AccessGrants Object
Relationships
graph LR
AccessGrants -->|"account"| Accounts
AccessGrants -->|"principal"| HumanIdentities
AccessGrants -->|"permission"| PermissionDefinitions
Properties
Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
Whether the privilege is permanent, eligible (activated on request), or time-limited with an expiry.
permanenteligibletime_limitedunknown
When Truto read this object from the provider, in UTC ISO 8601 with offset. Not the request time, and not a provider-supplied timestamp.
When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
When the grant expires. AWS IAM attachments and Identity Center assignments are permanent until detached, so this is null with not_supported_by_provider there. Session duration bounds a credential, not this grant, and is not mapped here.
Stable reference for this grant. Synthesized on AWS, which has no single grant identifier.
Whether the grant permits every action on every resource, derived from the permission document including the NotAction case.
Whether this grant confers administrative privilege. Derived by parsing the permission document.
When this grant was last formally reviewed. AWS has no access-review or attestation concept, so this is always null there; see last_used_at for a related but different signal.
When the granted access was last exercised. Not a substitute for last_reviewed_at.
The provider's own type string, unmodified -- for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
What was granted. Absent for a grant with no independently addressable policy — an AWS inline policy, which lives inside its principal.
The target's id.
What the provider calls it.
Who holds the grant. user resolves against human_identities and workload_identity against workload_identities. Null when principal_type is group or external, which have no resource in this family; the provider's id for those is kept in remote_data.principal_arn.
The target's id.
What kind of principal holds it.
usergroupworkload_identityexternalunknown
Which cloud this object was read from.
awsazuregcp
The provider's own identifier, verbatim -- a full ARN, resource id, or self-link. Never truncated or normalised. Use it to find the object in the provider's console.
Where the object is located. 'global' marks resources with no region (e.g. IAM, a GCP VPC network). If the provider gives none, the collector's queried region is used instead and flagged in unreadable_fields.
Raw data returned from the remote API call.
The provider reference for the exact thing the grant applies to.
The provider reference for the scope node.
How far the grant reaches, from organisation level down to a single resource.
organisationgroupingaccountresourceunknown
Key-value pairs exactly as the customer set them -- no case folding, key/value normalisation, or merging across providers. An empty object means no tags; unreadable tags appear in unreadable_fields instead.
Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
Additional detail on the reason, when there is any.
The property on this resource that could not be read.
Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
not_supported_by_providernot_configuredpermission_deniednot_collectedcollection_errorpartially_collectedavailable_on_get
When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.