TigerGate scans your AWS account with read-only access. The recommended way is a cross-account IAM role that TigerGate assumes — no long-lived keys to store or rotate. A one-click CloudFormation template sets it up.
The role grants auditing/read permissions only (SecurityAudit + ViewOnlyAccess + a few extra read actions). TigerGate can never create, modify, or delete resources in your account.

​
Before you start

Deploying the template needs two values:
ValueWhat it is
TigerGate account IDThe 12-digit AWS account TigerGate scans from — the principal that assumes your role. Get it from TigerGate; it fills the template’s TigerGateAccountId parameter.
External IDA shared secret you choose (any unique string). Put the same value in the template and in the AWS connection form (confused-deputy protection).

​
1. Create the role with CloudFormation

1

Get the template

Use the tigergate-cspm-scan-role.yaml template (shown in full at the bottom of this page — copy it into a file).
2

Deploy it in the account you want scanned

aws cloudformation deploy \
  --template-file tigergate-cspm-scan-role.yaml \
  --stack-name tigergate-cspm-scan-role \
  --capabilities CAPABILITY_NAMED_IAM \
  --parameter-overrides \
      TigerGateAccountId=<TIGERGATE_ACCOUNT_ID> \
      ExternalId=<EXTERNAL_ID_FROM_TIGERGATE>
CAPABILITY_NAMED_IAM is required because the template creates a named role.
3

Copy the Role ARN from the stack Outputs

aws cloudformation describe-stacks \
  --stack-name tigergate-cspm-scan-role \
  --query "Stacks[0].Outputs" --output table

​
2. Connect it in TigerGate

1

Paste the Role ARN + External ID

In the dashboard, go to Integrations → Cloud Providers → Add Provider → Amazon Web Services. Paste the RoleArn output into Role ARN and the same value into External ID. Set a Default Region (required — used for the initial STS/API calls; the scan still covers every region).
2

Test

Click Test. TigerGate does a live AssumeRole + GetCallerIdentity and confirms the connection works — or tells you the exact AWS reason (bad credentials, assume-role denied, wrong external ID) so you can fix it before saving.
3

Scan or schedule

Run an on-demand scan, or add a Schedule. Schedule creation re-validates the credentials, so a broken role can’t be scheduled.

​
Multiple accounts (AWS Organizations)

To roll the role out across every account in an Organization, deploy the same template as a CloudFormation StackSet targeting your OUs. Use the same TigerGate account ID; you can share one External ID or use one per account.

​
Alternative: static access keys

If you can’t use a role, TigerGate also accepts an IAM user’s access key + secret key (with an optional session token for temporary STS credentials). Attach the same read-only policies (SecurityAudit + ViewOnlyAccess + the extra read actions) to that user, then enter the keys in the same Add Provider → Amazon Web Services form (Access Key ID, Secret Access Key, Default Region). A role is preferred — no long-lived secrets to store or rotate.
An access key belongs to an IAM user, not a role. Don’t put a user ARN in the “Role ARN” field — roles are assumed, users are not, and the scan will fail with AccessDenied on sts:AssumeRole.

​
Troubleshooting

Scan/Test errorCauseFix
AccessDenied … sts:AssumeRoleRole trust doesn’t allow TigerGate, wrong External ID, or a user ARN was entered as the roleRedeploy the template with the correct TigerGate account ID + External ID; make sure the Role ARN (not a user ARN) is used
SignatureDoesNotMatch / AWS Secret Access Key is invalidWrong/rotated secret keyRe-enter the access key + secret, or switch to the role
InvalidClientTokenIdAccess key ID is wrong or deactivatedRe-check the key
Scan runs but few findingsMissing read permissionsEnsure both managed policies + the additions policy are attached (the template does this)

​
The template

AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  TigerGate CSPM read-only scan role. Creates a cross-account IAM ROLE that
  TigerGate assumes (via sts:AssumeRole with an ExternalId) to run posture scans
  against this AWS account. Read-only auditing permissions only.

Parameters:
  TigerGateAccountId:
    Type: String
    Description: The 12-digit AWS account ID TigerGate scans FROM.
    AllowedPattern: "^[0-9]{12}$"
  ExternalId:
    Type: String
    Description: Shared secret TigerGate must send when assuming the role.
    NoEcho: true
    MinLength: 8
    MaxLength: 1224
  RoleName:
    Type: String
    Default: TigerGateCSPMScanRole
    AllowedPattern: "^[A-Za-z0-9+=,.@_-]{1,64}$"
  MaxSessionDurationSeconds:
    Type: Number
    Default: 3600
    MinValue: 3600
    MaxValue: 43200

Resources:
  TigerGateScanRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      Description: Read-only role assumed by TigerGate to run CSPM posture scans.
      MaxSessionDuration: !Ref MaxSessionDurationSeconds
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub "arn:${AWS::Partition}:iam::${TigerGateAccountId}:root"
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ExternalId
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/SecurityAudit"
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/job-function/ViewOnlyAccess"
      Policies:
        - PolicyName: TigerGateReadOnlyAdditions
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: AllowMoreReadForTigerGate
                Effect: Allow
                Action:
                  - account:Get*
                  - appstream:Describe*
                  - appstream:List*
                  - backup:List*
                  - cloudtrail:GetInsightSelectors
                  - codeartifact:List*
                  - codebuild:BatchGet*
                  - cognito-idp:GetUserPoolMfaConfig
                  - dlm:Get*
                  - drs:Describe*
                  - ds:Get*
                  - ds:Describe*
                  - ds:List*
                  - dynamodb:GetResourcePolicy
                  - ec2:GetEbsEncryptionByDefault
                  - ec2:GetInstanceMetadataDefaults
                  - ec2:GetSnapshotBlockPublicAccessState
                  - ecr:Describe*
                  - ecr:GetRegistryScanningConfiguration
                  - elasticfilesystem:DescribeBackupPolicy
                  - glue:GetConnections
                  - glue:GetSecurityConfiguration*
                  - glue:SearchTables
                  - lambda:GetFunction*
                  - logs:FilterLogEvents
                  - macie2:GetMacieSession
                  - s3:GetAccountPublicAccessBlock
                  - securityhub:BatchImportFindings
                  - securityhub:GetFindings
                  - shield:DescribeProtection
                  - shield:GetSubscriptionState
                  - ssm:GetDocument
                  - ssm-incidents:List*
                  - support:Describe*
                  - tag:GetTagKeys
                  - wellarchitected:List*
                Resource: "*"

Outputs:
  RoleArn:
    Description: Paste this into TigerGate as the AWS Role ARN.
    Value: !GetAtt TigerGateScanRole.Arn
  ExternalId:
    Value: !Ref ExternalId