An identity is any non-human principal that authenticates to something: an IAM role, a service account, an OAuth client, an API key, a signed certificate. Everything discovered by NHIG lands here.

​
Anatomy of an identity

{
  "id": "nhi_xxx",
  "kind": "aws_iam_role",
  "name": "prod-lambda-payments-execution",
  "source": "aws",
  "source_account": "123456789012",
  "created_at": "2024-11-03T09:12:00Z",
  "last_used_at": "2026-09-17T18:02:00Z",
  "permissions": {
    "policies": ["arn:aws:iam::123456789012:policy/PaymentsLambdaPolicy"],
    "trust_policy": { "Service": ["lambda.amazonaws.com"] }
  },
  "owner": {
    "user_id": "u_alice",
    "attested_at": "2026-09-01T00:00:00Z"
  },
  "labels": { "env": "prod", "system": "payments" },
  "findings": ["over-privileged: iam:*"]
}

​
Kinds

KindWhere it comes from
aws_iam_user / aws_iam_role / aws_iam_access_keyAWS IAM
azure_service_principal / azure_managed_identityAzure AD
gcp_service_account / gcp_service_account_keyGCP IAM
kubernetes_service_account / kubernetes_role_bindingKubernetes RBAC
github_app / github_patGitHub App API
oauth_clientRegistered OAuth clients
tls_certificateCLM’s inventory
pam_machinePAM’s tbot deployments
sm_approle / sm_tokenSecrets Manager

​
Bulk operations

tt nhig identities ls --source=aws --unowned
tt nhig identities assign-owner nhi_xxx [email protected]
tt nhig identities label nhi_xxx --label=system=payments
tt nhig identities archive nhi_xxx --reason="decommissioned 2026-09"

Ownership

Assign, delegate, and re-attest owners.

Findings

Orphaned, stale, over-privileged.