NetworkBoundaries Object
Relationships
graph LR
NetworkBoundaries -->|"account"| Accounts
NetworkBoundaries -->|"attached_rule_sets"| FirewallRuleSets
NetworkBoundaries -->|"flow_log_destinations"| LogDestinations
NetworkBoundaries -->|"flow_log_object_stores"| ObjectStores
Properties
Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
Firewall rule sets attached at the boundary level.
The target's id.
Whether a boundary-wide public-access block overrides routing. A boundary can have an internet gateway route and still be unreachable because of this.
The provider's own identifier for the network.
The address ranges the network covers.
When Truto actually read this object from the provider, in UTC ISO 8601 with the offset present — not the request time, and not a provider timestamp.
When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
How long the provider batches records before writing them — a batching window, not a sampling fraction. Not the same as flow_log_sampling_rate.
The log stores this network's flow logs are delivered to, as references to log_destinations (AWS: VPC Flow Logs delivered to CloudWatch Logs; the log group ARN from logDestination, else the group named by logGroupName in the calling account and region). How long the records are kept is the target's retention_days. Only the flow logs that flow_logs_enabled counts (network-level, active and delivering). Delivery to an object store is in flow_log_object_stores; delivery to a streaming service (AWS: Amazon Data Firehose) has no unified resource and no reference. A target in another account resolves only when that account is connected too. Empty when there are none; null when the flow-log read was refused (unreadable_fields says so).
The target's id.
The object stores (buckets) this network's flow logs are delivered to, as references to object_stores (AWS: VPC Flow Logs delivered to S3; the bucket ARN from logDestination, without the key prefix that may follow it). How long the records are kept is the target's retention_policy_days and lifecycle_rules. Only the flow logs that flow_logs_enabled counts (network-level, active and delivering). Delivery to a log store is in flow_log_destinations; delivery to a streaming service (AWS: Amazon Data Firehose) has no unified resource and no reference. A bucket in another account resolves only when that account is connected too. Empty when there are none; null when the flow-log read was refused (unreadable_fields says so).
The target's id.
What fraction of traffic is captured, where the provider samples. Null with not_supported_by_provider on AWS, which has no sampling rate field or setting.
Whether flow logging is on for this boundary. Flow logs can attach at boundary, subnet, or interface level; true requires the log to be ACTIVE and actually delivering, not just present.
Whether the boundary can reach the internet, accounting for subnets implicitly associated with the main route table (not just explicit associations).
What kind of internet path exists — an internet gateway (inbound-capable) is a different finding from outbound-only NAT, and the two are kept distinct.
noneinternet_gatewaynat_onlyipv6_egress_onlyunknown
True where the provider's network has no location at all. When true, the envelope region carries the literal string 'global' rather than a guessed region.
Whether this is the provider's automatically created default network.
The network name.
The provider's own type string, unmodified — for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
Which cloud this object was read from.
awsazuregcp
The provider's own identifier, passed through verbatim — a full ARN, resource id, or self-link. Never truncated, prefixed, or normalized.
Where the object is located. 'global' denotes genuinely global resources (e.g. IAM, GCP VPC networks) rather than a guessed region. A substituted region (when none is derivable) is flagged in unreadable_fields.
Raw data returned from the remote API call.
Whether the network is regional or genuinely global.
regionalglobal
Subnets inside this boundary. Nested because a subnet is only meaningful within its boundary.
The zone the subnet sits in.
The address range of the subnet.
Whether instances launched here get a public IP automatically.
The subnet's provider reference.
Key-value pairs exactly as the customer set them: no case folding, key/value normalization, or merging of separate provider concepts. An empty object means no tags; tags that could not be read appear in unreadable_fields instead.
Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
Explanation of the reason, where one adds anything.
The property on this resource that could not be read.
Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
not_supported_by_providernot_configuredpermission_deniednot_collectedcollection_errorpartially_collectedavailable_on_get
When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.