TigerGate Docs — code-to-cloud security platform

Use the TigerGate inventory collection script to generate customer-facing counts for licensing, sizing, and scoping.

Download the latest inventory collection script:customer-inventory-counts.shOr download it directly from the command line:

curl -fsSL https://download.tigergate.dev/scripts/tigergate-customer-inventory-counts.sh -o customer-inventory-counts.sh
chmod +x customer-inventory-counts.sh
./customer-inventory-counts.sh

Run it

chmod +x customer-inventory-counts.sh
./customer-inventory-counts.sh

Run with no arguments to be prompted for the product and provider. You can also target a single product:

./customer-inventory-counts.sh --product code --provider github --days 90
./customer-inventory-counts.sh --product container --provider all
./customer-inventory-counts.sh --product cloud --provider aws
./customer-inventory-counts.sh --product kspm
./customer-inventory-counts.sh --product runtime

Options

Option	Description	Default
`--product <name>`	Product to count: `code`, `container`, `cloud`, `kspm`, `runtime`, or `all`.	Prompted
`--provider <name>`	Provider to count. Comma-separate to select several, or use `all`.	Prompted
`--days <number>`	Activity window for code repositories.	`90`
`--out-dir <path>`	Directory for the result files.	`./tigergate-inventory-output`
`--details`	Print the itemized count tables to the terminal.	On
`--no-details`	Print only the summary tables to the terminal.
`--help`	Show usage and exit.

Result files are written to the output directory (see Output files below).

Cloud manual checks

If you want to validate cloud counts directly from the provider CLI, run the commands below.

AWS

Prerequisites:

IAM access key and secret key with ReadOnlyAccess or SecurityAudit
AWS CLI configured
region set in your shell or chosen per command

Assets count:

EC2 instances

aws ec2 describe-instances --region "$region" --query 'length(Reservations[].Instances[])'

EBS volumes

aws ec2 describe-volumes --region "$region" --query 'length(Volumes[])'

EBS snapshots

aws ec2 describe-snapshots --owner-ids self --region "$region" --query 'length(Snapshots[])'

Elastic IPs

aws ec2 describe-addresses --region "$region" --query 'length(Addresses[])'

Network interfaces

aws ec2 describe-network-interfaces --region "$region" --query 'length(NetworkInterfaces[])'

Application load balancers

aws elbv2 describe-load-balancers --region "$region" --query 'length(LoadBalancers[?Type==`application`])'

Network load balancers

aws elbv2 describe-load-balancers --region "$region" --query 'length(LoadBalancers[?Type==`network`])'

Classic load balancers

aws elb describe-load-balancers --region "$region" --query 'length(LoadBalancerDescriptions[])'

Target groups

aws elbv2 describe-target-groups --region "$region" --query 'length(TargetGroups[])'

Auto Scaling groups

aws autoscaling describe-auto-scaling-groups --region "$region" --query 'length(AutoScalingGroups[])'

RDS instances

aws rds describe-db-instances --region "$region" --query 'length(DBInstances[])'

RDS clusters

aws rds describe-db-clusters --region "$region" --query 'length(DBClusters[])'

Lambda functions

aws lambda list-functions --region "$region" --query 'length(Functions[])'

EKS clusters

aws eks list-clusters --region "$region" --query 'length(clusters[])'

ECR repositories

aws ecr describe-repositories --region "$region" --query 'length(repositories[])'

Security groups

aws ec2 describe-security-groups --region "$region" --query 'length(SecurityGroups[])'

VPCs

aws ec2 describe-vpcs --region "$region" --query 'length(Vpcs[])'

Subnets

aws ec2 describe-subnets --region "$region" --query 'length(Subnets[])'

NAT gateways

aws ec2 describe-nat-gateways --region "$region" --query 'length(NatGateways[])'

ECS clusters

aws ecs list-clusters --region "$region" --query 'length(clusterArns[])'

ECS services

aws ecs list-clusters --region "$region" --query 'clusterArns[]' --output text | tr '\t' '\n' | while read -r c; do [ -n "$c" ] && aws ecs list-services --region "$region" --cluster "$c" --query 'length(serviceArns[])'; done

ECS tasks

aws ecs list-clusters --region "$region" --query 'clusterArns[]' --output text | tr '\t' '\n' | while read -r c; do [ -n "$c" ] && aws ecs list-tasks --region "$region" --cluster "$c" --query 'length(taskArns[])'; done

Secrets Manager secrets

aws secretsmanager list-secrets --region "$region" --query 'length(SecretList[])'

KMS keys

aws kms list-keys --region "$region" --query 'length(Keys[])'

CloudWatch log groups

aws logs describe-log-groups --region "$region" --query 'length(logGroups[])'

API Gateway REST APIs

aws apigateway get-rest-apis --region "$region" --query 'length(items[])'

S3 buckets

aws s3api list-buckets --query 'length(Buckets[])'

IAM users

aws iam list-users --query 'length(Users[])'

IAM roles

aws iam list-roles --query 'length(Roles[])'

CloudFront distributions

aws cloudfront list-distributions --query 'length(DistributionList.Items[])'

The script uses AWS Config first when it is available. If AWS Config inventory is not available, it falls back to the direct API family above.

Azure

Prerequisites:

Azure CLI login
Reader on the subscription

Assets count:

Disks

az graph query -q "resources | where type =~ 'Microsoft.Compute/disks' | summarize Count = count()" -o json

Virtual machines

az graph query -q "resources | where type =~ 'Microsoft.Compute/virtualMachines' | summarize Count = count()" -o json

AKS managed clusters

az graph query -q "resources | where type =~ 'Microsoft.ContainerService/managedClusters' | summarize Count = count()" -o json

Load balancers

az graph query -q "resources | where type =~ 'Microsoft.Network/loadBalancers' | summarize Count = count()" -o json

Network interfaces

az graph query -q "resources | where type =~ 'Microsoft.Network/networkInterfaces' | summarize Count = count()" -o json

Public IP addresses

az graph query -q "resources | where type =~ 'Microsoft.Network/publicIPAddresses' | summarize Count = count()" -o json

Route tables

az graph query -q "resources | where type =~ 'Microsoft.Network/routeTables' | summarize Count = count()" -o json

Virtual networks

az graph query -q "resources | where type =~ 'Microsoft.Network/virtualNetworks' | summarize Count = count()" -o json

Subnets

az graph query -q "resources | where type =~ 'Microsoft.Network/virtualNetworks' | mv-expand subnets = properties.subnets | summarize Count = count()" -o json

GCP

Prerequisites:

gcloud auth
roles/cloudasset.viewer
one or more project IDs

Assets count:

Subnetworks

gcloud asset search-all-resources --project="$project" --asset-types=compute.googleapis.com/Subnetwork --format='value(name)' | sort -u | wc -l

Routes

gcloud asset search-all-resources --project="$project" --asset-types=compute.googleapis.com/Route --format='value(name)' | sort -u | wc -l

Firewalls

gcloud asset search-all-resources --project="$project" --asset-types=compute.googleapis.com/Firewall --format='value(name)' | sort -u | wc -l

Log buckets

gcloud asset search-all-resources --project="$project" --asset-types=logging.googleapis.com/LogBucket --format='value(name)' | sort -u | wc -l

Services

gcloud asset search-all-resources --project="$project" --asset-types=serviceusage.googleapis.com/Service --format='value(name)' | sort -u | wc -l

OCI

Prerequisites:

OCI CLI login
OCI_COMPARTMENT_ID

Assets count:

oci search resource structured-search --query-text "query all resources where compartmentId = '$OCI_COMPARTMENT_ID'" --all

The script groups the returned rows by resource type and counts them.

Code manual checks

If you want to validate code inventory directly, use the product-specific run and the provider APIs below.

GitHub

Prerequisites:

GITHUB_TOKEN
GITHUB_ORG
token access to read repository metadata, commits, contributors, and languages

Assets count:

Total repositories

curl -fsSL \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/orgs/$GITHUB_ORG/repos?per_page=100&type=all" | jq 'length'

Active repositories in the last 90 days

cutoff=$(date -u -d '90 days ago' '+%Y-%m-%dT%H:%M:%SZ')
curl -fsSL \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/orgs/$GITHUB_ORG/repos?per_page=100&type=all" |
  jq --arg cutoff "$cutoff" '[.[] | select((.pushed_at // .updated_at // "") >= $cutoff)] | length'

Active committers and developers

git clone "https://github.com/$GITHUB_ORG/<repo>.git"
cd <repo>
git log --since="90 days ago" --format='%an <%ae>' | sort -u | wc -l

Estimated code volume

curl -fsSL \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/$GITHUB_ORG/<repo>/languages" | jq 'to_entries | map(.value) | add // 0'

GitLab

Prerequisites:

GITLAB_TOKEN
optional GITLAB_GROUP

Assets count:

Total projects

curl -fsSL --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
  "https://gitlab.com/api/v4/projects?membership=true&simple=true&per_page=100&page=1" | jq 'length'

Active repositories in the last 90 days

cutoff=$(date -u -d '90 days ago' '+%Y-%m-%dT%H:%M:%SZ')
curl -fsSL --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
  "https://gitlab.com/api/v4/projects?membership=true&simple=true&per_page=100&page=1" |
  jq --arg cutoff "$cutoff" '[.[] | select((.last_activity_at // "") >= $cutoff)] | length'

Azure DevOps

Prerequisites:

AZURE_DEVOPS_PAT
AZURE_DEVOPS_ORG
optional AZURE_DEVOPS_PROJECT

Assets count:

Projects

curl -fsSL -u ":$AZURE_DEVOPS_PAT" \
  "https://dev.azure.com/$AZURE_DEVOPS_ORG/_apis/projects?api-version=7.1&\$top=1000" | jq '.value | length'

Repositories

curl -fsSL -u ":$AZURE_DEVOPS_PAT" \
  "https://dev.azure.com/$AZURE_DEVOPS_ORG/<project>/_apis/git/repositories?api-version=7.1" | jq '.value | length'

Active repositories

curl -fsSL -u ":$AZURE_DEVOPS_PAT" \
  "https://dev.azure.com/$AZURE_DEVOPS_ORG/<project>/_apis/git/repositories/<repo-id>/commits?searchCriteria.\$top=1&api-version=7.1" | jq -r '.value[0].committer.date // .value[0].author.date // ""'

Bitbucket

Prerequisites:

BITBUCKET_USERNAME
BITBUCKET_APP_PASSWORD
BITBUCKET_WORKSPACE

Assets count:

Total repositories

curl -fsSL -u "$BITBUCKET_USERNAME:$BITBUCKET_APP_PASSWORD" \
  "https://api.bitbucket.org/2.0/repositories/$BITBUCKET_WORKSPACE?pagelen=100" | jq '.values | length'

Active repositories

cutoff=$(date -u -d '90 days ago' '+%Y-%m-%dT%H:%M:%SZ')
curl -fsSL -u "$BITBUCKET_USERNAME:$BITBUCKET_APP_PASSWORD" \
  "https://api.bitbucket.org/2.0/repositories/$BITBUCKET_WORKSPACE?pagelen=100" |
  jq --arg cutoff "$cutoff" '[.values[] | select((.updated_on // "") >= $cutoff)] | length'

Container manual checks

Docker Hub

Prerequisites:

DOCKERHUB_NAMESPACE
optional DOCKERHUB_USERNAME and DOCKERHUB_TOKEN

Assets count:

curl -fsSL "https://hub.docker.com/v2/repositories/$DOCKERHUB_NAMESPACE/?page_size=100" | jq '.results | length'

Tags per repository:

curl -fsSL "https://hub.docker.com/v2/repositories/$DOCKERHUB_NAMESPACE/<repo>/tags?page_size=1" | jq '.count'

GHCR

Prerequisites:

GITHUB_TOKEN
GHCR_OWNER

Assets count:

curl -fsSL \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/orgs/$GHCR_OWNER/packages?package_type=container&per_page=100" | jq 'length'

AWS ECR

Prerequisites:

AWS CLI auth with ECR read access
region or AWS_REGIONS

Assets count:

aws ecr describe-repositories --region "$region" --query 'length(repositories[])'

aws ecr describe-images --region "$region" --repository-name "<repo>" --query 'length(imageDetails[])'

Azure ACR

Prerequisites:

Azure CLI login
ACR reader access

Assets count:

az acr repository list --name "$registry" -o tsv | wc -l

az acr repository show-tags --name "$registry" --repository "<repo>" -o tsv | wc -l

GCR

Prerequisites:

gcloud auth
GCP_PROJECT or GCP_PROJECTS

Assets count:

gcloud container images list --repository="gcr.io/$project" --format='value(name)' | wc -l

Google Artifact Registry

Prerequisites:

gcloud auth
roles/artifactregistry.reader

Assets count:

gcloud artifacts repositories list --project "$project" --location "$loc" --filter='format:DOCKER' --format='value(name.basename())'

GitLab Registry

Prerequisites:

GITLAB_TOKEN
optional GITLAB_GROUP

Assets count:

curl -fsSL --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
  "https://gitlab.com/api/v4/groups/<group>/projects?include_subgroups=true&per_page=100&page=1"

Harbor

Prerequisites:

HARBOR_URL
HARBOR_USERNAME
HARBOR_PASSWORD

Assets count:

curl -fsSL -u "$HARBOR_USERNAME:$HARBOR_PASSWORD" \
  "$HARBOR_URL/api/v2.0/projects?page_size=100"

KSPM manual checks

Prerequisites:

kubectl configured with one or more reachable contexts
optional KUBE_CONTEXTS

Assets count:

Clusters

kubectl config get-contexts -o name | wc -l

Namespaces

kubectl --context "$ctx" get ns --no-headers | wc -l

Nodes

kubectl --context "$ctx" get nodes --no-headers | wc -l

Pods

kubectl --context "$ctx" get pods -A --no-headers | wc -l

Workload total

kubectl --context "$ctx" get deploy,sts,ds,job,cronjob,rs,svc,ing,endpointslices,cm,secret,sa,role,rolebinding,clusterrole,clusterrolebinding,networkpolicy,pv,pvc,storageclass,resourcequota,limitrange,hpa,pdb,rc,priorityclass,crd,mutatingwebhookconfiguration,validatingwebhookconfiguration -A --no-headers | wc -l

Runtime manual checks

Runtime licensing is based on the number of protected compute resources. Prerequisites:

kubectl configured with the target Kubernetes contexts (for Kubernetes environments)
Runtime agent installed on Kubernetes nodes or virtual machines

Kubernetes nodes

Count the total number of worker nodes across all Kubernetes clusters.

kubectl get nodes --no-headers | wc -l

If multiple contexts are configured:

for ctx in $(kubectl config get-contexts -o name); do
    echo -n "$ctx: "
    kubectl --context "$ctx" get nodes --no-headers 2>/dev/null | wc -l
done

Virtual machines

Count the total number of virtual machines protected by the TigerGate Runtime Agent. Supported environments include AWS EC2, Azure Virtual Machines, Google Compute Engine, Oracle Cloud Infrastructure, VMware, and bare metal Linux servers.

AWS
Azure
Google Cloud
Oracle Cloud

aws ec2 describe-instances \
  --query 'length(Reservations[].Instances[])' \
  --output text

az vm list --query "length(@)"

gcloud compute instances list --format="value(name)" | wc -l

oci compute instance list \
  --compartment-id <COMPARTMENT_ID> \
  --all \
  --query "length(data)"

Protected compute

Protected compute is the sum of Kubernetes worker nodes and protected virtual machines. For example, 18 Kubernetes worker nodes plus 12 protected virtual machines gives a total protected compute of 30.

How each count is calculated

Code

Provider	Counted items	Calculation
GitHub	Repositories, active repositories, developers, active committers, estimated code volume	Repositories come from the org repo list. Active repositories are filtered by `pushed_at` or `updated_at` within the selected day window. Committers and contributors are de-duplicated from commit history. Code volume is estimated from the repository language byte totals.
GitLab	Repositories, active repositories	Projects are listed from the selected group or membership scope. Active repositories are filtered by `last_activity_at` within the selected day window.
Azure DevOps	Repositories, active repositories	Projects are enumerated, then repositories are listed per project. Active repositories are those whose latest commit timestamp is newer than the cutoff.
Bitbucket	Repositories, active repositories	Workspace repositories are listed, then filtered by `updated_on` within the selected day window.

Container

Provider	Counted items	Calculation
Docker Hub	Repositories, tags	Repositories are listed under the namespace. Tags are summed per repository.
GHCR	Packages, image versions	Packages are listed for the owner. Versions are counted per package.
AWS ECR	Repositories, images	Repositories are listed in each region. Images are counted per repository.
Azure ACR	Repositories, tags	Repositories are listed per registry. Tags are counted per repository.
GCR	Images, tags	Image names are listed by project and host. Tags are counted per image.
Google Artifact Registry	Repositories, packages, image versions	Docker repositories are listed per project and location. Packages are counted per repository, and versions are counted from tagged image listings.
GitLab Registry	Repositories, tags	Registry repositories are listed per project. Tags are counted per repository.
Harbor	Repositories, artifacts	Projects and repositories are listed from Harbor. Artifacts are counted per repository.

Cloud

Provider	Counted asset types
AWS	AWS Config resource types when available. Fallback direct API counts for EC2 instances, EBS volumes, EBS snapshots, Elastic IPs, ENIs, ALBs, NLBs, classic load balancers, target groups, Auto Scaling groups, RDS instances, RDS clusters, Lambda functions, EKS clusters, ECR repositories, security groups, VPCs, subnets, NAT gateways, ECS clusters, ECS services, ECS tasks, Secrets Manager secrets, KMS keys, CloudWatch log groups, API Gateway REST APIs, plus global S3 buckets, IAM users, IAM roles, and CloudFront distributions.
Azure	`Microsoft.Compute/disks`, `Microsoft.Compute/virtualMachines`, `Microsoft.ContainerService/managedClusters`, `Microsoft.Network/loadBalancers`, `Microsoft.Network/networkInterfaces`, `Microsoft.Network/publicIPAddresses`, `Microsoft.Network/routeTables`, `Microsoft.Network/virtualNetworks`, `Microsoft.Network/virtualNetworks/subnets`
GCP	`compute.googleapis.com/Subnetwork`, `compute.googleapis.com/Route`, `compute.googleapis.com/Firewall`, `logging.googleapis.com/LogBucket`, `serviceusage.googleapis.com/Service`
OCI	All resource types returned by `oci search resource structured-search` for the selected compartment

KSPM

KSPM counts Kubernetes posture inventory objects. The report shows a separate workload_total box so customers can see workload counts by cluster and a final total.

Counted objects	Calculation
Clusters, namespaces, nodes, pods, containers, running containers, images	Direct `kubectl` counts across the selected contexts.
Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, ReplicaSets, Services, Ingresses, EndpointSlices	Counted per cluster with `kubectl get`.
ConfigMaps, Secrets, ServiceAccounts, Roles, RoleBindings, ClusterRoles, ClusterRoleBindings	Counted per cluster with `kubectl get`.
NetworkPolicies, PersistentVolumes, PersistentVolumeClaims, StorageClasses, ResourceQuotas, LimitRanges, HorizontalPodAutoscalers, PodDisruptionBudgets, RuntimeClasses, PriorityClasses, CustomResourceDefinitions, MutatingWebhookConfigurations, ValidatingWebhookConfigurations	Counted per cluster with `kubectl get`.
`workload_total`	Sum of the workload and control-plane inventory objects above, excluding clusters, namespaces, nodes, pods, containers, running containers, and images.

Runtime

Runtime licensing is based on the number of protected compute resources.

Billable resource	Calculation
Kubernetes nodes	Total worker nodes across all Kubernetes clusters.
Virtual machines	Total supported Linux/Windows VMs protected by the TigerGate Runtime Agent.
Protected compute	Kubernetes nodes + virtual machines.

Output files

By default the script writes to ./tigergate-inventory-output. Change this with --out-dir.

summary.tsv is the final product/provider/metric rollup.
details.tsv is the itemized customer-facing count list.
details.jsonl is the structured machine-readable export.
report.txt is the printable report with the TigerGate banner and boxed sections.

For every product counted, the script also writes a per-product copy of each file: summary-<product>.tsv, details-<product>.tsv, details-<product>.jsonl, and report-<product>.txt.

Permissions

The script is read-only. It needs the same credentials described in the inventory collection guide, plus access to the target Kubernetes contexts or runtime telemetry store when those products are selected.

​Run it

​Options

​Cloud manual checks

​AWS

​Azure

​GCP

​OCI

​Code manual checks

​GitHub

​GitLab

​Azure DevOps

​Bitbucket

​Container manual checks

​Docker Hub

​GHCR

​AWS ECR

​Azure ACR

​GCR

​Google Artifact Registry

​GitLab Registry

​Harbor

​KSPM manual checks

​Runtime manual checks

​Kubernetes nodes

​Virtual machines

​Protected compute

​How each count is calculated

​Code

​Container

​Cloud

​KSPM

​Runtime

​Output files

​Permissions

Run it

Options

Cloud manual checks

AWS

Azure

GCP

OCI

Code manual checks

GitHub

GitLab

Azure DevOps

Bitbucket

Container manual checks

Docker Hub

GHCR

AWS ECR

Azure ACR

GCR

Google Artifact Registry

GitLab Registry

Harbor

KSPM manual checks

Runtime manual checks

Kubernetes nodes

Virtual machines

Protected compute

How each count is calculated

Code

Container

Cloud

KSPM

Runtime

Output files

Permissions