FileSystems Object
Relationships
graph LR
FileSystems -->|"account"| Accounts
FileSystems -->|"encryption_key"| ManagedKeys
Properties
Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
Whether the provider's own automatic backup of this file system is on. On AWS this is the EFS backup policy (backups by AWS Backup's default plan): true only when its status is ENABLED, so a policy that is still turning on (ENABLING) reads false. A separate backup plan the customer built in AWS Backup can still cover a file system that reads false; that is not checked here.
The provider's own automatic-backup status string, verbatim (on AWS EFS: ENABLED, ENABLING, DISABLED or DISABLING). Null when no backup policy exists or it could not be read - see unreadable_fields.
When Truto actually read this object from the provider, in UTC ISO 8601 with the offset present — not the request time, and not a provider timestamp.
When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
Whether the file system's data is encrypted at rest. Encryption in transit is a separate, client-side mount setting and is not reported here.
The key that protects the file system at rest. Null when the file system is not encrypted, or when the provider names no key object the customer can see.
The target's id.
Who manages the key that encrypts the file system at rest. provider_owned: a key the provider holds outside the customer's account, with no key object the customer can see. provider_managed: the provider's default key that lives inside the customer's key service but that the customer cannot manage (for example an AWS managed aws/ key). customer_managed: a key the customer creates and controls in the key service. none: not encrypted at rest. unknown: encrypted, but who manages the key was not resolved - unreadable_fields says why. On AWS, DescribeFileSystems names the key ARN but not whether it is the AWS managed aws/elasticfilesystem key or a customer managed key, so an encrypted EFS file system reads unknown here; join encryption_key.id to managed_keys (managed_by) to resolve it.
provider_managedprovider_ownedcustomer_managednoneunknown
The provider's own identifier for the file system, verbatim (an EFS fs- id, an Azure file share name, a GCP Filestore instance name).
The provider's own type string, unmodified — for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
Which cloud this object was read from.
awsazuregcp
The provider's own identifier, passed through verbatim — a full ARN, resource id, or self-link. Never truncated, prefixed, or normalized.
Where the object is located. 'global' denotes genuinely global resources (e.g. IAM, GCP VPC networks) rather than a guessed region. A substituted region (when none is derivable) is flagged in unreadable_fields.
Raw data returned from the remote API call.
The provider's own lifecycle state string for the file system, verbatim (on AWS EFS: creating, available, updating, deleting, deleted or error).
Key-value pairs exactly as the customer set them: no case folding, key/value normalization, or merging of separate provider concepts. An empty object means no tags; tags that could not be read appear in unreadable_fields instead.
Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
Explanation of the reason, where one adds anything.
The property on this resource that could not be read.
Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
not_supported_by_providernot_configuredpermission_deniednot_collectedcollection_errorpartially_collectedavailable_on_get
When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.