Most organizations already have hundreds of certificates inside cloud provider services — AWS ACM, Azure Key Vault, GCP Certificate Manager, load balancers, App Services. Cloud integrations plug TigerTrust into those accounts so it can enumerate, import, and optionally push certificates back to the cloud without requiring an agent on cloud infrastructure.
Cloud Integrations

​
What it is

You connect a cloud account with read credentials, TigerTrust discovers every certificate-related resource in that account, and the results land in your inventory alongside network-discovered and internally-issued certificates. One inventory, one renewal engine, one policy set.

​
When to use it

  • Get full visibility into AWS ACM certificates across all regions in minutes.
  • Import Azure Key Vault certificates into TigerTrust for policy enforcement and renewal.
  • Discover GCP Certificate Manager entries, including managed certificates that Google rotates automatically.
  • Push renewed certificates back to ACM or Key Vault automatically after renewal.

​
Set it up

1

Open cloud integrations

Go to Integrations > Cloud > AWS > Connect.
2

Enter credentials

Provide the account alias, access key ID, secret access key, and default region. For production, use an IAM role attached to the TigerTrust host instead of static keys.
3

Test

Click Test connection. TigerTrust calls acm:ListCertificates in the default region. A green result confirms permissions.
4

Run initial scan

Click Scan now or wait for the next scheduled scan (default: every 6 hours). Results land in your certificate inventory tagged source: aws.
Minimum IAM permissions (read-only discovery):
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "acm:ListCertificates",
      "acm:DescribeCertificate",
      "acm:GetCertificate",
      "iam:ListServerCertificates",
      "iam:GetServerCertificate",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeLoadBalancers",
      "cloudfront:ListDistributions",
      "apigateway:GET"
    ],
    "Resource": "*"
  }]
}
Add acm:ImportCertificate for push-back after renewal.

​
What you’ll see

Integrations > Cloud lists connected accounts with status (connected, error), last sync timestamp, and certificate count. Click Sync now on any integration to trigger an on-demand scan. Toggle Enabled to pause discovery without deleting credentials.
Cloud credentials are sensitive. In production, use role assumption or managed identities rather than static access keys, and store any keys you do use in a secrets manager — not directly in TigerTrust’s configuration.

AWS integration

Detailed IAM policy and region coverage for AWS.

Azure integration

Service principal setup and RBAC roles for Azure.

GCP integration

Service account setup and API enablement for GCP.

Renewal automation

Push renewed certificates back to ACM, Key Vault, and GCP CM.