellScript.yml` scripts. - For updating the IAM permissions assigned to the SnowOrganizationAccountAccessRole role, run the `CreateSnowOrganizationAccountAccessRoleInMemberAccount.yml` script. Role required: SGC-Admin \(sn\_cmdb\_int\_util.sgc\_admin\) or admin **Note:** The admin user role is required to run background scripts and to provide access to global tables to the SGC-Admin user. For information about the user roles for Service Graph Connectors, see [Service Graph Connector user roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/servicenow-platform/configuration-management-database-cmdb/cmdb-sgc-intro.md). ## About this task For more information on the **Service Graph Connector for AWS** setup instructions, see the following articles: - [Service Graph Connector for AWS - Setup Instructions \[KB1220597\]](https://support.servicenow.com/kb_view.do?sysparm_article=KB1220597) article on the Now Support Knowledge Base. - [Service Graph Connector for AWS - Introduction](https://www.servicenow.com/community/cmdb-articles/service-graph-connector-for-aws-introduction/ta-p/2300757) on the ServiceNow Community site. - [SGC-AWS - Release 2.0 Features](https://www.servicenow.com/community/cmdb-articles/sgc-aws-release-2-0-features/ta-p/2511663) on the ServiceNow Community site. If you upgrade the connector, complete the following tasks before the upgrade process: - If there are any customizations, delete the records associated with the Service Graph Connector for AWS from the Customer Updates \[sys\_update\_xml\] table. See [Customer Updates table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r_CustomerUpdatesTable.md). - Upgrade any dependencies. After you've installed the latest version of the Service Graph Connector for AWS: - Perform a full import of data from your AWS instance. Verify that the **Use last run datetime** field value is cleared for all the AWS data sources in the Data Source \[sys\_data\_source\] table. - Download and rerun the AWS scripts. See [Configure the AWS environment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/servicenow-platform/service-graph-connectors/sgc-cmdb-aws-task-overview.md). ## Procedure 1. Ensure that you’ve selected the **Service Graph Connector for AWS** application scope by using the application picker. For more information, see [Application picker](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/application-development/c_ApplicationPicker.md). 2. Navigate to **All** > **Service Graph Connectors** > **AWS** > **Setup**. 3. [Configure the AWS environment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/servicenow-platform/service-graph-connectors/sgc-cmdb-aws-task-overview.md). **Note:** For the Download the scripts task, select **Configure** to download the scripts. After you’ve downloaded the scripts and configured the AWS environment, set the Download the scripts and AWS Setup Instructions tasks to complete. 4. Configure the authentication credentials to authenticate requests sent to the AWS APIs. 1. Configure your AWS credentials. 1. For the Configure the connection section of the Service Graph Connector for AWS page, select **Get Started**. 2. For the Configure the credentials task, select **Configure**. 3. In the **Name** field, enter a name for the authentication. `SG-AWS-Credentials-Org` is the default credential alias name. You can add multiple AWS instances. However, don’t modify the default connection alias. 4. Enter the access key ID and the secret access key in the **Access Key ID** and **Secret Access Key** fields respectively. The AWS access keys are long-term credentials for the IAM user and include two parts: an access key ID and a secret access key. You must use both the access key ID and the secret access key together to authenticate requests. 5. Return to the Configure the connection task page by selecting the back icon \(<\). 6. Set the Configure the credentials task to complete by selecting **Mark as Complete**. 2. Test the AWS API connection to import data from the AWS application. 1. For the Test the connection task in the Configure the connection section, select **Configure**. 2. Select the **Test Connection** related link. 3. When the **Status** field is set to **Success**, select the back icon \(<\) to return to the guided setup. 4. Set the Test the connection task to complete by selecting **Mark as Complete**. 3. Update the required configuration properties for an AWS instance. 1. For the Update configuration properties for instance task, select **Configure**. 2. On the SG-AWS Configuration Properties form that opens in a new tab, review, and modify the fields.
| Field | Description |
|---|---|
| Connection Details | |
| Connection Alias | Name to identify the AWS connection record. For example, `SG_AWS_CredentialAlias_Org`. You can add multiple AWS instances. However, don’t modify the name for the default connection alias `SG_AWS_CredentialAlias_Org`. |
| Organization Details | |
| Organization Account | Numeric account identifier of the AWS organization. |
| Organization Name | Name of the AWS organization. |
| Organization Description | Description of the AWS organization. |
| AWS Regions | |
| Regions | AWS regions to collect the CI data.By default, the Service Graph Connector for AWS runs through all the AWS regions to collect the CI data. You can enter AWS specific regions to speed up the CI data import process. For example, `us-east1, us-east-2`. If this field is left empty, the Service Graph Connector for AWS pulls the resources from all the AWS regions. However, for the AWS GovCloud regions, don’t leave the **Regions** field empty. The supported AWS GovCloud regions are `us-gov-east-1` and `us-gov-west-1`. If you update the **Regions** field value later, clear the value of the **Last run datetime** field in all the data sources related to the Service Graph Connector for AWS to import a new set of data. |
| STS Assume Role Name | |
| STS Role | AWS Identity and Access Management \(IAM\) role name that is obtained by the ServiceNow user by calling the AssumeRole API offered by the AWS Security Token Service \(STS\). The AssumeRole API returns a set of temporary security credentials for the ServiceNow user to access the AWS resources.**Note:** Enter the IAM role name but don’t prefix `arn` in the name. If you leave this field is empty, the value of this field is automatically set to **SnowOrganizationAccountAccessRole**, which is the default IAM role name for the ServiceNow user. |
| S3 Account Details | |
| S3 Account Id | Numeric identifier of the AWS account that hosts the Amazon Simple Storage Service \(Amazon S3\) bucket. |
| S3 Bucket Name | Name of the Amazon S3 bucket that collects the details from Amazon EC2 instances. |
| S3 Region | Region where the Amazon S3 bucket resides. |
| SSM SendCommand Document Details | |
| SSM Send Command Linux Name | Name of the document that defines the actions run by the AWS Systems Manager \(SSM\) on a Linux-based Amazon EC2 instance. |
| SSM Send Command Windows Name | Name of the document that defines the actions run by the AWS SSM on a Windows-based Amazon EC2 instance. |
| Management Account ID | |
| Management Account ID | Management account in the AWS organization. The account calls the ListAccounts API associated with the AWS organization to collect CI information from all the accounts. For more information, see [ListAccounts](https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListAccounts.html) on the AWS documentation site.Enter a value for this field when the ServiceNow user was created in an AWS member account. |
| Standalone Account ID Details | |
| Standalone Account ID | ID of a member account in the AWS organization.**Note:** When specifying a standalone account, AWS organization-related data such as the organization name, organization units, organization ID, and service accounts are not imported. If you want to import the full data later, clear any value mentioned in the **Standalone Account ID** field. See the [Service Graph Connector for AWS - Standalone Setup \[KB1642159\]](https://hi.service-now.com/kb_view.do?sysparm_article=KB1642159) article in the Now Support Knowledge Base. |
| AWS Config Aggregator Details | |
| Config Aggregator Account | AWS account where the aggregator resource type in the AWS Config service has been configured.Enter a value in this field when you’re using an AWS Config aggregator. |
| Config Aggregator Name | Name of the aggregator resource type. This field is available only when you enter a value in the **Config Aggregator Account** field. |
| Config Aggregator Region | Region where the aggregator resource type resides. This field is available only when you enter a value in the **Config Aggregator Account** field. |
| AWS Key Rotation Setup | |
| AWS Rotate Keys | Option to enable the key rotation process. |
| AWS Key Rotation Date | Key rotation date. Set the value to the required key rotation date for the first run. For subsequent runs, this field is automatically set to the rotation date. This field is available only when you select the **AWS Rotate Keys** check box. |
| AWS Key Rotation Period \(in Days\) | Key rotation period in days. This field is available only when you select the **AWS Rotate Keys** check box. |
| AWS Key Rotation Status | Status message of a key rotation displaying whether the rotation was a success or a failure. This field is automatically set to display the key rotation status message. This field is available only when you select the **AWS Rotate Keys** check box. If the rotation status is a failure, an email notification is triggered, if configured. |
| Email accounts for receiving error notifications | Comma-separated list of the email addresses of recipients who receive notifications about the AWS key rotation errors. |
| Email account groups for receiving error notifications | Comma-separated list of the ServiceNow groups who receive notifications about the AWS key rotation errors. |
| Gov Cloud Setup | |
| Is Gov Cloud | Option to indicate that the connection setup is for the AWS GovCloud. |
| SSM EKS SendCommand Document Details | |
| EKS Cluster Names Document | Name of the AWS SSM document to discover EKS clusters associated with EC2 Bastion hosts. |
| EKS Shell Script Document | Name of the AWS SSM document to fetch CIs related to Kubernetes components, such as pods, services, and deployments, from EKS clusters. |
| Field | Description |
|---|---|
| EKS EC2 Resource Id | Identifier of the EKS EC2 resource. |
| EC2 Account | User name assigned to the EKS EC2 resource account. |
| EC2 Region | AWS region where the EKS EC2 resource is located. |
| Active | Option to activate the EKS EC2 resource.**Note:** Set to false, if you are not using the EKS EC2 resource resource. |
| Connection | Connection alias associated with the AWS environment setup and configured in step [4.a](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/servicenow-platform/service-graph-connectors/configure-aws-integration.md). |