ComputeInstances Object
Relationships
graph LR
ComputeInstances -->|"account"| Accounts
ComputeInstances -->|"network_boundary"| NetworkBoundaries
ComputeInstances -->|"attached_rule_sets"| FirewallRuleSets
ComputeInstances -->|"image"| MachineImages
ComputeInstances -->|"managed_instance"| ManagedInstances
Properties
Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
Security groups on the machine and on every one of its network interfaces.
The target's id.
The zone the machine runs in.
When Truto actually read this object from the provider, in UTC ISO 8601 with the offset present — not the request time, and not a provider timestamp.
When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
Whether any network interface has a public IPv4 address.
The image the machine was launched from. machine_images lists only images the account owns, so an Amazon, Marketplace or other shared image does not resolve there; GET machine_images/{id} still reads it.
The target's id.
The image the machine was launched from, verbatim (an AMI id on AWS).
The provider's own identifier for the machine, verbatim (an EC2 i- id, an Azure VM resource id, a GCP instance id).
The provider's size or machine type, verbatim (t3.micro, Standard_D2s_v3, e2-medium).
IPv6 addresses on any network interface. These are globally unique; whether they are reachable from the internet depends on routing and firewall rules.
Whether a fleet-management service (AWS Systems Manager, Azure Arc or Update Manager, GCP VM Manager) currently registers the machine as a managed node. On AWS, Systems Manager does not report stopped instances, so a stopped instance reads false even when it is registered. Read on GET only.
When the machine last started. On AWS this moves on every stop and start, so it is not a creation date.
The identity the machine runs as, verbatim: on AWS the instance profile ARN (an instance profile holds one IAM role; it is not the role ARN workload_identities is keyed on), on Azure the managed identity, on GCP the service account. Null when the machine has none.
The managed-node record for this machine, when is_managed is true. Read on GET only.
The target's id.
The instance metadata service (IMDS) settings. Null when the provider did not return them - see unreadable_fields.
Whether the metadata endpoint answers at all.
How many network hops a metadata response may travel. Above 1, containers on the host can reach the endpoint.
Whether every metadata request must carry a session token. On AWS true is IMDSv2-only (httpTokens required); false still answers IMDSv1 requests without a token.
The display name: on AWS the Name tag, which is optional, so null means the instance has no Name tag.
The provider's own type string, unmodified — for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
The VPC / virtual network the machine sits in.
The target's id.
Operating system family. linux_unix covers Linux and other Unix-like systems; unknown when the provider does not say. The provider's own value is in remote_data.
windowslinux_unixmacosunknown
Every private IPv4 address on any of the machine's network interfaces.
Which cloud this object was read from.
awsazuregcp
The provider's own identifier, passed through verbatim — a full ARN, resource id, or self-link. Never truncated, prefixed, or normalized.
Every public IPv4 address on any network interface, including addresses on secondary private IPs. Empty means no public IPv4.
Where the object is located. 'global' denotes genuinely global resources (e.g. IAM, GCP VPC networks) rather than a guessed region. A substituted region (when none is derivable) is flagged in unreadable_fields.
Raw data returned from the remote API call.
Lifecycle state, normalised. On AWS shutting-down is 'terminating'. Terminated EC2 instances stay listed for about an hour. The provider's own value is in remote_data.
pendingrunningstoppingstoppedterminatingterminatedunknown
The subnet of the primary network interface, verbatim.
Key-value pairs exactly as the customer set them: no case folding, key/value normalization, or merging of separate provider concepts. An empty object means no tags; tags that could not be read appear in unreadable_fields instead.
Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
Explanation of the reason, where one adds anything.
The property on this resource that could not be read.
Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
not_supported_by_providernot_configuredpermission_deniednot_collectedcollection_errorpartially_collectedavailable_on_get
When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.