SG-AWS import fails with HTTP 403 when Test Load 20 records in the "SG-AWS-Organization" data source. - Support and Troubleshooting

SG-AWS import fails with HTTP 403 when Test Load 20 records in the "SG-AWS-Organization" data source. Issue When attempting to import "SG-AWS-Organization" Data Source, the data load fails with:

org.mozilla.javascript.JavaScriptException: Unable to get Organization Account details. Please check your AWS Setup (sys_script_include.8a1235ed53cb3010a3e4ddeeff7b12c7.script; line 36)

To reproduce the issue:

Open "SG-AWS-Organization" - https:// .service-now.com/nav_to.do?uri=sys_data_source.do?sys_id=4c615ff853a03010a3e4ddeeff7b12ce Under Related Links click on "Test Load 20 Records". The JavaScriptException above is thrown.

The sys_outbound_http table's URL should look like this:

"https://sts.amazonaws.com?Action=AssumeRole&RoleSessionName=123456789012-session&Version=2011-06-15&RoleArn=arn:aws:iam::123456789012:role/"

Release Any release.

Cause This is an AWS issue.

The REST call is using the AWS Assume Role, and it requires a valid role name appended to "role/" in the RoleAr attribute in URL path.

This is the attribute that was used (noticed that the role name is missing after the slash): RoleArn=arn:aws:iam::123456789012:role/

RoleArn is the AssumeRole attribute.

AWS interprets this as a blank role, and throws the error:

{"Error":

{"Code":"AccessDenied",

"Message":"User: arn:aws:iam::123456789012:user/scwx-snow-config-user is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123456789012:role/"

},

"RequestId":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

}

***If there is an invalid role name, the API will throw the same error. Contact AWS support to get the right role.

Resolution A valid Role is required after the "role/" in the RoleArn attribute.

If the user created an Assumed Role named ServiceNowAssumedRole in AWS, the attribute should look like this: ***RoleArn=arn:aws:iam::123456789012:role/ServiceNowAssumedRole

The AssumedRole can be set during the guided setup, or it can be added directly into the sys_propeties table value field: https:// .service-now.com/nav_to.do?uri=sys_properties.do?sys_id=3f80348577213010199a234468106167

***If the role is not valid, the API will throw exactly the same error message.

For more information on troubleshooting this issue, here is a troubleshooting guide from AWS: https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-policy-issues/