Creating AWS Service Management Connector Sync user

This section describes how to create the AWS Sync user and associate the appropriate IAM permission. To perform this task, you need IAM permissions to create new users. The following steps to create a Sync user and End user are not required if you use the CloudFormation template ito deploy the permissions. See the AWS configurations for Connector for ServiceNow 4.5.0 AWS Commercial Regions and AWS GovCloud Regions.

Note

The AWS CloudFormation template to set up the AWS configurations of the Connector for ServiceNow creates the Sync user and End user with the required permissions for all the supported integrations.

To create AWS Service Management Connector sync user

1. Follow the instructions in Creating an IAM user in your AWS account to create a sync user (SMSyncUser). The user needs programmatic and AWS Management Console access to follow the Connector for ServiceNow installation instructions.

2. Set permissions for your sync user (SMSyncUser). Choose Attach existing policies directly and select:

   • AWSServiceCatalogAdminReadOnlyAccess (AWS managed policy)

   • AmazonSSMReadOnlyAccess (AWS managed policy)

   • AWSConfigUserAccess (AWS managed policy)

   • AWSSupportAccess (AWS managed policy)

3. Create this policy: ConfigBidirectionalPolicy. Then follow the instructions in Creating IAM Policies, and add this code in the JSON editor:

   {
      "Version: "2012-10-17",
      "Statement": [
        {
            "Action": [
            "cloudformation:RegisterType",
            "cloudformation:DescribeTypeRegistration",
            "cloudformation:DeregisterType",
            "config:PutResourceConfig"
        ],
        "Resource": "*",
        "Effect": "Allow"
        }
      ]
   }                                       

   The provided AWS Configuration template consists of two policies: ConfigBiDirectionalPolicy and SecurityHubPolicy.

4. Create this policy: SecurityHubPolicy. Then follow the instructions in Creating IAM policies, and add this code in the JSON editor:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Action": [
                   "sqs:ReceiveMessage",
                   "sqs:DeleteMessage"
               ],
               "Resource": "<add sqs ARN here> ",
               "Effect": "Allow"
           },
           {
               "Action": [
                   "securityhub:BatchUpdateFindings"
               ],
               "Resource": "*",
               "Effect": "Allow"
           }
       ]
   }                                                                            

5. Create this policy: OpsCenterExecutionPolicy. Then follow the instructions in Creating IAM Policies and add this code in the JSON editor:

   
     {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ssm:CreateOpsItem",
                   "ssm:GetOpsItem",
                   "ssm:UpdateOpsItem",
                   "ssm:DescribeOpsItems"
                ],
               "Resource": "*"
           }
       ]
   }                      

6. Create this policy: AWSIncidentBaselinePolicy. Then follow the instructions in Creating IAM Policies and add this code in the JSON editor:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Action": [
                   "ssm-incidents:ListIncidentRecords",
                   "ssm-incidents:GetIncidentRecord",
                   "ssm-incidents:UpdateRelatedItems",
                   "ssm-incidents:ListTimelineEvents",
                   "ssm-incidents:GetTimelineEvent",
                   "ssm-incidents:UpdateIncidentRecord",
                   "ssm:ListOpsItemRelatedItems"
               ],
               "Resource": "*",
               "Effect": "Allow"
           }
       ]
   }              

7. [Optional] Create this policy: AWSChangeManagerCloudtrailPolicy. Then follow the instructions in Creating IAM Policies and add this code in the JSON editor:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Action": [
                   "cloudtrail:DescribeQuery",
                   "cloudtrail:ListEventDataStores",
                   "cloudtrail:StartQuery",
                   "cloudtrail:GetQueryResults"
               ],
               "Resource": "*",
               "Effect": "Allow"
           }
       ]
   }            

8. Add a policy that allows budgets:ViewBudget on all resources (*).

9. Review and choose Create User.

10. Note the access and secret access information. Download the .csv file that contains the user credential information.