Connect an AWS account

TigerGate scans AWS with a read-only IAM user. You create the user, attach the permissions below, and paste its access key into TigerGate. Nothing in this setup can create, change, or delete a resource. The user needs three policies:

Policy	Type
`SecurityAudit`	AWS managed
`ViewOnlyAccess`	AWS managed
`TigerGateCSPMReadOnly`	Inline — the JSON below

The two AWS-managed policies do not cover every read a scan makes. Without the inline policy the scan still runs, but checks for services such as Bedrock, Backup, API Gateway, Service Catalog, and Macie return no results.

Policy JSON

Save this as TigerGateCSPMReadOnly.json.

TigerGateCSPMReadOnly.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "TigerGateCSPMReadOnly",
      "Effect": "Allow",
      "Action": [
        "account:Get*",
        "amplify:ListApps",
        "amplify:ListBranches",
        "appstream:Describe*",
        "appstream:List*",
        "backup:Get*",
        "backup:List*",
        "bedrock:Get*",
        "bedrock:List*",
        "cloudtrail:GetInsightSelectors",
        "codeartifact:List*",
        "codebuild:BatchGet*",
        "codebuild:ListReportGroups",
        "codepipeline:ListTagsForResource",
        "cognito-idp:GetUserPoolMfaConfig",
        "datapipeline:DescribePipelines",
        "datapipeline:GetPipelineDefinition",
        "datapipeline:ListPipelines",
        "dlm:Get*",
        "drs:Describe*",
        "ds:Describe*",
        "ds:Get*",
        "ds:List*",
        "dynamodb:GetResourcePolicy",
        "ec2:GetEbsEncryptionByDefault",
        "ec2:GetInstanceMetadataDefaults",
        "ec2:GetSnapshotBlockPublicAccessState",
        "ecr:BatchGetImage",
        "ecr:Describe*",
        "ecr:GetDownloadUrlForLayer",
        "ecr:GetRegistryScanningConfiguration",
        "elasticfilesystem:DescribeBackupPolicy",
        "glue:GetConnections",
        "glue:GetMLTransforms",
        "glue:GetSecurityConfiguration*",
        "glue:SearchTables",
        "lambda:GetFunction*",
        "lambda:GetLayerVersion",
        "lightsail:GetRelationalDatabases",
        "logs:FilterLogEvents",
        "macie2:GetAutomatedDiscoveryConfiguration",
        "macie2:GetMacieSession",
        "rolesanywhere:ListProfiles",
        "rolesanywhere:ListTagsForResource",
        "rolesanywhere:ListTrustAnchors",
        "s3:GetAccountPublicAccessBlock",
        "s3:GetObjectAcl",
        "s3:ListBucket",
        "securityhub:GetFindings",
        "servicecatalog:Describe*",
        "servicecatalog:List*",
        "shield:DescribeProtection",
        "shield:GetSubscriptionState",
        "ssm-incidents:GetReplicationSet",
        "ssm-incidents:List*",
        "ssm:GetDocument",
        "states:ListTagsForResource",
        "storagegateway:DescribeSMBFileShares",
        "support:Describe*",
        "tag:GetTagKeys",
        "waf:GetLoggingConfiguration",
        "waf:GetRule",
        "wellarchitected:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "TigerGateAPIGatewayReadOnly",
      "Effect": "Allow",
      "Action": [
        "apigateway:GET"
      ],
      "Resource": [
        "arn:*:apigateway:*::/restapis/*",
        "arn:*:apigateway:*::/apis/*",
        "arn:*:apigateway:*::/domainnames",
        "arn:*:apigateway:*::/domainnames/*"
      ]
    }
  ]
}

Create the IAM user and access key

AWS console
AWS CLI

Create the user

Go to IAM → Users → Create user. Name it tigergate-cspm and leave console access off.

Attach the managed policies

Choose Attach policies directly, select SecurityAudit and ViewOnlyAccess, and create the user.

Add the inline policy

Open the user, then Add permissions → Create inline policy → JSON. Paste the policy JSON above and name it TigerGateCSPMReadOnly.

Create an access key

On the user’s Security credentials tab, choose Create access key → Third-party service. Copy the Access key ID and Secret access key.

Run from the folder where you saved TigerGateCSPMReadOnly.json:

aws iam create-user --user-name tigergate-cspm

aws iam attach-user-policy --user-name tigergate-cspm \
  --policy-arn arn:aws:iam::aws:policy/SecurityAudit

aws iam attach-user-policy --user-name tigergate-cspm \
  --policy-arn arn:aws:iam::aws:policy/job-function/ViewOnlyAccess

aws iam put-user-policy --user-name tigergate-cspm \
  --policy-name TigerGateCSPMReadOnly \
  --policy-document file://TigerGateCSPMReadOnly.json

aws iam create-access-key --user-name tigergate-cspm

create-access-key prints AccessKeyId and SecretAccessKey.

The secret access key is shown only once. If you lose it, delete the key and create a new one.

Add the account to TigerGate

Open the form

Go to Integrations → Cloud Providers and choose Amazon Web Services. The same policy and commands are under How to create a read-only access key at the top of the form.

Enter the key

Fill in Connection Name, Access Key ID, Secret Access Key, and Default Region (for example us-east-1). The region is only used for the first API calls; the scan covers every region. Leave the Advanced fields blank.

Test

Click Connect Provider, then Test on the connection. If the test fails, the connection shows the error AWS returned.

Scan

Go to Cloud Security → Schedules to run a scan now or set a schedule.

Rotate the key

Create a second access key for tigergate-cspm, open the connection’s Edit form, enter the new key pair, and run Test. Once it passes, deactivate and delete the old key. Fields you leave blank in Edit keep their saved values.

Troubleshooting

Error	Fix
`InvalidClientTokenId`	The access key ID is wrong or deactivated. Re-enter it.
`SignatureDoesNotMatch`	The secret access key is wrong. Re-enter the pair, or create a new key.
Scan finishes but some services have no findings	A policy is missing. Confirm all three policies are on the user.

​Policy JSON

​Create the IAM user and access key

​Add the account to TigerGate

​Rotate the key

​Troubleshooting

Policy JSON

Create the IAM user and access key

Add the account to TigerGate

Rotate the key

Troubleshooting