Does TigerGate need a role in my cloud account?
No. For AWS, Azure and Google Cloud, you deploy the scanner with your own credentials, and it runs on its own identity in your account. TigerGate keeps its settings and schedule, and receives only its reports. Cloud Security (CSPM) uses its own read-only role, set up separately.What leaves my environment?
Metadata, posture results, classifications (class, counts, location and confidence), object and table identifiers, keyed fingerprints of identifier values, and run status. Raw values never leave. Masked samples leave while Share masked samples with TigerGate is on for the deployment (on by default; turn it off to keep them in your environment), and never while your organization’s Data samples policy is Omitted. See How scanning works.Does the scanner read whole objects?
Yes, by default. The full profile reads every new or changed object and every row of every changed table, with no size or sampling limit. Choose Sampled on the deployment’s Configuration tab to read a bounded sample of each store instead.How long does a scan take?
Classification is limited by CPU. One core classifies about 0.15 to 0.25 MB of content per second, so a worker with 2 vCPU reads about 0.3 to 0.5 MB per second. A first full read of 1 TB takes roughly 600 to 900 worker-hours, spread over your workers: with 100 workers, about 6 to 9 hours. Raise Max workers to finish sooner. Later runs read only new and changed content, so they are much shorter. Use the sampled profile when a first full read of a very large estate is not needed.Does every run re-read everything?
No. The first run reads everything. Later runs are incremental: they read only new and changed objects and tables, and record deletions. A full rescan runs every 30 days by default, and after a change to the classifier catalogue or your custom data classes. See Scheduling and incremental scans.What does it cost?
The scanner runs in your account, so its compute and the provider’s API requests are billed to you. On AWS an idle deployment costs a few USD a month: the coordinator runs for a few seconds every 15 minutes and workers scale to zero. During a scan you pay for the workers’ compute time and the storage requests. Each deployment guide has a cost section.Do I need one deployment per account?
On AWS, yes: each account is its own deployment with its own enrollment token. One organization API key serves them all. On Azure, one deployment can cover several subscriptions or management groups. On Google Cloud, one deployment can cover several projects, folders or the whole organization.Can I limit what the scanner may read?
Yes, at two levels:- In IAM, through the module: for example
content_bucket_names,kms_key_arnsandscan_regionson AWS,content_storage_account_idson Azure, andcontent_bucket_nameson Google Cloud. Eachenable_*input turns a feature off. The console cannot widen these bounds. - In the console, on the deployment’s Configuration tab: regions, Only these names and Exclude names, and per datastore Auto-Scan settings.
Can the scanner run without internet access?
On AWS, yes: use VPC endpoints for AWS services and an egress proxy that allows the TigerGate API host, and copy the image to ECR. On Azure and Google Cloud, route egress through your network and mirror the image to your registry. The scanner always needs outbound HTTPS to the TigerGate API of your region.Which TigerGate region does the scanner report to?
Your organization’s region. The wizard fills intigergate_api_url for it, and the module has no default, so a
scanner never reports to the wrong region by accident.
How are SaaS tools scanned?
TigerGate reads them through each provider’s API with a read-only credential you provide, because there is no environment of yours to run a scanner in. See Connect SaaS sources.Why does a store show no Findings?
Check its coverage first. A store that was not read, could not be read, or was only partly read is never shown as clean. Deployments → Coverage lists each gap with its cause and fix.What happens to Findings if I revoke a deployment?
Revoking stops the scanner’s credential at its next call and closes any run in progress. The datastores and Findings it reported stay. Runterraform destroy (or disable the on-prem timer) to remove the scanner itself.