Skip to content
Day 1 setup guide for Amazon Web Services on Cloud Provisioning and Governance › Cloud Provisioning and Governance › ITOM Cloud Accelerate › IT Operations Management
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Configure a custom AWS member role

Customize the AWS roles that a MID Server can assume to receive temporary credentials for member accounts. You can configure additional parameters to improve security and customize the way that the member account’s role is assumed when discovering cloud resources.

Before you begin

Role required: admin

About this task

Values that you enter in the Cloud Service Account > AWS Org Assume Role Params [cloud_service_account_aws_org_assume_role_params] table are passed as parameters to the AWS AssumeRole API for the named service account.

Procedure

  1. Navigate to All > Cloud Provisioning and Governance > Organization Access Parameters > AWS Org Assume Role Parameters.
Image omitted: AWSOrgAssumeRoleModule.png
AWS Org Assume Role Parameters module
  1. Click New and then complete the form using these parameters:
FieldDescription
Access role name \[access\_role\_name\]Name of the AWS role in the member account which is used by the management account to acquire temporary credentials.Default: OrganizationAccountAccessRole
Role session name \[role\_session\_name\]Name for the session using the temporary security credentials that may help in distinguishing use of a role by a principal or purpose. This session name is visible in the AWS Cloud Trail logs. See Cloud API Trail and the AWS documentation on AWS Cloud Trail for details.Default: master\_account\_id\_\_<management account ID number> An example of this is: `master_account_id__321003876149`.
Credential TTL in seconds \[credential\_ttl\_seconds\]

Time in seconds for the temporary security credentials to live.Default: Calculated as follows:

  1. Retrieve the value in the mid.aws.sts.assume_role.credential_ttl_minutes MID Server property.
  2. Constrain this value to be between 15 and 720 minutes. If the setting in the property is less than 15 minutes, the system enters 15 minutes. If the setting is greater than 720 minutes, the system enters 720 minutes.
  3. Convert the resulting value into seconds.
External ID \[external\_id\]Unique identifier required by the trust policy of the role being assumed.Default: ServiceNow\_MID\_Server
Session policy \[session\_policy\]IAM policy in JSON format that further restricts the permissions of the temporary security credentials beyond the role configured policy. \(JSON in AWS policy language.\)Default: Blank
MFA \[multifactor authentication\]Serial number of the Multi-Factor Authentication \(MFA\) device \(hardware or virtual\) used to authenticate the management account.Default: Blank
MFA token code \[mfa\_token\_code\]Token code supplied by the MFA device \(hardware or virtual\) used to authenticate the management account.Default: Blank
Cloud service account \[cloud\_service\_account\]Required. Service account to associate with the access parameters that you pass to the AWS AssumeRole API. Enter an account ID, either a management account or a member account, from the Service Accounts \[cmdb\_ci\_cloud\_service\_account\] table.
**Note:** For more details on how these parameters are used and what they mean, see the [AWS documentation](https://aws.amazon.com/documentation/) on the AWS Security Token Service API for the AssumeRole action.