Skip to tutorial content
Rate module Not yet rated

Cloud Account and IAM Prerequisites

4 min read
On this page

In this lesson, you will learn:

  • What cloud prerequisites are needed
  • Why read-only access matters
  • SNWR’s AWS setup

🔁 Quick look back: Last time: How Cloud Discovery Works: API vs IP. You learned how Cloud Discovery reads cloud APIs, and where IP scans still help.

1 The Problem: Cloud Access Needs Its Own Approvals

AWS access isn’t a normal server account. Kenji must create it in AWS, and Farah must approve it. Without it:

  • Cloud Discovery can’t log in.
  • Too much access would break security rules.

🎯 The problem: Cloud access needs its own setup and approvals.

👉 The fix: Ask for a read-only role, trust settings and network access, early.

Table of AWS prerequisites.
Figure 1. SNWR’s AWS prerequisites.

2 What to ask for

  • A read-only role or user for Discovery.
  • The account and regions in scope.
  • Network access from the MID Server to the cloud APIs.
  • Security approval.

💡 Good to know: ServiceNow’s docs list the permissions Cloud Discovery needs for each provider. Share that list with the cloud team.

3 Read-only matters

⚠️ Least privilege: A cloud role that can change or delete resources is a big risk. Discovery only needs to read.

4 Project Clear View: How We Implemented It

📍 Situation: AWS access was on the prerequisites list.

🧭 Decision: Ask Kenji for a read-only role and get Farah’s approval.

🛠️ Steps we took:

  1. Sent Kenji the documented permission list.
  2. Kenji created snwr-discovery-readonly.
  3. Farah reviewed and approved it.
  4. Confirmed snwr-mid-aws-01 reaches the AWS APIs through the proxy.

✅ What we verified:

  • The role only reads.
  • The MID Server can reach the APIs.

📁 Evidence: AWS prerequisites marked done in the tracker.

5 Quick recap

  • Cloud access needs a role, trust, network access and approval.
  • Use read-only rights only.
  • Share the documented permission list with the cloud team.
  • Check the MID can reach the APIs.

6 Check yourself

Think of your answer first. Then tap to check.

1 What’s SNWR’s AWS role called? Show answer

snwr-discovery-readonly.

2 Why read-only? Show answer

Discovery only needs to read, and change rights are a big risk.

3 Which region is in scope? Show answer

ap-south-1 (Mumbai).

Nice work! SNWR’s AWS access is ready. 🎉
Next up: Connecting the SNWR AWS Account

Was this lesson helpful?

Have a question or doubt?

Ask here and get help from instructors and fellow learners.

0 / 300

Only logged-in learners can post.