AccountGroupings Object
Relationships
graph LR
AccountGroupings -->|"account"| Accounts
AccountGroupings -->|"parent"| AccountGroupings
AccountGroupings -->|"child_accounts"| Accounts
AccountGroupings -->|"child_groupings"| AccountGroupings
Properties
Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
Accounts directly beneath this node. An empty array means it genuinely holds none; null means they were not collected.
The target's id.
Grouping nodes directly beneath this one.
The target's id.
When Truto read this object from the provider, in UTC ISO 8601 with offset. Not the request time, and not a provider-supplied timestamp.
When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
The provider's own identifier for the grouping node.
What kind of node this is. On AWS no field carries this directly -- it's derived from the identifier prefix and the operation that returned it, and flagged as derived.
organisationrootorganisational_unitmanagement_groupfolder
Whether grouping_type was read from the provider or derived.
providerderived
The name of this organisational unit, management group, or folder, as the provider names it.
The provider's own type string, unmodified -- for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
The organisation, tenant or GCP organisation this node belongs to.
The node directly above this one. Null for the organisation root.
The target's id.
Full path from the organisation root to this node. On AWS the root itself has no path field, so one is synthesized from the organisation and root identifiers.
Which cloud this object was read from.
awsazuregcp
The provider's own identifier, verbatim -- a full ARN, resource id, or self-link. Never truncated or normalised. Use it to find the object in the provider's console.
Where the object is located. 'global' marks resources with no region (e.g. IAM, a GCP VPC network). If the provider gives none, the collector's queried region is used instead and flagged in unreadable_fields.
Raw data returned from the remote API call.
Key-value pairs exactly as the customer set them -- no case folding, key/value normalisation, or merging across providers. An empty object means no tags; unreadable tags appear in unreadable_fields instead.
Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
Additional detail on the reason, when there is any.
The property on this resource that could not be read.
Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
not_supported_by_providernot_configuredpermission_deniednot_collectedcollection_errorpartially_collectedavailable_on_get
When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.