Alibaba Cloud RAM role (AssumedRoleUser) setup for ServiceNow discovery - Support and Troubleshooting

Alibaba Cloud RAM role (AssumedRoleUser) setup for ServiceNow discovery Summary .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } ================================================================================ Set up Alibaba Cloud RAM roles for ServiceNow Discovery ================================================================================

Overview -------- This article guides you through setting up Alibaba Cloud RAM (Resource Access Management) roles to enable secure discovery of cloud resources in ServiceNow.

The AssumedRoleUser pattern uses STS (Security Token Service) to allow a trusted entity (master account) to assume a role in a target account and obtain temporary credentials for resource discovery.

================================================================================ PART 1: ALIBABA CLOUD SIDE — RAM ROLE SETUP ================================================================================

Step 1: Create a RAM user in the master or caller account ---------------------------------------------------------- 1. Log in to the Alibaba Cloud Console. 2. Navigate to RAM > Users. 3. Select "Create User." 4. Enter a username (for example, discovery-user). 5. Select "Programmatic Access" to generate an AccessKey ID and Secret. 6. Save the AccessKey ID and Secret. You will need these values for the discovery tool configuration.

Step 2: Attach STS AssumeRole permission to the RAM user --------------------------------------------------------- Attach an inline or system policy that allows the user to call sts:AssumeRole on the target role. Use the following policy:

{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "acs:ram:: :role/ " } ] } Replace the following: - : The Alibaba Cloud Account ID of the target account. - : The role name you will create in Step 3.

Step 3: Create the RAM role in the target account -------------------------------------------------- 1. Log in to the target account. 2. Navigate to RAM > Roles. 3. Select "Create Role." 4. Select "Alibaba Cloud Account" as the trusted entity type. 5. Enter the master account ID (the account where the RAM user exists). 6. Name the role (for example, DiscoveryRole).

The system generates a trust policy. Verify that it matches the following format:

{ "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "RAM": [ "acs:ram:: :root" ] } } ], "Version": "1" } To restrict access to a specific RAM user instead of the entire account, replace the Principal value with: "acs:ram:: :user/discovery-user"

Step 4: Attach read permissions to the role -------------------------------------------- Attach read-only policies to the role based on the services you want to discover

Policy Purpose ReadOnlyAccess Broad read access (recommended for most use cases) AliyunECSReadOnlyAccess ECS instances only AliyunRDSReadOnlyAccess RDS databases only AliyunVPCReadOnlyAccess VPC and networking only AliyunOSSReadOnlyAccess Object storage only For least-privilege access, attach only the service-specific policies that your discovery tool requires.

Step 5: Gather credentials for ServiceNow configuration ------------------------------------------------------- Collect the following values from your Alibaba Cloud setup:

Field Value/Source AccessKey ID From the RAM user created in Step 1 AccessKey Secret From the RAM user created in Step 1 Role ARN acs:ram:: :role/DiscoveryRole STS Endpoint sts.aliyuncs.com (or regional: sts. .aliyuncs.com)

The discovery tool uses the AccessKey ID and Secret to call sts: AssumeRole with the Role ARN, obtaining temporary credentials for API calls.

Step 6: Verify the role assumption setup ----------------------------------------- Test your role assumption using the Alibaba Cloud CLI:

aliyun sts AssumeRole \ --RoleArn "acs:ram:: :role/DiscoveryRole" \ --RoleSessionName "test-session" \ --DurationSeconds 3600

A successful response returns temporary credentials (AssumedRoleUser) confirming your Alibaba Cloud setup is correct.

Troubleshooting Alibaba Cloud side issues Issue Resolution NoPermission on AssumeRole Verify the RAM user has the STS AssumeRole policy attached (Step 2) EntityNotExist.Role Confirm the Role ARN format is correct, and the role exists in the target account InvalidParameter.RoleArn Ensure the ARN uses acs:ram:: prefix (not arn:aws::) Token expired STS tokens are temporary (default 1 hour).Configure ServiceNow to auto-refresh tokens ================================================================================ PART 2: SERVICENOW SIDE — CONFIGURATION FOR ALIBABA CLOUD DISCOVERY ================================================================================

Prerequisites ------------- Ensure the following plugins are active in your ServiceNow instance:

Plugin Purpose ITOM Discovery Core discovery functionality Cloud Management Cloud account management Alibaba Cloud Service Alibaba Cloud-specific patterns Step 1: Create the Alibaba Cloud credential -------------------------------------------- 1. Navigate to Discovery > Credentials. 2. Select "New." 3. Select "Alibaba Cloud API Credentials" as the credential type. 4. Fill in the following fields:

Field Value Name Descriptive name (for example, Alibaba-Discovery-Credential) Access Key ID RAM user's AccessKey ID (from master account) Access Key Secret RAM user's AccessKey Secret

Step 2: Create the Alibaba Cloud account ---------------------------------------------- 1. Navigate to Cloud Provision and Governance> Service Accounts (cmdb_ci_cloud_service_account) 2. Select "New." 3. Fill in the following information:

Field Value Name Descriptive name (for example, Alibaba-Production-Account) Account ID Target Alibaba Cloud Account ID Discovery Credential Select the credential created in Step 1 Datacenter Alibaba datacenter

Step 3: Assumed Role User Setup --------------------------------------

For AssumedRoleUser setup, create a record in the "cloud_service_account_aws_org_assume_role_params" table and complete the following:

Field Value Access Role ARN acs:ram:: :role/DiscoveryRole Role Session Name Descriptive name (for example, servicenow-discovery) Cloud Service account Service account created for Alibaba account Credential TTL in seconds) 3600 (default; maximum 43200)

Note: The credential type may be labelled as "Alibaba Cloud Assume Role" or "Alibaba Cloud STS" depending on your ServiceNow version.

How ServiceNow uses AssumedRoleUser internally ---------------------------------------------- The discovery process follows this workflow:

1. ServiceNow MID Server uses your RAM user credentials (AccessKey ID + Secret) 2. MID Server calls Alibaba STS: sts:AssumeRole with your Role ARN 3. Alibaba STS returns temporary credentials (AccessKey + SecurityToken) 4. MID Server uses the temporary credentials to call Alibaba Cloud APIs: - ECS for compute instances - RDS for databases - VPC for networking 5. Discovered resources are populated into the ServiceNow CMDB as Configuration Items

MID Server networking requirements --------------------------------------------- Your MID Server must have outbound HTTPS access to the following endpoints:

Endpoint Purpose sts.aliyuncs.com STS role assumption ecs. .aliyuncs.com ECS instance discovery rds. .aliyuncs.com RDS database discovery vpc. .aliyuncs.com VPC and networking discovery slb. .aliyuncs.com Load balancer discovery | Troubleshooting ServiceNow side issues -------------------------------------------------

Symptom Resolution InvalidAccessKeyId error Verify the RAM user's AccessKey ID is correct, and the key is active NoPermission on AssumeRole Confirm the RAM user has the sts: AssumeRole policy attached EntityNotExist.Role error Verify the Role ARN format and confirm the role exists in the target account Discovery runs, but no CIs are created. Verify the MID Server has network access to Alibaba Cloud regional endpoints SecurityToken has expired Increase the token duration or verify ServiceNow is configured to auto-refresh tokens No ECS instances found Confirm that the regions configured in your Cloud Account match the regions where your resources are deployed.