Accounts Object
Relationships
graph LR
Accounts -->|"account"| Accounts
Accounts -->|"parent_grouping"| AccountGroupings
Properties
Truto's stable unified identifier for this account — the provider's own account number (AWS 12-digit id, Azure subscription id, GCP project id). Every other resource's account reference resolves against this. Use provider_id for the full ARN or self-link.
When Truto read this object from the provider, in UTC ISO 8601 with offset. Not the request time, and not a provider-supplied timestamp.
When the account was actually created. On AWS this requires a separate account-service call and is null unless that call was made; never back-filled from joined_at.
The account's registered contact address, where the provider exposes it.
Regions (locations) the account can use right now, by the provider's own region code. On AWS: every region that is enabled by default or opted in, from EC2 DescribeRegions run as the account itself. Read on GET accounts/self, or GET accounts/{id} with account_id set to the same account; null on the organisation-wide list (see unreadable_fields).
The full hierarchy path from the organisation root down to this account, as a single string.
All hierarchy paths for this account, where a provider allows more than one. Never collapsed to a single value.
Whether Truto currently holds working credentials for this account. False for accounts discovered in the organisation but not reachable.
When the account joined the organisation. For an invited account this is the invitation acceptance date, which can be years after the account was actually created.
How the account entered the organisation, as the provider reports it.
The account, subscription or project name.
The provider's own type string, unmodified -- for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
The organisational unit, folder or management group directly above this account.
The target's id.
Which cloud this object was read from.
awsazuregcp
The provider's own identifier, verbatim -- a full ARN, resource id, or self-link. Never truncated or normalised. Use it to find the object in the provider's console.
Where the object is located. 'global' marks resources with no region (e.g. IAM, a GCP VPC network). If the provider gives none, the collector's queried region is used instead and flagged in unreadable_fields.
Raw data returned from the remote API call.
Whether the account's root user holds long-lived credentials (on AWS, access keys; signing certificates are not counted), which IAM policies cannot restrict. On providers with no root user (Azure, GCP) it is null with not_supported_by_provider. On AWS it is opt-in: read on GET accounts/{id} with fields[]=root_user_has_static_credentials, as the account itself (accounts/self, or account_id={id}); otherwise, and on the list, null with not_collected (see unreadable_fields). (AWS: IAM GetAccountSummary AccountAccessKeysPresent)
Whether the account's root user (the account owner's sign-in, which IAM policies cannot restrict) has an MFA device registered. False also when the root user has no password at all, for example a member account whose root credentials were removed centrally (AWS Organizations centralized root access), where it is not by itself a finding. On providers with no root user (Azure, GCP) it is null with not_supported_by_provider. On AWS it is opt-in: read on GET accounts/{id} with fields[]=root_user_mfa_registered, as the account itself (accounts/self, or account_id={id}); otherwise, and on the list, null with not_collected (see unreadable_fields). (AWS: IAM GetAccountSummary AccountMFAEnabled)
Lifecycle state of the account. On AWS this comes from Account.State, not the retired Account.Status field (which had no CLOSED value).
pendingactivesuspendedpending_closureclosedunknown
Key-value pairs exactly as the customer set them -- no case folding, key/value normalisation, or merging across providers. An empty object means no tags; unreadable tags appear in unreadable_fields instead.
Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
Additional detail on the reason, when there is any.
The property on this resource that could not be read.
Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
not_supported_by_providernot_configuredpermission_deniednot_collectedcollection_errorpartially_collectedavailable_on_get
When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.