In this video, you’ll see how to integrate AWS products into your ServiceNow Portal via the AWS Service Management Connector.
With the connector, ServiceNow users are able to:
Request, update, and terminate curated AWS products in ServiceNow Service Catalog via AWS Service Catalog portfolios and products;
See near-real time resource details and relationships via the ServiceNow Configuration Management Database (CMDB)
that can scale with the cloud powered by AWS Config;
Request permitted automation playbooks on AWS resources in ServiceNow via AWS Systems Manager Automation runbooks;
View and manage operational items as incidents in ServiceNow via AWS Systems Manager OpsCenter;
andManage and resolve AWS Security Findings as ServiceNow incidents or problems via a dual sync powered by AWS Security Hub.
These features simplify AWS product request actions for ServiceNow users and provide ServiceNow governance and oversight over AWS products.
ServiceNow is an enterprise service management platform
that places a service oriented lens on the activities, tasks, and processes that enable a modern work environment.
From the ServiceNow portal, end users can access a centralized catalog to order IT services based on request fulfillment approvals and workflows.
To get started, let’s take a quick look at the ServiceNow Service Catalog.
Users can browse for services by category, such as those offered by different departments in your organization.
They can submit and manage their own service requests.
They can also request approved hardware and software.
You can make AWS cloud services available to users here by using the AWS Service Management Connector for ServiceNow.
The online documentation provides detailed instructions.
Be sure to review the prerequisites for AWS and ServiceNow before starting this integration in your environment.
To make this process easier,
you can use an AWS CloudFormation template to configure your AWS account with the policies, roles, and users you’ll need for the connector.
You can also do these steps manually by following the documentation.
Let’s navigate to the Baseline Permissions section to download the template.
Select the configuration for AWS Commercial Regions.
Now let’s switch to the AWS Management Console.
Open CloudFormation and create the stack.
Specify the template file you just downloaded.
Next, give this stack a name.
Because some products you make available through ServiceNow might need to perform stack operations across multiple regions,
you need to have the necessary permissions defined in your AWS accounts.
Keep this parameter set to true to create the roles needed for these operations.
Acknowledge the terms, and then create the stack.
After a few minutes, the stack will complete the deployment.
Let’s take a look at all the resources that were deployed.
These include the policies, roles, and users that are needed to configure the connector.
Next, make sure that AWS Config is enabled in the regions you are integrating with the connector.
Here we can see that AWS Config is enabled.
Next, let’s navigate to the AWS Identity and Access Management (IAM) to review the roles that were just created.
Here, we can see the roles deployed by the template, which include the optional StackSet roles.
The LaunchRole is used to place baseline service permissions into the AWS Service Catalog launch constraints.
The template also created two user accounts.
SyncUser is used to sync AWS portfolios, products, and SSM documents (playbooks)
to ServiceNow catalog items, as well as AWS Config resource details to ServiceNow CMDB.
EndUser enables the connector to provision AWS products by assuming
a role that contains the trust relationship with the account and policies needed for the end-user privileges in AWS Service Catalog.
Let’s take a closer look.
For each user account, be sure to note the access key ID and secret key value.
You'll need those to configure the connector.
Next, let’s look inside AWS Service Catalog.
The CloudFormation template we deployed also created a sample portfolio in AWS Service Catalog.
Let’s use it to demonstrate how to set up the connector.
This portfolio contains a single product that allows users to create Amazon Simple Storage Service (Amazon S3) buckets in this account.
A launch constraint has already been defined for this product, using the SCConnectLaunchRole.
The Service Catalog EndUser role has also been granted access to this portfolio.
Now that you’ve reviewed all the initial setup in AWS, let’s navigate to the ServiceNow Fulfiller view to see how to set up the connector.
First, you need to enable the UserCriteria API, which allows you to create, modify, or delete user criteria records using scripts.
To do this, let’s navigate to the available plugins.
Search for the User Criteria Scoped API.
Now activate this API, which is a requirement for the connector.
Next, return to the available plugins.
Search for “Discovery.”
The Discovery and Service Mapping Patterns plugin is free and is needed to align to the ServiceNow CMDB that stores information about all technical services.
Install the plugin.
Next, locate the AWS Service Management Connector in the ServiceNow Store.
From this product page, you can now request to install the connector.
The AWS Service Management Connector is available at no charge for ServiceNow’s Quebec, Paris, and Orlando platform releases.
The connector is released as a conventional ServiceNow scoped application via a ServiceNow Update Set.
The update set is also available as an XML file in the public AWS Service Catalog documentation for configuring ServiceNow.
Proceed to install the update set into the ServiceNow environment.
Use the link to import the update set from XML.
Choose the file you downloaded from the store.
Once the upload has completed, you can select the option to preview the update set,
which will validate the connector update set and let you know if there are any issues.
The preview completed, and no issues have been reported.
Next, to enable the AWS Service Management Connector for ServiceNow, you must create a discovery source and configure specific platform tables, forms, and views.
Let’s create a new discovery data source called “AWS Service Management Connector.”
To get started, navigate to Choice Lists.
Choose New.
The discovery source will allow AWS to report discovered configuration items into the CMDB.
For AWS products to display as subcategories under AWS portfolios in the ServiceNow Service Catalog,
you need to update the Catalog Item Category table.
Let’s find it.
Switch to the Application Access tab, and then select the can create, can update, and can delete options.
Now click Update to update permissions on this table.
Next, let’s look at user privileges.
The AWS Service Catalog scoped app comes with three ServiceNow roles that have permission to manage aspects of the application.
This enables system admins to grant other users privileges to administer the application without having to open up full sysadmin access to them.
These roles can be assigned either to individual users or to one administrator user.
In this example, let’s assign all of these roles to the existing Admin account.
Click Edit, and then search for the roles to add to this user.
Add the roles and save the change.
Now let’s add “AWS Service Catalog” as a new category in the ServiceNow Service Catalog.
On this screen, make sure AWS Service Catalog is selected as the catalog category, and then choose where you want to add it.
Next, let’s add a new change request type to make the scoped application trigger an automated change request.
To add the new type, navigate to an existing change request in the system.
From here, you can view the choice list for the change request types.
Click New and define a choice.
Once you’ve completed the form to define the choice, click Submit.
Next, you need to create a new group to allow end users to order AWS Service Catalog products.
Now that a group has been created, let’s assign some users to it.
Assign the admin user to the group.
Let’s add an example end user to the group, as well.
Now that we’ve completed the prerequisites, we can begin the connector configuration.
This Getting Started page provides links to the instructions on the AWS website.
Next, in the AWS Service Catalog scoped app Accounts menu, create a new account.
Provide the access IDs and secret access keys associated with both Sync User and End User.
This is where you can select which AWS services you want in scope for this account.
AWS Systems Manager OpsCenter is a new integration option that enables users to view,
investigate, and resolve operational items related to their AWS resources from ServiceNow.
In this case, let’s leave all the options selected.
Next, double-click Insert a new row to select the regions you want to sync the connector to using this account.
Next, let’s validate the account.
During the initial setup, manually sync all accounts instead of waiting for Scheduled Jobs to run.
Execute this script to perform the initial sync.
Data becomes visible in the AWS Service Catalog scoped app menus once the adapter’s scheduled synchronization job has run.
To grant access to AWS Service Catalog products in ServiceNow, you must establish a link between
the connector and the account entry created in the ServiceNow AWS Service Catalog scoped app.
This is done from the Portfolios screen.
Let’s associate the group we created earlier with the connector so that members of that group can request services.
Next, let’s see how you can define custom tags that will let you audit AWS product provisioning from ServiceNow.
Under Setup, select Automated Tags.
First, we’ll create a metadata tag that captures the name of the user making the request.
Tags can be applied globally or at the portfolio level. We’ll apply ours globally.
Next, we’ll create a generic tag that specifies that the product is being provisioned in ServiceNow.
We’ll make the third tag selectable by the user so they can choose the appropriate ServiceNow cost center.
Tag selections must be mapped to a specific table field in ServiceNow.
Finally, we’ll create a request item–based metadata tag.
Next, let’s see how ServiceNow administrators can add the My AWS Products widget to their ServiceNow Portal home page
so they can monitor their AWS product requests, view outputs, and perform post-operational actions such as update, terminate, and self-service actions.
To begin, navigate to the Service Portal Configuration screen.
Launch the Designer.
Now filter to the Service Portal and select the index.
Search for the My AWS Products widget.
This widget is needed for the user to perform post-operational actions on provisioned products.
Now, simply drag the widget onto the location on the page where you want it to appear.
Let’s preview the changes.
Configuration of the connector is complete.
Next, let's test this out by signing in to the service portal as the end user that has been granted access to the AWS Service Catalog through the group assignment.
Navigating to the catalog, you can see that the new AWS Service Catalog entry is displayed.
Here is the sample product that was configured in the AWS Service Catalog portfolio.
Type in a name for this product.
The user can edit the parameters for this product if needed.
These are the same parameters they would specify if they provisioned the product directly through AWS Service Catalog.
All the settings have been imported here.
Here is the cost center tag we created earlier with user-selectable values.
Users can also fill in any other tags and values that they want.
Now the user can order the product.
After a couple of minutes, they can review the status and see that the order has been fulfilled.
Returning to the home screen, notice that the widget has also been populated with details on this order.
Now, when this user signs in to AWS with appropriate permissions, they can see the bucket that was just created.
The bucket is now ready to use.
Next, let’s review some additional functionality of the connector.
Let’s take a look at Provisioned Products.
Here, admins can review and manage all the AWS Service Catalog products that your organization has provisioned from ServiceNow.
For instance, you can update and delete existing products if needed.
If AWS Config integration has been enabled with the connector,
then all your configuration data for AWS services in the specified regions will be visible here, in ServiceNow.
This information is for all products in AWS, not just products provisioned through ServiceNow using AWS Service Catalog.
For example, here you can see all the Amazon Elastic Compute Cloud (Amazon EC2) instances that AWS Config is reporting.
You can drill down to view more information on a specific EC2 instance.
You can even view and interact with dependency visualizations that show how all resources for an EC2 service are related.
Next, let’s navigate to AWS Systems Manager Automation Documents.
You can view and execute Automation documents here if AWS Systems Manager integration is enabled.
Admins can even configure ServiceNow to make Automation documents available to end users for execution,
or they can deactivate or hide documents to prevent them from being used.
You’ve just seen how to integrate AWS products into your ServiceNow Portal via the AWS Service Management Connector.
You can learn more about this topic in the description and links for this video.
Thanks for watching. Now it’s your turn to try.