Every SM caller needs a token. Which auth method mints that token depends on where the caller runs.

​
Method matrix

CallerMethodNotes
Developer laptopoidc (browser)Federated via workspace SSO
CI runner (GitHub Actions, GitLab, Buildkite)jwtOIDC token issued by the CI provider
Kubernetes podkubernetesServiceAccount JWT
Generic Linux host / VMapprolerole_id + secret_id pair
AWS EC2 / ECS / LambdaawsInstance/task identity
Azure VM / AKSazureManaged identity
GCP VM / GKEgcpWorkload identity

​
AppRole

tt auth-methods approle enable
tt auth-methods approle write prod-app \
  --token-policies=prod-read \
  --token-ttl=1h --token-max-ttl=24h \
  --bound-cidr-list=10.0.0.0/8

ROLE_ID=$(tt auth-methods approle read-role-id prod-app -format=json | jq -r .data.role_id)
SECRET_ID=$(tt auth-methods approle write-secret-id prod-app -format=json | jq -r .data.secret_id)

tt login --method=approle --role-id=$ROLE_ID --secret-id=$SECRET_ID

​
Kubernetes

tt auth-methods kubernetes enable
tt auth-methods kubernetes write \
  kubernetes-host=https://kubernetes.default.svc \
  kubernetes-ca-cert=@ca.crt

tt auth-methods kubernetes write role prod-app \
  bound_service_account_names=prod-app \
  bound_service_account_namespaces=prod \
  policies=prod-read ttl=1h
In the pod: 
env:
  - name: VAULT_ADDR
    value: https://api.tigertrust.io
  - name: TT_AUTH_METHOD
    value: kubernetes
  - name: TT_ROLE
    value: prod-app

​
JWT / OIDC (CI)

tt auth-methods jwt enable
tt auth-methods jwt write config \
  oidc_discovery_url=https://token.actions.githubusercontent.com

tt auth-methods jwt write role prod-deploy \
  role_type=jwt \
  user_claim=sub \
  bound_claims='{"repository":"org/repo","ref":"refs/heads/main"}' \
  policies=prod-deploy ttl=15m
Then in GitHub Actions: 
- uses: tigertrust/vault-jwt-action@v1
  with:
    api-url: https://api.tigertrust.io
    role: prod-deploy

​
Cloud IAM

Each cloud method binds a token to a specific IAM identity. See Settings → Secrets Manager → Auth Methods for the exact config per cloud.

Policies

Policies attached to tokens minted by these methods.

Engines

What those tokens can access once minted.