RelationalDatabases Object

When Truto actually read this object from the provider, in UTC ISO 8601 with the offset present. Not when the request was made and not a provider timestamp. Drives consumer staleness rules.

The provider's own identifier for the database.

The database engine, as the provider names it.

Truto's stable unified identifier for this object. Opaque; use provider_ref to address the object in the provider's own console or API.

Where the database sits.

The provider's own type string, unmodified -- for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.

Which cloud this object was read from.

The provider's own unbroken identifier, passed through verbatim -- a full ARN, resource id or self-link. Never truncated, prefixed or normalised. This is the customer-facing key used to find the object in the console.

Whether this row is a cluster or a standalone instance. A discriminator rather than cosmetic: the two shapes carry different field names for the same posture and a shared parser silently misreads one of them.

Whether any allowed network rule permits the whole internet. Called out as its own field because a provider-specific allow-all rule is a common and serious misconfiguration that is easy to lose inside a rule list.

Ingress rules that reach this database, as objects carrying the source range or group reference, protocol and port range. On AWS this requires joining out to the network service -- the database API returns only security group ids and a membership status -- and the join is batched per region rather than per database.

Where audit and error logs are delivered. The AWS API returns log TYPE strings only and never a log group reference, so these are string-constructed from the topology -- and the destination is created lazily on first log event, so it may not yet exist.

How many days of backups are retained.

Whether the database is protected against deletion.

Whether storage is encrypted at rest.

Reference to the encryption key.

Who manages the storage encryption key. On AWS the native field cleanly identifies provider-owned keys but deliberately merges provider-managed and customer-managed into one value; splitting them needs a key-service call that is governed by the key policy as well as IAM, so a key whose policy omits Truto's role yields permission_denied rather than a guess.

The provider's support status for this engine version, where exposed.

The running engine version -- the input to the end-of-support check.

The global cluster this database belongs to, where it is part of one.

The resilience topology. Deliberately not a boolean: a single hidden standby, members spanning availability zones, and a cluster with two readable standbys describe genuinely different failure domains that one flag would flatten.

Whether this row is the writer of its cluster or global cluster.

The most recent point the database could be restored to.

Minimum TLS version the database will accept. Not present on any AWS database shape: it requires per-engine parameter or option group calls, and a true minimum exists only for some engines -- others expose an allow-list or three independent toggles. A parameter never set has no value element at all, so absent is not off, and a parameter group value is not the running value unless it is in sync. Expect unknown for a meaningful share of any real fleet.

Whether point-in-time restore is available. No boolean exists on AWS -- it is derived from a non-zero backup retention period and corroborated against the provider's latest restorable time, which stays available in remote_data, because a retention integer on a fresh instance is aspirational while a populated restorable time proves backups exist now.

Whether the database is reachable from the public network. Note this is the provider's flag, not proven reachability: true does not mean reachable and false does not mean safe, since real exposure also depends on routing.

Where the object is. A compliance answer in its own right, not metadata. The literal string 'global' is emitted for genuinely global resources (for example IAM, or a GCP VPC network) rather than guessing a region. Never invented: where the provider does not return a location and none can be derived, the collector's queried region is used and that substitution is recorded in unreadable_fields.

Raw data returned from the remote API call.

Regions holding replicas of this database -- one half of the data residency answer. Derived from per-region enumeration with reverse matching, because no single AWS call covers every replication topology: the global-cluster call gives a clean cross-region view for one topology and is used as a cross-check, but three other topologies never appear in it.

References to the replica databases themselves.

References to the firewall rule sets attached to this database.

The provider's own storage encryption type string, verbatim.

Key-value pairs exactly as the customer set them: no case folding, no key or value normalisation, no merging of separate provider concepts. Present on every object because tags are the primary input for environment classification. An empty object means the object carries no tags; tags that could not be read are recorded in unreadable_fields instead.

Whether TLS is required for connections. Kept separate from min_tls_version, because enforcing TLS is not the same as setting a version floor.

Per-object list of the fields that could not be read, and why -- the brief section 8.4 answer, chosen over per-field sentinel values. Each entry is an object with 'field' (the property name on this resource), 'reason' (a reason code) and an optional human-readable 'detail'. Reason codes: not_supported_by_provider, not_configured, permission_denied, not_collected, collection_error, partially_collected. An empty array means every property on this object was read successfully. A property absent from this array and null in the payload means the provider genuinely returned no value, which is different from 'we could not look'.