ManagedKeys Object
Relationships
graph LR
ManagedKeys -->|"account"| Accounts
Properties
Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
Human-readable aliases for the key.
When Truto actually read this object from the provider, in UTC ISO 8601 with the offset present — not the request time, and not a provider timestamp.
Settings on the vault or key ring that prevent accidental deletion — purge protection, soft delete, deletion prevention.
When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
How long the provider waits before destroying a key scheduled for deletion.
The provider's own identifier for the key.
The raw key policy document, where it could be read.
The provider's own key specification string, verbatim.
The key's cryptographic type, as the provider names it.
Who manages the key: the provider, the customer, or an external key store.
providercustomerexternalunknown
Whether this key is part of a multi-region key set. Rotation is a shared property configured only on the primary key in the set.
The provider's own type string, unmodified — for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
When the key is next due to rotate.
Where the key material came from — generated in the key service, imported, or held in an external or hardware key store.
Whether the key policy grants use to anyone. A heuristic (absence of a scoping condition on a wildcard principal), not a provider fact. Doesn't account for grants, a separate authorization path, and cross-account policy reads are commonly permission_denied.
The condition keys found scoping the key policy's wildcard principal, if any.
Whether key material is held in software or in a hardware security module.
Which cloud this object was read from.
awsazuregcp
The provider's own identifier, passed through verbatim — a full ARN, resource id, or self-link. Never truncated, prefixed, or normalized.
Where the object is located. 'global' denotes genuinely global resources (e.g. IAM, GCP VPC networks) rather than a guessed region. A substituted region (when none is derivable) is flagged in unreadable_fields.
Raw data returned from the remote API call.
Whether rotation is a meaningful question for this key type, so a null rotation_enabled isn't mistaken for missing data.
Whether automatic rotation is on. Null (not false) when rotation doesn't apply to the key type at all — e.g. asymmetric, HMAC, and custom-key-store keys.
How often the key rotates, in days. A key with no rotation period never rotates — distinct from a missing field, which unreadable_fields declares with not_configured.
When the key is scheduled for destruction, where deletion is pending.
The provider's own key state string, verbatim.
Key-value pairs exactly as the customer set them: no case folding, key/value normalization, or merging of separate provider concepts. An empty object means no tags; tags that could not be read appear in unreadable_fields instead.
Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
Explanation of the reason, where one adds anything.
The property on this resource that could not be read.
Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
not_supported_by_providernot_configuredpermission_deniednot_collectedcollection_errorpartially_collectedavailable_on_get
When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.