Cloud Account Management

Cloud Account Management interacts with Amazon Web Services to create and manage subscription accounts.

Cloud Account Management has two types of dashboards: one for requesters and another for admins. Depending on the logged- in user, an appropriate dashboard appears.

The Cloud Account Management overview dashboard gives a clear view of all cloud accounts and their compliance status. Cloud Account Management pulls data from Cloud Configuration Governance to create a simple, visual overview of compliance. As an admin, you can take the necessary actions for the reported vulnerabilities.

Cloud Account Management provides policy-driven rules to automate account provisioning, approvals, and security. These policies improve governance, control costs, enhance security, and promote sustainability in cloud operations. Regular reviews promote consistency and efficiency in managing cloud infrastructure.

Cloud Account Management supports both Terraform (Cloud and Enterprise) and cloud native interface provision modes.

The AWS admin configures a Service Control Policy (SCP) and shares its ID with the ServiceNow AI Platform admin for Cloud Account Management setup. Cloud Account Management enforces the SCP via API calls to block resource creation in the account.

Simplify cloud account provisioning using Terraform. The workflow provides the basic steps involved in setting up Terraform and GitHub.

New cloud account request form and related list field descriptions.

You can install the Cloud Workspace application (sn_itom_cam) if you have the admin role. The application includes demo data and installs related ServiceNow Store applications and plugins if they are not already installed.

Provide the required information for cloud account creation and provisioning.

Ensure accurate assignment of members to their respective groups to streamline account requests, approvals, provisioning, and certification. Grant necessary permissions through proper group assignment to prevent unauthorized access and maintain security.

Managing a cloud account involves tracking budgets, checking for configuration violations, and validating certificates. The procedure helps you to onboard an unmanaged cloud account.

Add the Terraform API key to the ServiceNow instance to ensure consistent and error-free infrastructure provisioning.

Approve or deny a cloud account request as an approver. A notification email is received when the requester creates an account request. When a cloud account is requested, the table captures and retrieves the details of the request. Once the Cloud Account Management request is approved, it’s assigned to a provisioner, such as CCOE, DevOps, or SRE.

Automate finance approvals for Cloud Account Management requests based on predefined conditions. Approve requests automatically when criteria are met. Otherwise, wait for manual approval. Modify the default policy to include additional conditions as necessary.

Automate the general approval or rejection of requests based on predefined conditions. Requests are automatically approved when the criteria are met. Otherwise, the system waits for manual approval. You can modify the default policy to include additional conditions as needed.

Automate assigning configurations and AWS organizational units in requests based on specified conditions. When conditions are met and approvals are complete, requests move forward without admin input. Update the default policy to include specific conditions and values for configuration and AWS organizational unit.

Create a unique email address to manage several accounts. Having multiple accounts and emails can be a significant challenge for an AWS admin. A single AD email for multiple AWS accounts simplifies management.

Access control lists (ACLs), groups, and roles in Cloud Account Management control how access permissions are organized and managed within a cloud environment.

Setting up the Cloud Account Management app is a prerequisite task before proceeding to create, suspend, or scan a service account. By configuring Cloud Account Management, you can ensure that the application is ready to effectively execute account management tasks and deliver the desired results.

Cloud Account Management simplifies account management by automating tasks like creation and provisioning. Predefined policies enable easy suspension, reactivation, and certification of accounts. Potentially reduce provisioning times from weeks to minutes by automating requests, approvals, and setups.

Reference topics provide additional information for configuring and using the Cloud Account Management in Cloud Workspace application.

Cancel an account request that you have submitted.

A certification task represents the work of verifying and certifying the data associated with a record. The certifier reviews tasks created after data validation against the published policy. Account certification helps resolve issues like outdated ownership, inactive user profiles, and improper permissions in cloud accounts.

The Cloud account details table provides detailed information about each account.

Stores metadata of cloud assets collected from providers for IT operations.

Cloud native interface configuration account form and related list field descriptions.

Several user roles are installed with the Cloud Account Management app.

The credentials provided by your AWS administrator are used in this procedure to create a suspension profile, enabling you to temporarily suspend or terminate AWS accounts as needed.

Configure the Cloud Asset Collection Configs table to collect cloud assets or add comments to the CI entries.

Configure a custom name for Cloud Account Management. You can optionally re-brand the Cloud Account Management with your company or any custom name. The name change is applicable only on the Cloud Account Management home page and navigation.

Create an application service to standardize the organization, maintenance, and monitoring of services in your organization.

Set up a restriction on cloud account creation. For example, when the account owner isn’t in the organization or if there are budget constraints. Using Cloud Account Management, admin adds the account number to the AWS organization's service control policy, promoting existing accounts to continue to function normally while blocking new account creation.

Manage an Azure subscription using the permission and by assigning the role to a user. The role must have the permission to execute the APIs for suspending and reactivating an Azure account.

Configuring the Cloud Account Management application involves a set of required tasks, integrations, and setups to be completed before initiating service account creation and provisioning.

Configure the catalog ID used for Cloud Account Management request to map the custom service catalog and streamline account provisioning.

This section covers all the general topics required to set up Cloud Account Management. The topics are arranged in order of configuration priority.

The topics in this section cover various cloud configurations required to set up and work with Cloud Account Management in Cloud Workspace.

Create the policy at the root level to lock or unlock an Azure account. As an Azure administrator, lock an Azure subscription, resource group, or resource to avoid accidental deletions and modifications.

Customize the Request cloud account catalog by creating or editing variable sets. Build a variable set to group related variables into a single, reusable collection. Select only the necessary variables for specific cloud account requests to promote an organized and uniform process.

Configure cloud accounts using the native interface of supported cloud providers like AWS AWS or Azure to enable seamless provisioning and integration.

Customize the cloud account request process by creating or editing variable to collect essential information during cloud account request.

Configure the Cloud Account Management app before scanning a service account to confirm it’s ready for effective account management.

Create a service account in CAM. A service account holds the credential and account information that you created in your provider account. Discovery uses the information to access your provider account and then obtain information on each logical datacenter that is associated with the account.

Set up a suspension profile that allows temporary suspension or termination of cloud accounts to support cost control or policy enforcement.

Define and set up configurations based on Terraform to automate cloud account provisioning, including required credentials and infrastructure templates.

Creating a cloud account involves a requester submitting an account request, an approver approving or rejecting the request, and that admin provisioning the account.

The discovery schedule is the control point for running discoveries. The schedule controls when discovery runs, defines the MID Server to use, the type of discovery that should run, and the IP addresses to query.

The ServiceNow Cloud Account Management in Cloud Workspace application provides a framework to streamline the cloud account creation and management process.

Integrate with Terraform Cloud/Terraform Enterprise to organize accounts, define workflows, enforce security, improve collaboration, and enhance scalability.

Integrate GitHub with Terraform to link workspaces to repositories, enabling version control, change tracking, and rollbacks.

Use the cloud asset form in the Cloud Account Management to view, edit, and manage cloud asset details such as attributes, health, and records.

Managing a cloud account enables you to accomplish a range of tasks such as canceling, suspending, or reactivating cloud accounts, and adding unmanaged accounts.

This table provides the permissions needed to create, close or cancel an Azure subscription, download billing details, and tag subscriptions.

A list of default policies provided for scanning the cloud accounts.

Review the default certification policy provided in Cloud Account Management to validate data against the policy set. This default policy certifies all available cloud service accounts every 90 days. Administrators can customize the default policy or create one as needed.

Provision a cloud account as an admin through Cloud Workspace.

Publish the Terraform template defined by the application in GitHub to enable version control, collaboration, and centralized storage.

Reactivate an account that was previously suspended if there is a need retrieve the account. After reactivating an account, the account status changes from suspended to active. Only Cloud Account Management managed accounts can be reactivated.

Request a cloud account as a requester. A notification email is sent when the requester creates an account request.

Generating API tokens with limited permissions enhances security, enables fine-grained control, facilitates automation, and provides temporary access within your Terraform organization.

Add and configure an Azure connection with your Azure portal. Using the connection credentials, the Cloud Account Management application creates Azure subscriptions. This is a one-time configuration step.

Provide the Azure credentials obtained from your Azure administrator. These credentials are used to create a suspension profile and enables you to suspend temporarily or terminate Azure accounts as needed.

Visualize all account violations by scanning them using the selected policy set. Display the severity of all violations on the admin dashboard to take appropriate actions.

Create AWS CloudFormation Identity Access Manager (IAM) resources for three AWS account types in the management account. Use CloudFormation templates (CFT) to integrate ServiceNow Cloud Account management (CAM) with AWS GovCloud.

AWSCreate an AWS CloudFormation Identity Access Manager (IAM) user in the management account using the CloudFormation template (CFT). This allows you to manage multiple AWS accounts with a centralized IAM user.

This section covers all the topics required to set up AWS cloud. The topics are arranged based on configuration priority.

This section covers all the topics required to set up Azure cloud. The topics are arranged in order of configuration priority.

The app creates accounts with a unique request ID and root email, promoting distinct emails for each account and simplifying management.

Cloud Account Management in Cloud Workspace offers flexible provision modes such as Terraform and cloud native interfaces while centralizing management, enhancing security, optimizing costs, and improving governance.

Suspend an account when there’s a budget constraint or the account owner isn’t available in the organization. Only admins and account owners can see the suspended accounts.

Suspend the account configuration form and related list field descriptions.

Terraform account configuration form and related list field descriptions.

Keep account details up to date so you can identify and resolve policy violations effectively.

The Cloud Account Management app in Cloud Workspace manages the lifecycle of your cloud accounts.

View account statuses and violations, actionable insights, and administrative controls on the home page.

View and manage cloud account requests on requester page. The home page provides a view of requested, approved, denied, pending, and active accounts.

The Cloud account records page is a comprehensive dashboard that provides information to help you manage a cloud account.

The Cloud accounts page displays information used to access and manage the life cycle of multiple cloud subscription accounts.

The dashboard helps cloud governance and operations teams monitor, track, and act on compliance and asset details more efficiently. As an asset viewer, you can view all assets and drill down to see detailed information for each configuration item (CI).

This page displays the Cloud assets view. It lists all compute assets across connected cloud providers such as AWS, Azure, GCP, and OCI. Details include location, cloud account, installation status, owner, discovered dates, ownership attestation, and cost center.

Review and update request policies to confirm they align with your cloud account request process. These policies enforce data checks and conditions, promoting consistency in creating cloud subscription accounts.