Accounts Object
Relationships
graph LR
Accounts -->|"account"| Accounts
Accounts -->|"parent_grouping"| AccountGroupings
Properties
Truto's stable unified identifier for this account — the provider's own account number (AWS 12-digit id, Azure subscription id, GCP project id). Every other resource's account reference resolves against this. Use provider_id for the full ARN or self-link.
When Truto read this object from the provider, in UTC ISO 8601 with offset. Not the request time, and not a provider-supplied timestamp.
When the account was actually created. On AWS this requires a separate account-service call and is null unless that call was made; never back-filled from joined_at.
The account's registered contact address, where the provider exposes it.
The full hierarchy path from the organisation root down to this account, as a single string.
All hierarchy paths for this account, where a provider allows more than one. Never collapsed to a single value.
Whether Truto currently holds working credentials for this account. False for accounts discovered in the organisation but not reachable.
When the account joined the organisation. For an invited account this is the invitation acceptance date, which can be years after the account was actually created.
How the account entered the organisation, as the provider reports it.
The account, subscription or project name.
The provider's own type string, unmodified -- for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
The organisational unit, folder or management group directly above this account.
The target's id.
Which cloud this object was read from.
awsazuregcp
The provider's own identifier, verbatim -- a full ARN, resource id, or self-link. Never truncated or normalised. Use it to find the object in the provider's console.
Where the object is located. 'global' marks resources with no region (e.g. IAM, a GCP VPC network). If the provider gives none, the collector's queried region is used instead and flagged in unreadable_fields.
Raw data returned from the remote API call.
Lifecycle state of the account. On AWS this comes from Account.State, not the retired Account.Status field (which had no CLOSED value).
pendingactivesuspendedpending_closureclosedunknown
Key-value pairs exactly as the customer set them -- no case folding, key/value normalisation, or merging across providers. An empty object means no tags; unreadable tags appear in unreadable_fields instead.
Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
Additional detail on the reason, when there is any.
The property on this resource that could not be read.
Why the field could not be read.
not_supported_by_providernot_configuredpermission_deniednot_collectedcollection_errorpartially_collected
When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.