TigerGate scans your Oracle Cloud Infrastructure tenancy with read-only access via a dedicated IAM user and its API signing key.
The user only needs an inspect/read policy over all-resources. TigerGate can never create, modify, or delete resources in your tenancy.

​
Before you start

In TigerGate, open Cloud Providers → Oracle Cloud (OCI). You’ll fill in five values once the user and API key exist:
ValueWhat it is
Tenancy OCIDYour OCI tenancy’s OCID (Console → Profile menu → Tenancy).
User OCIDThe OCID of the IAM user created below.
FingerprintThe fingerprint of the API key uploaded to that user.
Private Key (PEM)The private half of the same API key pair.
RegionThe tenancy’s home region (e.g. us-ashburn-1).

​
1. Create the read-only user

1

Create a group and user

oci iam group create --name tigergate-cspm-scan \
  --description "TigerGate CSPM read-only scan group"

oci iam user create --name tigergate-cspm-scan \
  --description "TigerGate CSPM read-only scan user"

oci iam group add-user \
  --group-id <GROUP_OCID> --user-id <USER_OCID>
2

Grant a read-only policy

oci iam policy create \
  --name tigergate-cspm-read-only \
  --description "Read-only access for TigerGate CSPM scans" \
  --compartment-id <TENANCY_OCID> \
  --statements '["Allow group tigergate-cspm-scan to inspect all-resources in tenancy",
                  "Allow group tigergate-cspm-scan to read all-resources in tenancy"]'
inspect + read cover everything the posture checks need without granting access to resource contents (e.g. object storage bucket contents, secret values).
3

Generate an API signing key for the user

openssl genrsa -out tigergate-cspm-key.pem 2048
openssl rsa -pubout -in tigergate-cspm-key.pem -out tigergate-cspm-key-public.pem

oci iam user api-key upload \
  --user-id <USER_OCID> \
  --key-file tigergate-cspm-key-public.pem
The upload command’s output includes the key’s fingerprint — copy it. tigergate-cspm-key.pem is the private key you’ll paste into TigerGate; treat it as a secret.

​
2. Connect it in TigerGate

1

Fill in the five values

In Cloud Providers → Oracle Cloud (OCI), enter the Tenancy OCID, User OCID, Fingerprint, the full contents of tigergate-cspm-key.pem as Private Key (PEM), and the tenancy’s home Region.
2

Test

Click Test. For Oracle Cloud this is a field check — TigerGate confirms the Tenancy OCID, User OCID, Fingerprint, and Private Key are all present. The key is first exercised against OCI on your first scan, where the scanner signs requests with it, so run an on-demand scan to confirm the credentials and policy work end-to-end.
3

Scan or schedule

Run an on-demand scan, or add a Schedule under Cloud Security → Schedules. Credential problems surface on the first scan — if it fails auth, fix the key, fingerprint, or policy and re-run.

​
Troubleshooting

Scan errorCauseFix
NotAuthenticatedFingerprint doesn’t match the uploaded key, or the private key is wrongRe-upload the public key and copy the fingerprint from the upload output exactly
NotAuthorized on read callsPolicy statements missing or scoped to the wrong compartmentRe-run the policy create command against the tenancy (root compartment) OCID
Private key parse errorKey was truncated or re-wrapped when pastedPaste the raw tigergate-cspm-key.pem contents, including the BEGIN/END lines, unmodified
Scan runs but few findingsPolicy only grants inspect, not readEnsure both statements from step 2 are present