Install NHI Governance

NHI Governance (NHIG) is a discovery-and-inventory module. There’s no proxy, no session broker, no CLI required for basic operation — you feed it identities via cloud-account roles or on-host agents, then use the UI/API for attestations and reviews.

NHIG’s install story is agents and cloud roles. The server side runs inside the TigerTrust backend, and workflows (ownership attestation, access reviews) happen in the UI. Optional binaries: the same tt CLI you install for SM works against NHIG endpoints.

What ships

Component	Runs on	Purpose
NHIG engine	TigerTrust backend	Identity inventory, ownership graph, review campaigns
Cloud discovery workers	TigerTrust cloud	Pull identities from AWS/Azure/GCP over read-only roles
`tt-nhig-agent`	Customer hosts / K8s	Discover local service accounts, kube RBAC, systemd services
`tt` CLI	Any workstation	Query inventory, run scans, export reports

1. Connect a cloud account (read-only)

The fastest way to populate the inventory is to grant a read-only IAM role to TigerTrust’s cloud discovery workers. Nothing to install on your side.

AWS
Azure
GCP

# Deploy via CloudFormation
aws cloudformation deploy \
  --stack-name tigertrust-nhig-reader \
  --template-url https://releases.tigertrust.io/tigertrust-nhig/aws-reader.yaml \
  --parameter-overrides ExternalId=<from UI>

The role grants iam:List*, iam:Get*, sts:GetCallerIdentity, and read on secretsmanager, kms, ssm. Attach the role ARN under Integrations → Cloud Providers.

az ad sp create-for-rbac \
  --name tigertrust-nhig-reader \
  --role "Reader" \
  --scopes /subscriptions/<sub-id>
# Give the appId + tenantId + a fresh secret to the UI.

gcloud iam service-accounts create tigertrust-nhig-reader
gcloud projects add-iam-policy-binding <project> \
  --member=serviceAccount:tigertrust-nhig-reader@<project>.iam.gserviceaccount.com \
  --role=roles/iam.securityReviewer
gcloud iam service-accounts keys create key.json \
  --iam-account=tigertrust-nhig-reader@<project>.iam.gserviceaccount.com
# Upload key.json under Integrations → Cloud Providers.

Once the credential is registered, the first discovery scan runs immediately and repeats hourly. Discovered identities land under NHIG → Inventory with source aws, azure, or gcp.

2. Install `tt-nhig-agent` on hosts

The on-host agent discovers non-human identities the cloud APIs can’t see: local service accounts, Kubernetes RBAC subjects, systemd unit users, cron owners, and static kubeconfigs on operator machines.

systemd
Kubernetes (DaemonSet)
Windows

curl -sSf https://releases.tigertrust.io/tigertrust-nhig/agent | \
  TT_API_URL=https://api.tigertrust.io \
  TT_API_KEY=ak_prod_... \
  sh
sudo systemctl enable --now tt-nhig-agent

helm repo add tigertrust https://charts.tigertrust.io
helm upgrade --install tt-nhig-agent tigertrust/nhig-agent \
  --namespace tigertrust --create-namespace \
  --set apiKey=ak_prod_...

The DaemonSet mounts host paths read-only and issues an in-cluster SubjectAccessReview sweep to enumerate RBAC subjects.

Invoke-WebRequest https://releases.tigertrust.io/tigertrust-nhig/agent.msi -OutFile nhig-agent.msi
msiexec /i nhig-agent.msi TT_API_KEY=ak_prod_... /qn

On Windows the agent enumerates local service accounts (sc), scheduled tasks running as non-interactive users, and DPAPI-protected credential blobs.

The agent has no listening port. It polls the Collector over outbound HTTPS every 15 minutes and reports identity findings.

3. (Optional) Use `tt` CLI for scripted queries

If you already installed the tt CLI for Secrets Manager, the NHIG subcommands are already there:

tt nhig identities ls --source=aws --unowned
tt nhig findings ls --severity=high
tt nhig attest identity_xxx --owner=alice@example.com
tt nhig reviews export --campaign=Q1-2026 --format=csv

4. What gets discovered

Source	Identity kinds
AWS	IAM users, IAM roles, IAM access keys, Secrets Manager secrets, KMS keys, SSM parameters, Lambda execution roles, ECS task roles, EKS IRSA roles
Azure	Service principals, managed identities, application registrations, storage account keys, Key Vault objects
GCP	Service accounts, keys, workload-identity bindings, IAM policy bindings on projects/folders
Kubernetes	ServiceAccounts, ClusterRoleBindings, RoleBindings, secrets referenced by pods
On-host	Local service accounts, systemd unit users, cron owners, kubeconfig subjects, Docker credential stores
Application	GitHub Apps, OAuth clients, DB service accounts, MQ users (via connectors)

NHIG overview

Inventory, ownership graph, review campaigns.

Discovery

Cloud, kubernetes, and on-host discovery paths.

Access reviews

Campaign-driven periodic attestation of every identity.

Findings

Orphaned, stale, over-privileged, and unowned identities.

​What ships

​1. Connect a cloud account (read-only)

​2. Install tt-nhig-agent on hosts

​3. (Optional) Use tt CLI for scripted queries

​4. What gets discovered

​Related

NHIG overview

Discovery

Access reviews

Findings

What ships

1. Connect a cloud account (read-only)

2. Install `tt-nhig-agent` on hosts

3. (Optional) Use `tt` CLI for scripted queries

4. What gets discovered

Related