Skip to main content

How to Discover S3 Devices in ServiceOps

Discover Amazon S3 buckets as managed assets in ServiceOps using the AWS Public Cloud Network scan, so your cloud storage inventory stays accurate and auditable.

This guide walks you through creating AWS credentials, configuring the scan, and running discovery. It applies to both On-Premises and SaaS deployments of ServiceOps.

Prerequisites​

  • Administrative access to the Admin > Discovery And Agents section of ServiceOps.
  • An active AWS account with an IAM user or role that has the following S3 permissions: s3:ListAllMyBuckets, s3:GetBucketLocation, and relevant s3:Get* / s3:List* actions.
  • The AWS Access Key ID and Secret Key for the IAM identity above.
  • Outbound HTTPS (TCP 443) connectivity from the ServiceOps server or Poller to AWS API endpoints.
  • A Poller configured in ServiceOps, if you are discovering assets through a Poller Service. This is recommended for SaaS deployments and for on-premises networks behind a firewall.
  • A Proxy Server configured in ServiceOps, if your environment requires one for internet access to AWS.

Steps​

Step 1: Create AWS Credentials for S3 Discovery​

Create a dedicated AWS credential for S3 discovery. Storing it separately makes it reusable across scans and easier to audit.

  1. Go to Admin > Discovery and Agents > Credentials.
  2. Click Create Credentials.
  3. Retrieve the Access Key ID and Secret Access Key from AWS. On your AWS console, go to IAM > IAM users, open the IAM user configured for S3 discovery, and click Create access key under the Access key section.

AWS IAM Users page showing the IAM user summary with the Create access key link highlighted in the Access key section

The Retrieve access keys page displays the Access key and Secret access key. Copy both values and store them in a secure location. The Secret Access Key is shown only once and cannot be retrieved after you close this page.

AWS Retrieve access keys page showing the Access key and Secret access key values ready to copy

  1. Fill in the following fields in ServiceOps:

ServiceOps Create Credentials form with AWS credential type selected for S3 discovery

FieldValue
NameEnter a descriptive name, for example: S3 Discovery
Credential TypeSelect AWS
Access Key IdEnter the AWS Access Key ID retrieved in step 3
Secret Key IdEnter the AWS Secret Access Key retrieved in step 3
RegionsSelect the AWS regions where your S3 buckets are located
DescriptionOptional, for example: Credentials to discover S3

  1. Click Test Connection to verify the credential authenticates to AWS.

  2. Click Save.

Credential Permissions

If the Access Key ID or Secret Key is incorrect, or if the IAM identity lacks the required S3 permissions, the discovery scan will fail. Verify both before proceeding.

Step 2: Configure the Public Cloud Network Scan​

The Public Cloud Network scan defines which AWS account and region to connect to, which credential to use, and how to route the scan.

  1. Go to Admin > Discovery and Agents > Discovery > Public Cloud Network.
  2. Click Create Public Cloud Network.
  3. Fill in the following fields:

FieldValue
NameEnter a descriptive name, for example: S3 Discovery Scan
Cloud TypeSelect AWS
DescriptionOptional, for example: S3 Discovery Scan
CredentialsSelect the AWS credential created in Step 1
PollerSelect a Poller service, if applicable
Proxy ServerSelect a Proxy Server, if internet access to AWS requires one.
  1. Click Save. The new scan appears on the Public Cloud Network list.

Step 3: Run the Discovery​

Trigger the discovery scan and monitor its progress in real time.

  1. On the Public Cloud Network list page, locate the scan you created (for example: S3 Discovery Scan).
  2. Click the Discover New Asset icon in the row actions.

  1. Go to Admin > Discovery and Agents > Discovery > Discovery Service.
  2. Select the relevant Poller (if applicable) and open the Running Scan tab.
  3. Confirm the scan details: Scan Name, Scan Type (Cloud Network (Discovery)), Start Date, and Submitted By.

  1. Track discovery progress using the S3 Asset/CI counter alongside the Total, AWS Database Asset/CI, and EC2 Asset/CI counters.
  2. Once the scan completes, open the Completed Scan tab to review discovered and not-discovered counts.
  3. Click View History for a detailed breakdown. Download results in Excel or PDF format for your records if needed.
  4. Confirm discovered S3 buckets appear under the S3 asset type in Asset Management or CMDB, depending on your configured Discovery Preference Rule.

Step 4 (Optional): Schedule Recurring Discovery​

Schedule automatic discovery runs to keep your S3 inventory current without manual re-runs.

  1. On the Public Cloud Network list page, select Scheduler next to the S3 Discovery Scan.
  2. Configure the Discover Scan Schedule: choose from Once, Daily, Weekly, Monthly, or Interval.

  1. Choose whether to automatically add entities in Asset or CI list based on the Discovery Preference rule.
  2. Add notification email addresses if you want alerts on completion.
  3. Configure a Polling Scan Schedule to refresh existing S3 asset details on a recurring basis (optional).
  4. Click Save. Scheduled runs appear in the Discovery Service tab at the configured time.

Best Practices​

  • Use a dedicated IAM user or role for S3 discovery with least-privilege permissions scoped only to S3 actions. Do not reuse credentials from other services.
  • Select only the AWS regions where S3 buckets are actively used. Scanning unnecessary regions adds scan time without benefit.
  • Run Test Connection on the credential after any IAM key rotation to catch authentication failures before the next scheduled scan.
  • Review the Completed Scan history after each run to catch any assets that were not discovered.
  • Enable the Polling Scan Schedule alongside the discovery schedule so that bucket metadata stays current between full discovery runs.

Troubleshooting​

Common issues and fixes for S3 discovery in ServiceOps.

Discovery completes but no S3 assets appear

Cause: The Access Key ID or Secret Key entered in the credential is incorrect or expired, or the IAM identity lacks the required S3 permissions.

Fix: Open Admin > Discovery and Agents > Credentials, edit the S3 Discovery credential, and verify the Access Key ID and Secret Key. Confirm the IAM identity has s3:ListAllMyBuckets, s3:GetBucketLocation, and the relevant s3:Get* / s3:List* actions. Re-run Test Connection and retry the scan.

Buckets from some regions are missing after discovery

Cause: The credential does not include all the AWS regions where S3 buckets exist. Buckets outside the selected regions are not returned.

Fix: Go to Admin > Discovery and Agents > Credentials and open the credential used for the scan. Verify that the required regions in which S3 buckets exist are selected. If any regions are missing, either update the credentials in ServiceOps or add the regions in the S3 bucket, then re-run the discovery scan.

Scan fails to connect to AWS

Cause: The ServiceOps server or assigned Poller does not have outbound HTTPS (TCP 443) access to AWS API endpoints, or the Proxy Server is not configured correctly.

Fix: Confirm outbound HTTPS connectivity to AWS from the server or Poller. If a proxy is required, open the Public Cloud Network scan configuration and verify the correct Proxy Server is selected.

Next Steps​