Service Graph Connector for AWS
-
- UpdatedApr 22, 2025
- 8 minutes to read
- Washington DC
- Now Platform Capabilities
Use the Service Graph Connector for AWS to securely bring in Amazon Web Services (AWS) data into your ServiceNow instance.
Request apps on the Store
Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.
The integration uses AWS native technologies and AWS security best practices to enable cloud teams to connect the data within their ServiceNow workflow. For more information about the Service Graph Connector for AWS, see the Service Graph Connector for AWS - Introduction article on the ServiceNow Community site.
Supported ServiceNow versions
- Washington DC
- Xanadu
- Yokohama
Use cases
The following are examples on how you can use the Service Graph Connector for different ServiceNow applications:
- Visibility into cloud resources, relationships, and state in real time.
- Deep discovery of applications for ITAM or SAM outcomes.
- Governance and compliance outcome.
Important information for upgrading Service Graph Connector for AWS
- If there are any customizations, delete the records associated with the Service Graph Connector for AWS from the Customer Updates [sys_update_xml] table. See Customer Updates table.
- Upgrade any dependencies.
- Perform a full import of data from your AWS instance. Verify that the Use last run datetime field value is cleared for all the AWS data sources in the Data Source [sys_data_source] table.
- Download and rerun the AWS scripts. See Configure the AWS environment.
Configuring a connection for the connector
CMDB integrations dashboard
The Integration Commons for CMDB store app provides a dashboard with a central view of the status, processing results, and processing errors of all installed integrations. You can see metrics for all integration runs. You can filter the view to a specific CMDB integration, a specific time duration, or a specific integration run. For more details about monitoring AWS integrations in the CMDB Integrations Dashboard, see Using the CMDB Integrations Dashboard.
Data mapping
Data from the AWS data sources is mapped and transformed into the ServiceNow CMDB Configuration Item (CI) class definitions using the Robust Transform Engine (RTE). Data is inserted into the ServiceNow CMDB using the Identification and Reconciliation Engine (IRE).
- The SG-AWS-Generic-Resources data source imports data for generic resources not tracked by other data sources. The connector utilizes the Service Graph Resource Inclusion Whitelist
[sn_cmdb_int_util_service_graph_resource_inclusion_whitelist] table to differentiate between generic and other supported resource types.
The connector first populates all supported resources in the Service Graph Resource Inclusion Whitelist [sn_cmdb_int_util_service_graph_resource_inclusion_whitelist] table. These resources, categorized under their respective supported resource types, have specific data sources designated for ingestion within the connector. When the SG-AWS-Generic-Resources data source is executed and retrieves unsupported resource types, they are added to the Service Graph Resource Inclusion Whitelist [sn_cmdb_int_util_service_graph_resource_inclusion_whitelist] table and categorized as generic.
- If the AWS Systems Manager (SSM) service isn't enabled, the connector populates the server records in the Server [cmdb_ci_server] class. If the AWS SSM service is enabled, then based on the platform type obtained through the SSM service, the server records are populated in either the Linux Server [cmdb_ci_linux_server] class or the Windows Server [cmdb_ci_win_server] class. The Server [cmdb_ci_server] class is the parent class of the Linux Server [cmdb_ci_linux_server] and the Windows Server [cmdb_ci_win_server] classes.
- All labels associated with an AWS resource are added to the Key Value [cmdb_key_value] table.Note: You can use the CMDB Data Manager to delete tag data from retired CIs in the Key Value [cmdb_key_value] table based on conditions like retention time and discovery source. A scheduled job runs the policy, which can be configured to execute during off-peak hours.
- The basic information about a GCP resource is stored in the SG-AWS Extension Attributes [sn_aws_extension_attributes] table.
- Starting with the Service Graph Connector for AWS 2.10.0 version, the SG-AWS-Get-Inventory data source runs before the SG-AWS-EC2 data source and creates a Server [cmdb_ci_server] CI with the host name mapped to the Name attribute, instead of being mapped to the VM name.
For more information on where data is saved when pulling data from AWS, see CMDB classes targeted in Service Graph Connector for AWS and Supported AWS resource types.
- SG AWS Diagnostic Details [sn_aws_integ_sg_aws_diagnostic_details]
- SG-AWS Diagnostic Summary [sn_aws_integ_sg_aws_diagnostic_summary]
- SG AWS Diagnostic Summary Notes [sn_aws_integ_sg_aws_diagnostic_summary_notes]
You can use the IntegrationHub ETL app to view the data maps. See IntegrationHub ETL for more information.
The AWS configuration data for each connection is stored in the SG AWS Application properties [sn_aws_integ_sg_aws_application_properties] table.
For more information about how CI information is pulled from AWS, see the Service Graph Connector for AWS - Functional Spec and CI article on the ServiceNow Community site.
BYOL support
Bringing your own licenses (BYOL) is the process of bringing previously purchased on-premises licenses to Amazon AWS Cloud. The connector supports the BYOL of the Image CIs for Oracle Database servers on Amazon AWS Cloud by populating the Key Value [cmdb_key_value] table with the licensing information. When the licensing information is found, the key is set to Windows_OS_License_Type_automatic
and the key value is set to BYOL in the Key Value [cmdb_key_value] table.
To support BYOL, the sn_aws_integ.load_all_images system property is enabled during the initial pull to import the metadata of all Image CIs included in the SG-AWS-Image-Id data source. After the initial pull, the property is disabled automatically. The SG-AWS-Image-Id data source then imports the metadata of the Image CIs without names only.
Managing retired CIs in EKS components
If the Amazon Elastic Kubernetes Services (EKS) CIs are deleted in EKS components such as pods, services, and volumes, the corresponding CI entries are automatically set to Retired in the following CMDB CI classes:
Kubernetes Cluster, Kubernetes Node, Kubernetes Pod, Kubernetes Service, Kubernetes DaemonSet Kubernetes Namespace, Kubernetes Deployment, Docker Container, Kubernetes Volume
Shared VPC and subnets support
Import CI relationships established between virtual private clouds (VPCs), subnets, and network interfaces hosted in different AWS accounts. For example, a VPC in one AWS account can be connected to a subnet in the same account, which can then link to a network interface and a virtual machine in another AWS account.
Additional resources
See the following articles on the ServiceNow Community site for any additional information on the AWS set up:
Related content
Enable optimized deletion of retired CIs in AWS
Enable optimized SG-AWS-SendCommand data source performance
Handling import failures for large AWS resources
Handling memory utilization errors for Service Graph Connector for AWS
Life cycle management of records in Service Graph Connector for AWS