A resource is anything PAM can broker a session to. Every resource is enrolled with a join token issued by tash-admin, labelled, and matched against roles.

​
Resource kinds

KindBroker mechanismOn the target
sshSSH proxy on the PAM serverPAM node agent (outbound-only)
kuberneteskube-API proxy — short-lived kubeconfigNothing (uses cluster’s own API)
databasePostgres / MySQL / Mongo / MSSQL proxyOptional connection-agent for private DBs
rdpRDP proxy with screen recordingNothing (native RDP)
http_appReverse HTTP proxyNothing (native HTTP)

​
Enroll an SSH host

tash-admin tokens add --type=node --ttl=15m --labels=env:prod,tier:web
# → jt_yyy

# On the target host:
curl -sSf https://releases.tigertrust.io/tigertrust-pam/node | TT_JOIN_TOKEN=jt_yyy sh
The joined host runs tigeraccess-node — a small agent that dials back to tigeraccess-server. No inbound ports on the target.

​
Enroll a Kubernetes cluster

tash-admin tokens add --type=kubernetes --ttl=15m --labels=env:prod,cluster:eks-01
# Apply the returned manifest to the cluster
kubectl apply -f - <<'YAML'
apiVersion: v1
kind: ConfigMap
metadata: { name: tigeraccess-kube-join, namespace: tigeraccess }
data:
  joinToken: jt_yyy
YAML
The PAM server proxies kubectl traffic — users get a short-lived kubeconfig via tash kube login <cluster>.

​
Enroll a database

tash-admin tokens add --type=database --ttl=15m \
  --labels=engine:postgres,env:prod \
  --db-name=prod-postgres \
  --db-uri=postgres://tigeraccess@db.internal:5432/postgres
Rotate the DB service account’s password out of your .env files — PAM manages it from now on.

​
Labels

Labels are how roles match resources. Common patterns:
LabelValue examples
envprod, staging, dev
regionus-east-1, eu-west-2
tierweb, db, data, mgmt
teampayments, sre, data-platform
sensitivitypii, pci, public
Labels are set at enrollment and can be edited via tash-admin resources update <id> --labels=....

Roles & bindings

Match resources to users by label.

Sessions

Everything that happens once a user connects.