ServiceNow - Alibaba Cloud Discovery setup readiness, API testing, validation, and troubleshooting - Support and Troubleshooting

ServiceNow - Alibaba Cloud Discovery setup readiness, API testing, validation, and troubleshooting Summary .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } :root { color-scheme:light; --ink:#29201d; --muted:#6b5a52; --line:#eadbd5; --page:#f8f4f1; --brown:#7c2d12; --orange:#c2410c; --amber:#f59e0b; --green:#059669; --blue:#2563eb; --red:#dc2626; } * { box-sizing:border-box; } html { scroll-behavior:smooth; } body { margin:0; padding:24px; background:radial-gradient(circle at top right,#ffedd5 0,transparent 30%),var(--page); color:var(--ink); font-family:Inter,-apple-system,BlinkMacSystemFont,"Segoe UI",Arial,sans-serif; line-height:1.58; } a { color:#b45309; text-underline-offset:2px; } .portal-tools { position:sticky; top:10px; z-index:20; max-width:1180px; margin:0 auto 14px; display:flex; gap:10px; align-items:center; padding:10px; border:1px solid rgba(231,216,209,.94); border-radius:14px; background:rgba(255,255,255,.93); box-shadow:0 8px 26px rgba(67,32,18,.10); backdrop-filter:blur(10px); } .portal-tools label { font-size:12px; font-weight:800; color:#7c2d12; white-space:nowrap; } .portal-tools input { width:100%; padding:9px 12px; border:1px solid #d6c2b8; border-radius:9px; font:inherit; } .portal-tools button { padding:9px 12px; border:0; border-radius:9px; background:#7c2d12; color:#fff; cursor:pointer; } .kb-page { max-width:1180px; margin:0 auto; } .kb-hero { position:relative; overflow:hidden; } .kb-hero:after { content:""; position:absolute; right:-80px; bottom:-110px; width:280px; height:280px; border:38px solid rgba(255,255,255,.11); border-radius:50%; } .kb-badges { position:relative; z-index:1; } .kb-toc { box-shadow:0 10px 30px rgba(67,32,18,.05); } .kb-toc li { break-inside:avoid; margin:4px 0; } .kb-section { transition:opacity .2s ease,transform .2s ease; } .kb-section.hidden { display:none; } .kb-section-title { box-shadow:0 6px 20px rgba(124,45,18,.16); } .kb-panel { box-shadow:0 10px 28px rgba(67,32,18,.045); } .kb-panel h3 { margin:20px 0 8px; color:#9a3412; font-size:17px; } .kb-panel h3:first-child { margin-top:0; } .kb-panel h4 { margin:18px 0 8px; color:#6b3c2a; } .kb-panel p:first-child { margin-top:0; } .kb-panel p:last-child { margin-bottom:0; } .kb-card { padding:16px; border:1px solid var(--line); border-radius:10px; background:#fff; } .kb-card h3 { margin-top:0; } .kb-card ul { margin-bottom:0; padding-left:20px; } .kb-table-wrap { overflow-x:auto; margin:14px 0; border:1px solid #eadbd5; border-radius:10px; } table { width:100%; border-collapse:collapse; font-size:13px; } th { padding:10px 12px; background:#6b3c2a; color:#fff; text-align:left; vertical-align:top; } td { padding:10px 12px; border-bottom:1px solid #eee2dc; vertical-align:top; } tr:last-child td { border-bottom:0; } tr:nth-child(even) td { background:#fffaf7; } code { padding:1px 4px; border-radius:4px; background:#f5ede8; color:#7c2d12; font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace; font-size:.92em; overflow-wrap:anywhere; } pre { overflow:auto; padding:15px; border-radius:9px; background:#211713; color:#fff7ed; box-shadow:inset 0 0 0 1px #4b2d21; } pre code { padding:0; background:transparent; color:inherit; white-space:pre; } details { margin:0 0 11px; border:1px solid #fed7aa; border-radius:9px; overflow:hidden; background:#fff; } summary { cursor:pointer; padding:12px 15px; background:linear-gradient(90deg,#fff7ed,#fffaf7); color:#7c2d12; font-weight:750; } details > div { padding:16px; border-top:1px solid #ffedd5; } .flow-node { min-width:135px; flex:1; display:flex; flex-direction:column; justify-content:center; gap:3px; padding:13px; border:1px solid #fed7aa; border-radius:10px; background:linear-gradient(180deg,#fff7ed,#fff); text-align:center; } .flow-node span { font-size:11px; color:#78655c; } .flow-arrow { display:flex; align-items:center; color:#c2410c; font-size:24px; } .check { display:flex; align-items:flex-start; gap:9px; padding:12px; border:1px solid #eadbd5; border-radius:9px; background:#fffdfb; } .check input { margin-top:5px; accent-color:#059669; } .steps li { margin:0 0 10px; padding-left:5px; } .trigger-map p { margin:7px 0; } .ladder-step { display:flex; flex-direction:column; align-items:center; gap:4px; padding:13px; border:1px solid #fdba74; border-radius:10px; background:linear-gradient(180deg,#fff7ed,#fff); text-align:center; } .ladder-step b { display:grid; place-items:center; width:28px; height:28px; border-radius:50%; background:#c2410c; color:#fff; } .small { color:#78655c; font-size:12px; } .sources li { margin-bottom:6px; } .search-status { min-width:90px; color:#78655c; font-size:12px; text-align:right; } @media (max-width:760px) { body { padding:10px; } .kb-hero { padding:23px 19px !important; border-radius:13px !important; } .kb-hero h1 { font-size:27px !important; } .toc-grid { columns:1 !important; } .kb-grid.two,.kb-grid.three,.check-grid { grid-template-columns:1fr !important; } .kb-panel { padding:16px !important; } .kb-section-title { font-size:18px !important; } .portal-tools label,.search-status { display:none; } th,td { min-width:145px; } } @media print { body { background:#fff; padding:0; } .portal-tools { display:none; } .kb-section { break-inside:avoid; } details > div { display:block !important; } }

Find in article 16 sections Clear ServiceNow Discovery • Alibaba Cloud

Alibaba Cloud Discovery setup readiness, API testing, validation, and troubleshooting A release-neutral, customer-safe handoff guide for RAM, credentials, MID Server connectivity, service accounts, schedules, patterns, APIs, ECC/IRE evidence, CMDB validation, and read-only Postman or host-level fallback tests.

Readiness and handoffs 7 functional + 5 supporting items MID-host and Postman tests Contents

Purpose and scope How Alibaba Discovery works Ownership and handoffs Readiness gate ServiceNow prerequisites RAM access and credentials MID, network, proxy, and time Service account and schedule Pattern and API catalog CMDB outputs and records Pilot validation Postman and MID-host tests Troubleshooting Evidence and security Acceptance and operations Authoritative sources 1. Purpose, scope, and safe-use boundary Use this guide before onboarding an Alibaba Cloud account or when Alibaba cloud CIs are missing. It defines the handoffs, proof points, expected CMDB results, and first-divergence troubleshooting path. This is a release-neutral readiness, validation, API-testing, and troubleshooting guide for ServiceNow pattern-based Alibaba Cloud Discovery. Exact menus and content revisions can change; the current product documentation and the active pattern content in the target instance remain authoritative.

Included Ownership, applications, RAM access, credentials, endpoints, service account, schedule, patterns, APIs, CMDB classes, validation, errors, evidence, and operations.

API diagnostics Read-only tests from the MID host or its execution context using Postman, Alibaba Cloud CLI, Linux, CMD, and PowerShell.

Not included Cloud write/delete calls, customer secrets, fixed tenant policy approvals, guest-OS discovery, software inventory, custom pattern development, or a substitute for security review.

Boundary: Postman and CLI are diagnostic comparators, not prerequisites for Discovery. A successful test from a laptop does not prove that the MID Server can perform the same call. 2. How Alibaba Cloud Discovery works Schedule account, regions, cadence → ECC output work is queued → MID Server runs cloud patterns → Alibaba APIs signed read calls → ECC input responses return → Pattern + IRE parse, identify, reconcile → CMDB CIs, tags, relations The service-account validation pattern establishes identity. It triggers datacenter discovery, and datacenter output supplies the regional ECS endpoints used by the downstream availability-zone, image, hardware-type, storage-volume, and virtual-machine patterns.

Control-plane discovery Inventories Alibaba Cloud metadata through APIs. It does not log in to the operating system inside an ECS instance.

Guest discovery If OS, software, or process details are required, design a separate server Discovery schedule with its own routing and credentials.

ECC interpretation: an output record remaining in ready indicates that a MID has not consumed the work. An input record in ready can be a normal intermediate state; correlate direction, timestamps, payload, Discovery status, and pattern logs. 3. Ownership and handoffs Team / role Owns Must provide before pilot Acceptance evidence Alibaba Cloud account owner Account, target regions, ECS inventory Account ID, target region IDs, commercial or government/dedicated environment, known sample resources Read-only API results match known objects in the intended account and regions RAM / security owner Dedicated RAM identity, AccessKey pair, policy, rotation Approved AccessKey ID/secret delivery path and least-privilege read actions Identity and inventory calls succeed without write permissions Network / proxy / PKI DNS, TCP 443, proxy, TLS trust, time Global and regional endpoint path, CA chain, proxy rules, NTP Tests pass from the MID host under the effective service identity ServiceNow Discovery admin Applications, credential, cloud account, MID, schedule, pattern evidence Up and validated MID with Cloud Management capability; linked credential and schedule scope Trigger chain completes, ECC returns, and Discovery status closes CMDB owner Classes, IRE, reconciliation, duplicate policy, ownership Expected CI/relationship list and authoritative-source rules Known samples update without unexpected duplicates or blocked attributes Operations / support Monitoring, failure routing, access-key rotation, evidence retention Runbook, contacts, cadence, alert thresholds, redaction standard A repeat run succeeds and each failure layer has an owner 4. Readiness gate Keep the pilot narrow until every mandatory item is green. The boxes are interactive in the standalone portal; keep durable approvals in the implementation record.

Scope names the Account ID, target region IDs, environment type, and known sample resources. A dedicated non-root RAM user and AccessKey pair are approved. RAM actions cover every enabled functional pattern and no discovery write access is granted. Required ServiceNow applications and pattern content are installed and supported. MID is Up, validated, and has Cloud Management capability. DNS, TCP 443, proxy, TLS trust, and system time pass from the MID context. Alibaba Cloud API credential is linked to the intended RAM identity. Service account contains the exact Alibaba Account ID and correct datacenter URL family. One representative pilot region is selected before broad rollout. Expected CI classes, relationships, IRE behavior, and tag exposure are reviewed. Evidence collection excludes AccessKey secrets, Authorization headers, signatures, and sensitive tag values. Disable/rollback procedure, rotations, ownership, and retest cadence are documented. 5. ServiceNow prerequisites Requirement Why it is needed Readiness check Discovery entitlement and cloud-discovery capability Creates cloud schedules, launches patterns, and processes results. Confirm entitlement and production support policy with the platform owner. Discovery and Service Mapping Patterns Provides the Alibaba functional patterns, trigger rules, tag helpers, and content updates. Installed and supported; review customizations separately. CMDB CI Class Models Provides the target cloud CI class definitions. Alibaba/cloud target tables exist and are active. Visibility Content Provides shared visibility and cloud-discovery content. No failed install or skipped dependency. Discovery Admin Workspace cloud workflow Guides MID selection, account verification, region selection, and scheduling. The administrator can initiate Alibaba Cloud onboarding. discovery_admin or approved equivalent Administers cloud credentials, service accounts, and schedules. Use least privilege and separate setup privileges from operational read access. Update applications through the supported application lifecycle. Do not copy individual pattern records between instances or assume that a permissions list from an older content package remains complete. 6. Alibaba RAM access and credential design Credential components Component Expected value Common failure RAM identity Dedicated non-root user approved for ServiceNow Discovery. Root AccessKey used, user disabled, or policy attached to another identity. AccessKey ID Identifier for the approved RAM AccessKey pair. Copied from another account, deactivated, or truncated. AccessKey secret Matching secret stored only in the ServiceNow credential/approved secret boundary. Whitespace added, wrong pair, exported in Postman, or exposed in evidence. Alibaba Account ID Numeric account identifier used to establish the service-account identity. RAM user ID, region ID, name, ARN, or a cloud-provider-specific identifier supplied instead. Endpoint environment Commercial or government/dedicated endpoint family approved for the account. aliyuncs.com and aliyun-inc.com mixed. Read-only action baseline ServiceNow requires an Alibaba identity with at least read access to the services queried by the enabled patterns. The following template reflects the active functional call chain covered by this guide. The RAM owner must compare it with the current installed patterns and current quarterly ServiceNow pattern/API reference before approval.

{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "resourcemanager:GetAccount", "sts:GetCallerIdentity", "ecs:DescribeRegions", "ecs:DescribeZones", "ecs:DescribeImages", "ecs:DescribeInstanceTypes", "ecs:DescribeAvailableResource", "ecs:DescribeDisks", "ecs:DescribeInstances" ], "Resource": "*" } ] } Policy control: this is a validation template, not a universal approval. Add a content-specific action only when the active pattern calls it. Never grant write actions solely to make Discovery pass. Use RAM conditions such as approved source IPs where they fit the MID/proxy design. The installed validation flow first attempts Resource Manager GetAccount and can fall back to STS GetCallerIdentity . The availability-zone operation is ecs:DescribeZones . Do not substitute the similar-looking DescribeAvailabilityZones . For a zero-result response, prove the identity, account, region, resource state, pagination, and permission scope before accepting it as success. Rotate AccessKeys under change control and retest identity plus one known-resource call. 7. MID Server, network, proxy, TLS, and time MID readiness Status is Up and Validated . Cloud Management capability is present. The service identity can use the effective proxy, trust store, and DNS configuration. Capacity and log retention cover the pilot. Only the intended MID or qualified MID cluster is eligible. Network readiness Forward DNS resolves global and regional Alibaba endpoints. Outbound TCP 443 succeeds through the effective proxy path. TLS chain and hostname are trusted without bypassing verification. System time is synchronized; signed requests are time-sensitive. TLS inspection does not break SNI, hostname validation, or payload integrity. Endpoint model Purpose Commercial example Why it matters Identity fallback sts.aliyuncs.com Supports GetCallerIdentity . Account validation resourcemanager.aliyuncs.com Supports GetAccount . Region catalog ecs.aliyuncs.com Returns regions and their regional ECS endpoints. Regional resources ecs. .aliyuncs.com Zones, images, hardware types, resources, disks, and instances are queried in region context. The ServiceNow Alibaba content distinguishes the commercial aliyuncs.com family from the government/dedicated aliyun-inc.com family. Use the environment actually assigned to the account; do not mix suffixes. Because DescribeRegions returns regional endpoints, allow the exact returned hosts for the selected regions instead of relying on one hard-coded regional name.

Evidence rule: browser or Postman success from an administrator laptop is not MID proof. Run network and signed tests on the MID host under the same service identity, proxy, DNS, and trust context whenever operational policy permits. 8. Alibaba service account and discovery schedule Create the Alibaba Cloud API credential. Enter the approved AccessKey ID and matching AccessKey secret. Never use a root-account AccessKey for Discovery. Create or select the Alibaba cloud service account. Provide a clear name, the exact Alibaba Account ID, the linked credential, and an Alibaba datacenter URL. The target datacenter type is cmdb_ci_alibaba_datacenter . Use the correct endpoint family. Commercial accounts use the aliyuncs.com family; government/dedicated environments use the applicable aliyun-inc.com family. Validate identity first. Confirm that the returned Account ID and ARN belong to the intended RAM identity/account before resource discovery. Select MID execution. Choose a qualified MID, qualified cluster, or supported automatic selection. Only Up, validated Cloud Management MIDs should be eligible. Refresh and select regions. Start with one region that has known ECS resources. A region missing from the picker usually points to the account-validation/datacenter chain, endpoint family, permission, or MID path. Set cadence and timeout. Avoid overlapping broad cloud runs; size the schedule using observed duration, throttling, ECC volume, and MID capacity. Separate guest discovery. If OS-level details are required, configure the server-discovery option/schedule only after control-plane inventory is stable. Account-ID caution: supply the Alibaba Account ID—not a region ID, RAM user ID, display name, ARN, compartment identifier, tenancy identifier, subscription identifier, or project identifier. 9. Pattern, API, permission, and trigger catalog The baseline covered by this guide contains seven functional discovery patterns plus five supporting tag/endpoint helpers. Names and internals can evolve, so compare the table with the active installed content and the current ServiceNow quarterly pattern/API reference.

Trigger chain Service Account Validation → Datacenter

Datacenter → Availability Zone + Cloud Hardware Type + Cloud OS Image + Storage Volume + Virtual Machine

Supporting helpers normalize endpoints/API versions and map tags to cmdb_key_value .

# Pattern / purpose Operation and API version RAM action Primary CMDB output Expected dependency/result 1 Alibaba – Service Account Validation GetAccount 2020-03-31 ; STS GetCallerIdentity 2015-04-01 fallback resourcemanager:GetAccount ; sts:GetCallerIdentity cmdb_ci_cloud_service_account , cmdb_key_value Returned Account ID/ARN proves identity; triggers Datacenter. 2 Alibaba – Datacenter DescribeRegions 2014-05-26 ecs:DescribeRegions cmdb_ci_alibaba_datacenter Creates the region catalog and supplies each regional ECS endpoint. 3 Alibaba – Availability Zone DescribeZones 2014-05-26 ecs:DescribeZones cmdb_ci_availability_zone Zone is contained by its Alibaba datacenter. 4 Alibaba – Cloud OS Image DescribeImages 2014-05-26 ecs:DescribeImages cmdb_ci_cloud_os_image , cmdb_key_value Image is hosted on the datacenter; tags reference the image. 5 Alibaba – Cloud Hardware Type DescribeInstanceTypes ; DescribeAvailableResource 2014-05-26 ecs:DescribeInstanceTypes ; ecs:DescribeAvailableResource cmdb_ci_cloud_hardware_type Relates available hardware types to datacenter and zone context. 6 Alibaba – Storage Volume DescribeDisks 2014-05-26 ecs:DescribeDisks cmdb_ci_storage_volume , cmdb_key_value Volume is hosted in a datacenter/zone and can be used by a VM. 7 Alibaba – Virtual Machine DescribeInstances 2014-05-26 ecs:DescribeInstances cmdb_ci_vm_instance , cmdb_ci_nic , cmdb_key_value VM relates to datacenter, zone, image, hardware type, NIC, storage, and tags. Supporting content Set API and API Version derives the endpoint/API-version context used by functional patterns. Service Account Tags, Image Tags, Storage Volume Tags, and VM Tags create tag records and reference relationships. Do not troubleshoot a child first. If VMs, disks, images, or zones are all absent, prove Service Account Validation and Datacenter before opening the downstream pattern. 10. CMDB outputs, relationships, and operational records Primary CI and relationship expectations Target Expected relationships / evidence Validation focus cmdb_ci_cloud_service_account Account identity and tags; parent context for discovered regions. Exact Account ID, ARN identity, linked credential/account. cmdb_ci_alibaba_datacenter Alibaba region and the regional ECS endpoint returned by DescribeRegions . Expected region IDs and endpoint family. cmdb_ci_availability_zone Contained by the Alibaba datacenter; can contain VMs/hardware context. Zone IDs match the pilot region. cmdb_ci_cloud_os_image Hosted on datacenter; provisions VMs; tag references. Known image ID, name, status, and no legacy-model confusion. cmdb_ci_cloud_hardware_type Hosted/available in datacenter and zone; provisions VMs. Known instance type and availability context. cmdb_ci_storage_volume Hosted in datacenter, contained by zone, used by VM, tag references. Known disk ID, attachment relation, lifecycle state. cmdb_ci_vm_instance Hosted on datacenter, contained in zone, provisioned from image/hardware type, uses volume, endpoint NIC, tag references. Known instance ID, expected relationships, IRE/update source. cmdb_ci_nic Endpoint relationship to VM when NIC data is present in VM results. MAC/IP identity quality and duplicate handling. cmdb_key_value References tagged service account, image, volume, or VM. Sensitive tag review, stale tags, duplicate keys. Operational evidence by layer Layer Evidence Healthy signal Schedule Discovery schedule/run/status records Correct account/region scope, start and completion timestamps, no overlap. Transport ecc_queue output/input pairs MID consumes output; responses return and correlate. Pattern Pattern execution and MID logs Parent and child steps execute in order; expected row counts. Identification IRE/CMDB identification and reconciliation evidence Known resources identify existing CIs or create one expected CI. CMDB CI, relationship, and tag records Known samples, source timestamps, classes, and relationships agree with Alibaba. 11. Pilot validation and expected evidence 1 Identity AccountId + ARN 2 Regions DescribeRegions 3 Zone DescribeZones 4 Resource known VM/disk/image 5 Transport ECC round trip 6 CMDB CI + relations Run identity validation and compare the returned AccountId and redacted ARN with the approved account/RAM user. Call DescribeRegions ; verify the pilot region and its returned endpoint. Call DescribeZones in the pilot region and record a non-sensitive zone sample. Call at least one known-resource operation, preferably DescribeInstances and one of images or disks, with a small page size. Run the ServiceNow pilot schedule. Correlate schedule, ECC, MID, parent pattern, child pattern, IRE, and CMDB timestamps. Compare a known Alibaba resource ID, region/zone, status, image, hardware type, disk/NIC relationship, and approved tags with the CMDB. Repeat the same run. The second pass should update/identify the same CIs rather than create duplicates. Valid zero: an empty collection is acceptable only after proving the same identity, account, region, filter/pagination context, permission, and an independently confirmed absence of that resource type. 12. Postman and MID-host API testing Secret handling: never paste an AccessKey secret, Authorization header, security token, complete signature, or full sensitive response into a ticket, screenshot, shared shell history, exported Postman environment, or KB. Use approved temporary/local secret handling and redact Account IDs, ARNs, resource IDs, IPs, names, and tag values. Test ladder 1. Unsigned network test Proves DNS, route, proxy, TCP 443, TLS, and HTTP reachability. A structured 4xx can be expected because no signature is present.

2. Signed identity test Proves AccessKey validity and account identity using STS GetCallerIdentity .

3. Signed resource test Proves region endpoint, RAM action, request parameters, and response structure for an enabled discovery operation.

Linux or Unix on the MID host: DNS, TCP/TLS, and unsigned HTTP ALIBABA_ECS_HOST="ecs. .aliyuncs.com" nslookup "$ALIBABA_ECS_HOST" curl --silent --show-error --output /dev/null --write-out 'HTTP %{http_code}\n' "https://$ALIBABA_ECS_HOST/" openssl s_client -connect "$ALIBABA_ECS_HOST:443" -servername "$ALIBABA_ECS_HOST" -verify_return_error Use the government/dedicated host suffix when applicable. Do not add -k , --insecure , or disable certificate validation; doing so hides the trust failure Discovery must solve.

Windows CMD on the MID host set ALIBABA_ECS_HOST=ecs. .aliyuncs.com nslookup %ALIBABA_ECS_HOST% curl.exe -sS -o NUL -w "HTTP %{http_code}\n" "https://%ALIBABA_ECS_HOST%/" powershell -NoProfile -Command "Test-NetConnection -ComputerName '%ALIBABA_ECS_HOST%' -Port 443" If the CMD commands are saved in a batch file, double the percent sign in the curl format token: %%{http_code} .

PowerShell on the MID host $AlibabaEcsHost = "ecs. .aliyuncs.com" Resolve-DnsName $AlibabaEcsHost Test-NetConnection -ComputerName $AlibabaEcsHost -Port 443 try { Invoke-WebRequest -Uri "https://$AlibabaEcsHost/" -Method Get -UseBasicParsing } catch { $_.Exception.Message if ($_.Exception.Response) { [int]$_.Exception.Response.StatusCode } } An HTTP authentication error can still prove that DNS/TLS/HTTP reached Alibaba. It does not prove identity or RAM authorization.

Alibaba Cloud CLI: signed, read-only semantic tests Use an approved local profile for the same RAM identity as ServiceNow where possible. CLI releases support classic PascalCase commands and newer plugin-style kebab-case commands with different parameter spelling. Run aliyun ecs DescribeInstances --help or aliyun ecs describe-instances --help and use the syntax exposed by the installed CLI.

# Identity: expected AccountId, Arn, IdentityType, RequestId aliyun sts get-caller-identity --profile # Classic operation syntax: stable read-only examples aliyun ecs DescribeRegions --profile aliyun ecs DescribeZones --RegionId --profile aliyun ecs DescribeImages --RegionId --PageSize 10 --profile aliyun ecs DescribeInstanceTypes --profile aliyun ecs DescribeAvailableResource --RegionId --DestinationResource InstanceType --profile aliyun ecs DescribeDisks --RegionId --PageSize 10 --profile aliyun ecs DescribeInstances --RegionId --PageSize 10 --profile On Windows, run the same commands with aliyun.exe . If the CLI is not approved on the MID host, use an approved diagnostic host in the identical network/proxy path and clearly label the residual difference.

Postman: current signing workflow Create a local, non-exported environment containing only the necessary values: endpoint , region_id , action , api_version , AccessKey ID, and a secret variable for the AccessKey secret. Use the HTTP method and parameter placement from current Alibaba OpenAPI metadata. A read-only API operation can use HTTP POST; classify safety by the operation, not only the HTTP verb. Use Alibaba's current Signature V3 algorithm ACS3-HMAC-SHA256 or an approved official SDK-generated request. Required signed headers include host , x-acs-action , x-acs-content-sha256 , x-acs-date , x-acs-signature-nonce , and x-acs-version . Keep the timestamp in UTC and within the allowed window, generate a unique nonce for every request, preserve canonical sort/encoding rules, and ensure the transmitted parameters exactly match those used to calculate the signature. Test in order: STS GetCallerIdentity , ECS DescribeRegions , ECS DescribeZones , then one known-resource call such as DescribeInstances . Record HTTP status, Alibaba Code , redacted Message , RequestId , endpoint, operation, API version, region, UTC time, and response count. Never record the secret or Authorization value. Do not use an AWS or Azure Postman signer. Alibaba canonicalization and headers are different. Prefer Alibaba OpenAPI Explorer/official SDK output or a security-reviewed V3 pre-request script; do not copy an obsolete V2/HMAC-SHA1 example into a new diagnostic collection. Comparison record Field Postman / CLI ServiceNow / MID Interpretation Execution location Host, user, proxy, DNS, CA context MID name/service identity/proxy/trust context Different context means the tests are not equivalent. Identity Redacted AccountId and ARN Service-account validation output Mismatch means wrong credential/account. Endpoint Exact global/regional hostname Datacenter URL and returned RegionEndpoint Mismatch explains region-specific failure. Operation/version Action and x-acs-version Pattern step operation/version Must be semantically equivalent. Response HTTP, Code, RequestId, redacted count Pattern/ECC response and row count Use Alibaba RequestId for cloud-side correlation. 13. Troubleshooting by first divergent layer Begin with the earliest missing proof. Expand the symptom that matches the run; each branch states what to check, what to correct, and what evidence closes the branch.

1. Alibaba is available, but no MID Server is selectable Check: MID status, validation, Cloud Management capability, application/content state, schedule affinity, cluster membership, and user access.

Correct: restore the MID to Up/validated, add the required capability through supported configuration, or select a qualified MID/cluster.

Close with: the MID is selectable and a small discovery output is consumed.

2. ECC output remains in ready Interpretation: the work was queued but no MID consumed it.

Check: agent targeting, MID service health, ECC connectivity, capability/affinity, capacity, and whether the selected MID still exists.

Do not do: do not troubleshoot RAM or Alibaba API parsing until the MID has actually picked up the output.

3. DNS lookup fails from the MID context Check: global and returned regional hostnames, DNS suffix/search policy, resolver used by the MID service, split DNS, proxy DNS behavior, and endpoint family.

Correct: make the exact sts , resourcemanager , global ECS, and regional ECS names resolvable. Do not solve this with hard-coded IPs because service addresses can change.

4. DNS works, but TCP 443 or proxy connection fails Check: outbound firewall, proxy ACL/authentication, service-account proxy variables, PAC behavior, and regional endpoint allowlisting.

Correct: authorize the MID's effective source/proxy path to the required hosts on TCP 443; then retest from the service context.

5. TLS handshake, certificate path, or hostname validation fails Check: SNI hostname, certificate chain, trust store actually used by the MID runtime, expiry, TLS inspection, and endpoint mismatch.

Correct: install the approved CA chain in the correct trust boundary or bypass interception through policy. Never disable certificate verification as a production fix.

6. Service Account Validation fails before Datacenter starts Check: exact Account ID, AccessKey pair, active RAM user, Resource Manager GetAccount , STS GetCallerIdentity , endpoint family, time, and MID connectivity.

Correct: align the credential and Account ID, authorize the current validation operation(s), and rerun validation before downstream patterns.

7. HTTP 400 / InvalidParameter / malformed request Check: operation name, API version, required RegionId/AccountId, HTTP method, parameter location, encoding, endpoint, and whether the request was modified after signing.

Correct: rebuild the call from current OpenAPI metadata. For zones, use DescribeZones .

8. Invalid AccessKey ID, deactivated key, or authentication failure Check: AccessKey ID/secret pairing, whitespace/line damage, key state, RAM user state, account status, and whether a different profile/credential was selected.

Correct: replace the credential through the approved secret path; do not paste either value into evidence.

9. SignatureDoesNotMatch or signature does not conform Check: Signature V3 algorithm, canonical URI/query, lowercased/sorted signed headers, SHA-256 payload hash, percent encoding, HTTP method, transmitted parameters, unique nonce, and secret pairing.

Correct: compare with official SDK/OpenAPI-generated output. The final request must be byte-for-byte consistent with the canonical request used for signing.

10. Request expired, timestamp invalid, or intermittent signature failure Check: UTC time, NTP, host clock drift, proxy delay, reused nonce/request, and long pauses between signature generation and send.

Correct: synchronize the MID host and generate a fresh timestamp/nonce immediately before the request.

11. Forbidden.NoPermission or another authorization denial Check: the denied RAM action, identity ARN, policy attachment, explicit deny/condition, source-IP condition, region, and resource scope.

Correct: grant only the missing read action to the intended RAM identity and re-run that exact operation. Authentication success alone does not prove ECS authorization.

12. Identity succeeds, but the Account ID or ARN is not expected Interpretation: the credential is valid but belongs to the wrong account, RAM user, role session, or CLI/Postman profile.

Correct: stop the pilot, select the approved credential, correct the ServiceNow Account ID, and revalidate identity before any inventory comparison.

13. DescribeRegions succeeds, but the expected region is missing Check: correct account/environment, returned region list, account eligibility, endpoint family, RAM constraints, and whether the UI region list was refreshed after validation.

Correct: fix the account/datacenter layer and refresh. Do not manually seed a region to conceal an upstream failure.

14. Regions exist, but Availability Zones are missing Check: regional endpoint returned by DescribeRegions , ecs:DescribeZones , RegionId, endpoint suffix, trigger execution, and result parsing.

Correct: use DescribeZones on the returned regional endpoint and rerun the Datacenter-to-Zone chain.

15. API call succeeds with an empty collection Check: identity, region, filters, page/page size, lifecycle state, policy conditions, and a console-confirmed known sample in that exact region/account.

Correct: remove unintended filters, complete pagination, correct region/scope, or document a valid zero with independent proof.

16. Zones/images/disks appear, but virtual machines are missing Check: ecs:DescribeInstances on the same regional endpoint, RegionId, page handling, known instance state, VM pattern trigger, and response shape.

Correct: grant the exact action or fix the VM call/trigger. Use one known instance ID for comparison without exposing it in public evidence.

17. Only one resource family is missing Check: that pattern's exact action, response code/count, current API version, endpoint, required parameters, trigger, and CMDB class.

Correct: work the failing child only after its Datacenter parent is proven. Avoid broad credential/policy changes when other children succeed.

18. CIs exist, but tags are missing or stale Check: source response contains tags, supporting tag helper ran, tag values are not excluded/redacted by policy, relationships were written, and later reconciliation did not overwrite data.

Correct: repair the corresponding service-account/image/volume/VM tag helper or ownership rule; do not expose sensitive tag values while troubleshooting.

19. Throttling / rate-limit responses Check: concurrent schedules, region/account breadth, pagination, retry bursts, proxy retries, and Alibaba RequestId .

Correct: reduce concurrency/scope, stagger schedules, and use bounded exponential backoff with jitter where the client supports it. Do not retry in a tight loop.

20. Alibaba response returns to ECC, but no CIs are created Check: input processing state, pattern parse/output rows, payload schema, pattern errors, class availability, IRE errors, and identification/reconciliation logs.

Correct: fix the first parser/IRE/class failure. Successful HTTP is only transport/API proof, not CMDB proof.

21. Duplicate CIs appear or expected attributes do not update Check: native cloud identifiers, class, identifier rules, object-source identity, reconciliation precedence, competing integrations, reclassification, and historical duplicates.

Correct: preserve stable Alibaba resource IDs and repair IRE/reconciliation authority. Do not bulk-delete or merge until the identification cause is understood.

22. Intermittent 5xx, proxy resets, or partial regional results Check: UTC timestamps, Alibaba RequestIds, MID/proxy logs, retry behavior, pagination checkpoints, scheduled overlap, endpoint health, and whether failure is isolated to one region/operation.

Correct: retry read-only calls with controlled backoff, preserve correlation evidence, and escalate with the smallest reproducible operation when the cloud service remains at fault.

14. Evidence package and security controls Minimum support package Artifact Include Redact / exclude Scope statement Environment type, pilot region, intended resource types, schedule time window, expected counts Customer/account names and confidential topology MID proof Status, validation, capability, execution host context, proxy/DNS/TLS test result Internal hostnames, IPs, usernames, certificate subject details as required Identity proof Redacted AccountId/ARN match statement and Alibaba RequestId AccessKey ID when policy requires, always the secret/token/signature/Authorization header API proof Operation, API version, endpoint category, region, UTC time, HTTP status, Code, RequestId, redacted count Full payload, resource names/IDs, IPs, tags, keys, secrets ServiceNow proof Schedule/run reference, ECC direction/state/timestamps, parent/child pattern outcome, IRE result Instance URL, sys_ids, usernames, credentials, raw sensitive payload CMDB proof Class, redacted known-sample comparison, required relationships, duplicate/update result Customer-specific names, addresses, account data, confidential tags Prefer a narrow excerpt around the first failure over a complete log bundle. Record timestamps with timezone and maintain the correlation chain: schedule → ECC output → MID/pattern → Alibaba RequestId → ECC input → IRE → CI. Scrub shell history and Postman consoles/exports if a secret was accidentally entered. Rotate the exposed key rather than assuming deletion removes exposure. Use neutral filenames and customer-safe screenshots; do not include tenant names, account IDs, instance URLs, or case identifiers. 15. Acceptance criteria and ongoing operations Pilot exit criteria Identity returns the approved Account ID and RAM ARN. Pilot region and regional ECS endpoint are discovered. Zones and each in-scope resource family return expected or independently proven zero results. MID consumes output and returns correlated input without recurring transport/auth errors. Functional patterns and supporting tag helpers complete as designed. Known CI samples, relations, lifecycle state, and approved tags match Alibaba. A repeat run updates/identifies the same CIs without new duplicates. Key rotation, schedule monitoring, throttling response, evidence retention, and rollback owners are assigned. Operational cadence Every run Watch duration, status, ECC backlog, API/permission errors, throttling, row-count changes, and IRE failures.

After change Retest after AccessKey rotation, RAM policy, proxy/CA, MID, application/content, region scope, or identifier/reconciliation change.

Periodic review Reconcile enabled patterns against required RAM actions/endpoints, remove unused access, confirm owner contacts, and inspect duplicate/stale CI trends.

16. Authoritative sources and currency note Verify the current documentation and installed content before implementation; permissions, UI labels, APIs, and CLI syntax can evolve.

ServiceNow documentation Alibaba Cloud Discovery pattern overview and prerequisites Create Alibaba Cloud API credentials Set up an Alibaba Cloud service account Create an Alibaba Cloud Discovery schedule Alibaba service-account pattern data Alibaba datacenter pattern data Alibaba availability-zone pattern data Alibaba Cloud OS image pattern data Alibaba cloud hardware-type pattern data Alibaba storage-volume pattern data Alibaba virtual-machine pattern data Alibaba Cloud documentation Alibaba Cloud CLI quick start and identity verification CLI classic-to-plugin command migration Signature V3 native HTTP request and Postman guidance Create and protect a RAM AccessKey pair RAM security and least-privilege practices ECS API operations and RAM actions Alibaba regions and zones ECS API throttling Alibaba OpenAPI troubleshooting and RequestId evidence