AWS, Azure, Google Cloud and on-prem data is scanned by tigergate-dspm-scanner, which you deploy in your own environment with Terraform. TigerGate never holds a role or a credential in your cloud: you apply the module with your own credentials, and the scanner runs on its own identity.
EnvironmentRuns onQueue and stateGuide
AWSECS Fargate (or an EC2 Auto Scaling group)SQS and DynamoDBDeploy on AWS
AzureContainer Apps Jobs with a managed identityStorage queues and Table storageDeploy on Azure
Google CloudCloud Run Jobs with a keyless service accountPub/Sub and FirestoreDeploy on Google Cloud
On-premA container started by a systemd timer on your Linux hostSQLite on the hostDeploy on-prem
SaaS tools and SaaS warehouses need no deployment. See Connect SaaS sources.

​
The onboarding wizard

Go to DSPM → Deployments → Add deployment and choose AWS account, Azure subscription, Google Cloud project or On-prem. The wizard has five steps:
  1. Scan policy. What the scanner may read, exactly as the module grants it. It is read-only.
  2. Account & network. The account, subscription, project or site name; the regions; the TigerGate region; the network; the profile, the schedule (weekly by default), maximum workers and whether to share masked samples (on by default). Selecting Create deployment and enrollment token creates the deployment.
  3. Terraform. The enrollment token (shown once), the organization API key, and the generated main.tf, terraform.tfvars and apply commands, with links to the module archive and its checksums.
  4. Register & preflight. Waits for the scanner to register, then shows each preflight check with its fix.
  5. First run. The first run’s progress, report chunks and errors, with Run now.
You can close the wizard at any time. The deployment stays on the Deployments page with its status.

​
Two credentials

Every call the scanner makes to TigerGate carries two credentials:
  • The organization API key (tg_...) in the X-API-Key header. It authenticates your organization.
  • The enrollment token (tgdspm_...) on the first call, which the scanner exchanges once for a scanner credential of its own. It binds the call to one deployment.
TigerGate refuses a call whose API key is missing, invalid, revoked or expired, or belongs to another organization. The refusal is recorded on the deployment with its fix, because a refused scanner cannot report anything else.

​
The organization API key

The key is required on every platform. In the wizard’s Terraform step you can:
  • Create a key. Name it and select Create key. The value is shown once and filled into terraform.tfvars.
  • Paste a key you already have. TigerGate keeps only a hash, so an existing key’s value cannot be shown again.
  • Use a secret. Tick the option to keep the key out of Terraform state and give the secret that holds it: tigergate_api_key_secret_arn on AWS, tigergate_api_key_key_vault_secret_id on Azure, tigergate_api_key_secret_id on Google Cloud, or api-key.env on the on-prem host.
Listing and creating keys needs an organization owner or admin. Keys are also managed under Settings → Organization → API Keys → Organization Keys; see API keys. One key can serve every deployment.

​
The enrollment token

Each deployment has its own token. It works once: after the scanner registers, the token is spent and the scanner uses its own credential. TigerGate stores only hashes of both. To replace a lost or rejected credential, select Re-register on the deployment, which mints a new token, and put the token in place: the scanner registers again on its next run. See The scanner credential is rejected.

​
Terraform modules

The modules are published for each scanner version at https://releases.tigergate.dev/dspm/<version>/:
FileContent
tigergate-dspm-aws.zip, -azure.zip, -gcp.zip, -onprem.zip, -test-data.zipOne module each. The URL works directly as a Terraform source.
tigergate-dspm-terraform.zipEvery module in one archive.
tigergate-dspm-inaccount.yamlThe AWS CloudFormation template.
SHA256SUMSChecksums of the files above.
https://releases.tigergate.dev/dspm/latest/ serves the current release under the same names. Pin a version for production. To verify a download, run this in the directory that holds the downloaded files: 
sha256sum -c SHA256SUMS --ignore-missing
A single module can also be taken from the bundle: 
source = "https://releases.tigergate.dev/dspm/<version>/tigergate-dspm-terraform.zip//gcp"
Every module needs Terraform 1.11 or later. Each writes the token and the API key to its cloud’s secret store as write-only values, so neither is kept in Terraform state, and gives the scanner a reference to the secret, never the value.

​
Several clouds in one configuration

The examples/multi-cloud configuration in the bundle deploys AWS, Azure and Google Cloud together. Create one deployment per cloud in the console first, so each has its own enrollment token, then: 
export TF_VAR_tigergate_api_key='tg_...'
export TF_VAR_aws_enrollment_token='tgdspm_...'
export TF_VAR_azure_enrollment_token='tgdspm_...'
export TF_VAR_gcp_enrollment_token='tgdspm_...'

terraform init
terraform apply -var-file=multi-cloud.tfvars
terraform output run_now_commands   # register each deployment now, not at its next tick
multi-cloud.tfvars holds the non-secret inputs: tigergate_api_url, aws_vpc_id, aws_subnet_ids, azure_subscription_id and gcp_project_id. One API key serves the three deployments.

​
Deployment status

The Deployments page shows one status per deployment:
StatusMeaning
Not registeredThe deployment exists, but the scanner has not registered yet.
RegisteredThe scanner registered; no run has finished yet.
HealthyScanning on schedule, or a run is in progress.
DegradedThe last run finished with store errors, or a preflight check warned. Scanning works, with gaps.
FailingA preflight check failed, the last run failed, or TigerGate refused the scanner.
StaleNo call from the scanner for 45 minutes: three missed ticks.
RevokedThe deployment was revoked. Its scanner credential no longer works.
Scanner not deployedA cloud account connected to TigerGate has no in-account scanner, so nothing reads its data. Open it to start the wizard for that account.
Open a deployment for its Overview, Preflight, Runs, Configuration and Errors tabs. Every failed check, failed run and unreadable store has its fix beside it. See Troubleshooting.