Discovery is the input stage that populates the identity inventory. It runs continuously with three source classes:

​
1. Cloud APIs (read-only)

Configured under NHIG → Cloud Providers. TigerTrust workers periodically enumerate the read-only surface of the account:
  • AWS — IAM users, roles, access keys, service-linked roles, Lambda / ECS / EKS execution roles, Secrets Manager secrets, KMS keys, SSM parameters.
  • Azure — Service principals, managed identities, application registrations, Key Vault objects.
  • GCP — Service accounts, service-account keys, workload-identity bindings, IAM policy bindings.
Scans run hourly by default. Cadence and per-service inclusion are configurable per cloud account.

​
2. On-host agent

The tt-nhig-agent discovers identities the cloud APIs can’t see:
  • Local service accounts and systemd unit users
  • Cron owners
  • Kubeconfig subjects on operator workstations
  • Docker credential stores
  • .env files matching credential regex patterns (opt-in — file paths are configurable)

​
3. Application connectors

NHIG → Connectors exposes long-lived integrations with SaaS + on-prem apps:
ConnectorDiscovers
GitHubGitHub Apps, PATs, deploy keys
GitLabDeploy tokens, project access tokens
Okta / Azure ADOAuth clients, application service principals
SnowflakeService users, network policies
DatadogAPI keys, application keys
PagerDutyIntegration keys
Terraform CloudTeam tokens, agent tokens

​
Scan pipeline

Source ─► Raw fetch ─► Normalise ─► Diff with prior state ─► Persist + finding rules ─► UI + API
Diffing means the timeline for each identity is preserved — you can see when a key was created, first used, granted new permissions, and last used.

Install NHI Governance

Cloud roles + on-host agent.

Identities

What lands in the inventory after discovery.