ServerlessFunctions Object
Relationships
graph LR
ServerlessFunctions -->|"account"| Accounts
ServerlessFunctions -->|"execution_role"| WorkloadIdentities
ServerlessFunctions -->|"encryption_key"| ManagedKeys
ServerlessFunctions -->|"network_boundary"| NetworkBoundaries
ServerlessFunctions -->|"attached_rule_sets"| FirewallRuleSets
ServerlessFunctions -->|"log_destination"| LogDestinations
Properties
Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
Instruction set architectures, verbatim (x86_64, arm64).
Security groups of the VPC attachment.
The target's id.
Hash of the deployment package, as the provider reports it.
When Truto actually read this object from the provider, in UTC ISO 8601 with the offset present — not the request time, and not a provider timestamp.
When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
Where failed asynchronous invocations go (an SQS queue or SNS topic ARN on AWS). Null when none is set.
The customer managed key that encrypts the function's environment variables. Null when the provider's default key is used.
The target's id.
Names of the environment variables set on the function. Values are never read into this row or into remote_data, because they often hold credentials.
The identity the function runs as (on AWS the execution role).
The target's id.
The entry point the platform calls. Null for a container-image function.
Layer ARNs attached to the function.
The log group the function writes to (on AWS the CloudWatch Logs group from its logging configuration, by default /aws/lambda/). The provider creates it on the first invocation, so this can name a log group that does not exist yet.
The target's id.
Memory available to the function, in MB.
The function's name, verbatim.
The provider's own type string, unmodified — for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
The VPC / virtual network the function is attached to. Null when it runs on the provider network with no VPC attachment.
The target's id.
How the code is packaged: a zip archive or a container image. The provider's own value is in remote_data.
archivecontainer_imageunknown
Which cloud this object was read from.
awsazuregcp
The provider's own identifier, passed through verbatim — a full ARN, resource id, or self-link. Never truncated, prefixed, or normalized.
Where the object is located. 'global' denotes genuinely global resources (e.g. IAM, GCP VPC networks) rather than a guessed region. A substituted region (when none is derivable) is flagged in unreadable_fields.
Raw data returned from the remote API call.
The language runtime identifier, verbatim (nodejs22.x, python3.12). Null for a container-image function, which has no managed runtime.
Lifecycle state, normalised. pending: being created or having resources set up; active: ready to invoke; inactive: idle long enough that the provider reclaimed its resources (the next invocation re-activates it); failed: creation or a resource update failed. Read on GET (on AWS the list does not return it). The provider's own value is in remote_data.
pendingactiveinactivefailedunknown
Subnets of the VPC attachment. Empty with no VPC attachment.
Key-value pairs exactly as the customer set them: no case folding, key/value normalization, or merging of separate provider concepts. An empty object means no tags; tags that could not be read appear in unreadable_fields instead.
How long one invocation may run before it is stopped.
Whether active request tracing is on (on AWS, X-Ray Active mode).
Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
Explanation of the reason, where one adds anything.
The property on this resource that could not be read.
Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
not_supported_by_providernot_configuredpermission_deniednot_collectedcollection_errorpartially_collectedavailable_on_get
When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.