Itom Cloud Accelerate

The Cloud Configuration Governance AWS policies are listed for your reference.

The Cloud Configuration Governance policy sets and its policies are listed for your reference.

The Cloud Configuration Governance AWS policies are listed for your reference.

Action that turns on monitoring for the selected Amazon Web Services (AWS) Virtual Machine (VM) instance.

Subflow that lists all users in your account and the status of their various credentials, including passwords, access keys, and MFA devices.

Action that retrieves the user name for the specified Amazon Web Services (AWS) Identity Access Management (IAM) user.

Action that describes the specified images (AMIs, AKIs, and ARIs) available to you or all of the images available to you.

Action that returns a list of all the Amazon Web Services (AWS) buckets owned by the authenticated sender of the request.

Action that returns a list of all Amazon Web Services (AWS) Virtual Machines (VM) that belong to the specified logical datacenter.

Action that configures the default encryption and Amazon Web Services (AWS) S3 Bucket Key for an existing bucket.

Subflow that retrieves the Access Control List (ACL) details for the specified Amazon Web Services (AWS) S3 bucket.

Subflow that returns the default encryption configuration for an Amazon Web Services (AWS) S3 bucket.

Action that stops the specified Amazon Web Services (AWS) Virtual Machine (VM).

Action that returns the list of Microsoft Azure Virtual Machines (VM) that belong to the specified logical datacenter.

Action that stops the specified Microsoft Azure Virtual Machine (VM).

Action that returns the IP details of the specified Microsoft Azure Virtual Machine (VM).

Action that returns monitoring information for the specified Microsoft Azure Virtual Machine (VM).

Action that deletes the password for the specified IAM user, which terminates the user's ability to access Amazon Web Services (AWS) services through the AWS Management Console.

Action that returns an array of integers in the specified range.

Subflow that returns the credentials alias for the mentioned credential.

Subflow that returns a suitable MID Server based on the specified MID Server selection criteria.

Cloud Action Library (CAL) offers various actions that you can use to build the Integration Hub subflows for Cloud Configuration Governance.

The Configuration key form contains detailed information about the configuration key.

Use the condition builder to create a Cloud Configuration Governance policy without writing any code at all. Use it to specify the criteria for identifying and reporting the non-compliant cloud resource configurations.

Use the Integration Hub subflow to create a Cloud Configuration Governance policy. An Integration Hub subflow uses graphical coding mechanisms to specify the policy conditions. It offers greater flexibility in audit violation reporting than the condition builder. That is, you can use the same policy to report different types of issues.

Use the ServiceNow platform native scripting mechanism to define the policy condition. You can externalize the decision making to script includes and reuse the code across different policies.

Create a custom remediation catalog item in Cloud Configuration Governance for the remediations that require additional input parameters to execute.

Create a remediation action in Cloud Configuration Governance for the remediations that doesn’t require any additional input parameters.

Cloud Configuration Governance is a tool used to manage the configuration of the cloud resources as per your organizational standards and established security standards. Use the dashboard to review the health score of the cloud, policy violation statistics, policy violation trend, remediations overview, and more.

Cloud Configuration Governance (CCG) uses Integration Hub subflows to interact with the cloud and update the configuration data in the Configuration Management Database (CMDB).

Cloud Configuration Governance policy defines the non-compliant configurations for a given cloud resource type.

The Cloud Configuration Governance Policy form displays detailed information about the policy such as cloud provider, resource type, policy type, and policy violation reporting settings.

Reference topics provide additional information about the Cloud Configuration Governance application.

Use the Cloud Configuration Governance remediation actions to fix the non-compliant cloud resource configurations identified during the scan runs.

The Resource collector form contains detailed information about the resource collector.

Cloud Configuration Governance users require the appropriate roles and system properties to perform various activities. These roles and system properties are installed with the activation of the application.

Run the appropriate remediation action to fix the non-compliant cloud configuration identified during the Cloud Configuration Governance scan run.

The Cloud Configuration Governance Scan configuration form displays detailed information about the scan configuration.

Scan configuration defines the various settings for the Cloud Configuration Governance scan.

Each execution of a scan configuration is called a scan run. The Scan Runs module displays a list of all the scan runs.

Cloud Configuration Governance provides several objects and variables that you can use to create script-based policies and CI finder mapping scripts.

The Cloud Configuration Governance Service Account Assume Role Config form displays detailed information about the assume role configuration used to access the trusting account.

Reference topics provide additional information about the Cloud Action Library application.

Use the ready-to-use actions and subflows of the ServiceNow Cloud Action Library application to interact with the cloud resources of the organization. ServiceNow ITOM Cloud Accelerate features, such as Cloud Configuration Governance, use these actions to operate.

Use the ServiceNow Cloud Configuration Governance application to check the configuration settings of cloud resources in your organization against a set of policies to identify violations. After identifying the violation, use remediation workflows to mitigate them.

This application is no longer deployed, enhanced, or supported.

The Cloud Configuration Governance requires appropriate cloud permissions to collect the base system configuration keys from the cloud. Therefore, you must set the appropriate permissions in the cloud to suit the needs of your organization.

You need appropriate cloud permissions to execute the Cloud Action Library actions and subflows. Edit the cloud permissions profile JSON to suit the needs of your organization.

Configure the trusting account whose resources need to be accessed, to rely on the trusted account using the Identity and Access Management (IAM) role.

Copy an Integration Hub subflow template to create subflows for the Cloud Configuration Governance application.

Create a service account assume role configuration to facilitate cross-account access. This supports access from a management account to a member account, or from a trusted account to a trusting account. All related accounts are automatically loaded, avoiding the need to add them individually.

Create a configuration collector to set up how Cloud Configuration Governance imports the configuration data from the cloud. The configuration collector uses Integration Hub subflows to import the configuration data from the cloud.

Create a configuration key in Cloud Configuration Governance to use it in the policies. The configuration key specifies the resource collector and configuration collectors used to import the configuration data from the cloud. It also specifies the data type of the configuration value.

Create a policy set in Cloud Configuration Governance to group policies that enforce a given security or organization standard. When the scan configuration runs the policy set, it identifies the cloud resources that don’t adhere to the set standards. A policy set can contain one or more policies.

Create a resource collector to set up how Cloud Configuration Governance imports all the resources of a given type.

Create a scan configuration in Cloud Configuration Governance to scan the cloud resources against one or more policy sets and identify the policy violations.

Use the CI finder mapping to link the resources fetched by the ServiceNow Cloud Configuration Governance scan runs with the appropriate Configuration Management Database (CMDB) Configuration Items (CIs), if available. After you create the mapping, you can associate the reported configuration violations with the CIs to which they belong.

If any conrefs are broken, re-add them from the doc/source/reuse/domain-separation/domain-separation-overview.dita file. In the short description, edit the first sentence to state whether domain separation is supported or not and add the application name. Keep the conref at the end that describes domain separation.Domain separation is not supported in Cloud Action Library . Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

If any conrefs are broken, re-add them from the doc/source/reuse/domain-separation/domain-separation-overview.dita file.Domain separation is not supported in Cloud Configuration Governance . Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

Understand the typical Cloud Action Library workflows and high-level tasks.

Understand the typical Cloud Configuration Governance workflow and high-level tasks.

You can install the CCG Content Pack application (sn_itom_ccg_cp) if you have the admin role.If the application does NOT include demo data or it does NOT install related applications and plugins, delete or revise the following sentence:

You can install the Cloud Action Library application (sn.itom.cal) if you have the admin role. The application installs related ServiceNow Store applications and plugins if they are not already installed.

You can install the Cloud Configuration Governance application (com.sn.itom.ccg) if you have the admin role. The application installs related ServiceNow Store applications and plugins if they aren’t already installed.

ITOM Cloud Accelerate workflows streamline cloud automation across the cloud adoption journey via self-service catalogs and controlled workflows. It expedites application migration by facilitating assessment, planning, and resource migration tracking.

Reference topics provide additional information for configuring and using ITOM Cloud Accelerate.

Tables that list the plugins or applications that are installed with ITOM Cloud Accelerate applications. When you update your application, any newly required application dependencies are installed.

Run a scan configuration to evaluate the resource configuration of the given cloud against the specified policy sets and identify the policy violations. Cloud Configuration Governance reports the identified policy violations as audit results.

Set up access to the Amazon Web Services (AWS) cloud accounts in Cloud Configuration Governance to enable interaction between the application and the cloud. The application requires access to the cloud accounts to scan the cloud resources for non-compliant configurations and remediate them.

Set up access to the Microsoft Azure cloud accounts in Cloud Configuration Governance to enable interaction between the application and the cloud. The application requires access to the cloud accounts of your organization to scan the cloud resources for non-compliant configurations and remediate them.

Set up access to the Amazon Web Services (AWS) cloud accounts in Cloud Action Library to enable interaction between the application and the cloud.

Set up access to the Microsoft Azure cloud accounts in Cloud Action Library to enable interaction between the application and the cloud.

Test the Cloud Configuration Governance policy against the configuration data imported for a previous scan run. Test the policy to make sure that it is working properly.

Cloud Configuration Governance provides a set of ready-to-use policies. You can either use these policies to identify the non-compliant cloud resource configurations within your cloud organization, or create custom policies. After identifying the non-compliant cloud resource configurations, you can use the remediation feature of the application to fix the violations.