BlockVolumes Object
Relationships
graph LR
BlockVolumes -->|"account"| Accounts
BlockVolumes -->|"encryption_key"| ManagedKeys
Properties
Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
Whether the volume is attached to at least one virtual machine or provider-managed host right now. An attachment still being made or removed counts as attached; false means the volume is unattached.
Where the volume is attached. Empty means unattached. A volume with multi-attach turned on can list several.
What the volume serves when it is attached to a provider-managed host instead of a customer virtual machine - on AWS, the ARN of the ECS or Fargate task. Null for an ordinary virtual machine attachment.
Whether the volume is deleted when the virtual machine it is attached to is terminated. False means the volume and its data outlive the machine.
The attached virtual machine, as the provider identifies it (an EC2 i- id, an Azure VM resource id, a GCP instance self-link). Null when the volume is attached to a provider-managed host the customer does not own, such as an AWS Fargate task; associated_resource_id then names what it serves.
The provider's own attachment state string, verbatim (on AWS: attaching, attached, detaching, detached or busy).
When Truto actually read this object from the provider, in UTC ISO 8601 with the offset present — not the request time, and not a provider timestamp.
When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
Whether the volume's data is encrypted at rest.
The key that protects the volume at rest. Null when the volume is not encrypted, or when the provider names no key object the customer can see.
The target's id.
Who manages the key that encrypts the volume. provider_owned: a key the provider holds outside the customer's account, with no key object the customer can see. provider_managed: the provider's default key that lives inside the customer's key service but that the customer cannot manage (for example an AWS managed aws/ key). customer_managed: a key the customer creates and controls in the key service. customer_supplied: raw key material the customer passes in with each request and the provider does not store (GCP CSEK). none: not encrypted at rest. unknown: encrypted, but who manages the key was not resolved - unreadable_fields says why. On AWS, DescribeVolumes names the key ARN but not whether it is the AWS managed aws/ebs key or a customer managed key, so an encrypted EBS volume reads unknown here; join encryption_key.id to managed_keys (managed_by) to resolve it.
provider_managedprovider_ownedcustomer_managedcustomer_suppliednoneunknown
The provider's own type string, unmodified — for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
Which cloud this object was read from.
awsazuregcp
The provider's own identifier, passed through verbatim — a full ARN, resource id, or self-link. Never truncated, prefixed, or normalized.
Where the object is located. 'global' denotes genuinely global resources (e.g. IAM, GCP VPC networks) rather than a guessed region. A substituted region (when none is derivable) is flagged in unreadable_fields.
Raw data returned from the remote API call.
The provider's own status string for the volume, verbatim (on AWS: creating, available, in-use, deleting, deleted or error).
Key-value pairs exactly as the customer set them: no case folding, key/value normalization, or merging of separate provider concepts. An empty object means no tags; tags that could not be read appear in unreadable_fields instead.
Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
Explanation of the reason, where one adds anything.
The property on this resource that could not be read.
Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
not_supported_by_providernot_configuredpermission_deniednot_collectedcollection_errorpartially_collectedavailable_on_get
When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
The provider's own identifier for the volume, verbatim (an EBS vol- id, an Azure managed disk name, a GCP persistent disk name). On AWS, data_snapshots.source_resource_id holds this same vol- id for snapshots taken from the volume.