Skip to page contentSkip to chat
ServiceNow support
    • Community
      Ask questions, give advice, and connect with fellow ServiceNow professionals.
      Developer
      Build, test, and deploy applications
      Documentation
      Find detailed information about ServiceNow products, apps, features, and releases.
      Impact
      Accelerate ROI and amplify your expertise.
      Learning
      Build skills with instructor-led and online training.
      Partner
      Grow your business with promotions, news, and marketing tools
      ServiceNow
      Learn about ServiceNow products & solutions.
      Store
      Download certified apps and integrations that complement ServiceNow.
      Support
      Manage your instances, access self-help, and get technical support.
AWS member accounts discovery fails with Status Code: 401 - Support and Troubleshooting
  • >
  • Knowledge Base
  • >
  • Support and Troubleshooting (Knowledge Base)
  • >
  • AWS member accounts discovery fails with Status Code: 401
KB0748234

AWS member accounts discovery fails with Status Code: 401


4385 Views Last updated : Jul 24, 2025 public Copy Permalink
KB Summary by Now Assist

Issue

The management account corresponds to the Organization in AWS. You can identify any cloud service account in your instance as a management account only if you already configured the account in AWS as an Organization and you already associated other accounts under the Organization. 

Requirement: Amazon Technical Account confirmed the Service account should use a management account for Discovery and then use STS with specific roles for each member.

Doc: Managing the AWS Accounts in Your Organization

Minimum Permissions: To access an AWS account from any other account in your organization, you must have the following permission: sts: AssumeRole – The Resource element must be set to either an asterisk (*) or the account ID number of the account with the user who needs to access the new member account" 


Discovery of AWS member accounts using the credentials of the parent account may fail with the error:

"AWS was not able to validate the provided access credentials (Service: AmazonEC2; Status Code: 401; Error Code: AuthFailure; Request ID: xxxxxx-xxxx-xxxxx"

The credentials for the parent account of the AWS organization work successfully and can discover the parent account. However, obtaining a temporary token via Amazon STS for a member account using the parent account credentials will be not working.

Release

All releases. Instance activated with CMPv2 plugin and configured with AWS Management Service Account.


Cause

When discovering member accounts, the AWS Discovery credential and management service accounts are used to generate a temporary token. In order to generate this token, the management account needs to have the "AssumeRole" permission.

Resolution

Ensure the "OrganizationAccountAccessRole" is available and that has the "AssumeRole" permission.

Related Links

Can Discovery/MID Server be configured to use another role other than OrganizationAccountAccessRole? No, unfortunately, the STS override workaround is not going to be feasible. 

Additionally, and also for security, SN does not offer any methods available to use from the MID server level for decrypting passwords. MID servers store passwords in memory for this reason, so we cannot manually retrieve and decrypt credentials to make this function call, which would also be a security concern. 

A workaround would be to customize the default OrganizationAccountAccessRole to your desired role, and then create a new custom role with the admin rights that you would want your users to use as your "administrative link".


The world works with ServiceNow.

Sign in for more! There's more content available only to authenticated users Sign in for more!
Did this KB article help you?
Did this KB article help you?

Attachments

Attachments

No attachments found

How would you rate your Now Support digital experience?

*

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

What can we improve? Please select all that apply.

What are we doing well? Please select all that apply.

Tell us more

*

Do you expect a response from this feedback?

  • Terms and conditions
  • Privacy statement
  • GDPR
  • Cookie policy
  • © 2025 ServiceNow. All rights reserved.