# ObjectStores Object

> Source: https://truto.one/docs/api-reference/unified-cloud-infrastructure-api/objectstores/

Schema for the `ObjectStores` resource in **Unified Cloud Infrastructure API**.

## Properties

- **`id`** _(string, required)_
  Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
- **`provider_id`** _(string)_
  The provider's own identifier. S3 returns an ARN only for directory buckets; for general-purpose buckets this is the canonical `arn:<partition>:s3:::<name>`, which is how AWS itself addresses the bucket.
- **`provider`** _(string)_
  Which cloud this object was read from.
  Allowed: `aws`, `azure`, `gcp`
- **`account`** _(string)_
  The account, subscription or project this object belongs to.
- **`region`** _(string)_
  Where the object is located. 'global' denotes genuinely global resources (e.g. IAM, GCP VPC networks) rather than a guessed region. A substituted region (when none is derivable) is flagged in unreadable_fields.
- **`native_type`** _(string)_
  The provider's own type string, unmodified — for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
- **`tags`** _(object)_
  Key-value pairs exactly as the customer set them: no case folding, key/value normalization, or merging of separate provider concepts. An empty object means no tags; tags that could not be read appear in unreadable_fields instead.
- **`collected_at`** _(string)_
  When Truto actually read this object from the provider, in UTC ISO 8601 with the offset present — not the request time, and not a provider timestamp.
- **`updated_at`** _(string)_
  When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
- **`created_at`** _(string)_
  When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
- **`unreadable_fields`** _(array<object>)_
  Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
  - **`field`** _(string)_
    The property on this resource that could not be read.
  - **`reason`** _(string)_
    Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
    Allowed: `not_supported_by_provider`, `not_configured`, `permission_denied`, `not_collected`, `collection_error`, `partially_collected`, `available_on_get`
  - **`detail`** _(string)_
    Explanation of the reason, where one adds anything.
- **`remote_data`** _(object)_
  Raw data returned from the remote API call.
- **`store_id`** _(string)_
  The provider's own identifier for the store.
- **`name`** _(string)_
  The bucket or container name.
- **`location`** _(string)_
  Where the store's data physically sits.
- **`public_access_blocked`** _(boolean)_
  Whether public access is comprehensively blocked. True only when all four effective block-public-access flags are set (the more restrictive of account- and bucket-level config); a missing configuration counts as all-false.
- **`anonymous_access_allowed`** _(boolean)_
  Whether the store is effectively reachable without credentials. Computed from the provider's effective access rules, not a single flag.
- **`policy_grants_anyone`** _(boolean)_
  Whether the bucket policy grants access to anyone (distinct from account-level toggles, which can disagree). On AWS, cross-account access often can't read the policy body itself, so this may be marked permission_denied.
- **`acl_grants_anyone`** _(boolean)_
  Whether an ACL grants access to a public group, tracked separately from policy_grants_anyone since the two can differ.
- **`acl_grants_authenticated_users`** _(boolean)_
  Whether an ACL grants access to any authenticated account on the provider (not anonymous — requests must be signed, but any account on the provider qualifies).
- **`effective_public_access_block`** _(object)_
  The per-flag effective block configuration, combining account-level and store-level settings.
  - **`block_public_acls`** _(boolean)_
    AWS BlockPublicAcls. Rejects new public ACLs on the store and its objects.
  - **`ignore_public_acls`** _(boolean)_
    AWS IgnorePublicAcls. Ignores any public ACL already present.
  - **`block_public_policy`** _(boolean)_
    AWS BlockPublicPolicy. Rejects a store policy that would grant public access.
  - **`restrict_public_buckets`** _(boolean)_
    AWS RestrictPublicBuckets. Limits access under a public policy to principals in this account and AWS services.
- **`encryption_key_type`** _(string)_
  Who manages the encryption key. On AWS every bucket now gets default provider-side encryption, so 'none' is effectively obsolete; what matters is whether the key is customer_managed.
  Allowed: `provider_managed`, `provider_owned`, `customer_managed`, `customer_supplied`, `none`, `unknown`
- **`encryption_key`** _(object)_
  The key protecting the store, where a customer-managed one is configured.
  - **`id`** _(string)_
    The target's `id`.
- **`encryption_algorithm`** _(string)_
  The provider's own algorithm string, verbatim.
- **`versioning_enabled`** _(boolean)_
  Whether object versioning is on. On AWS, a bucket that never had versioning enabled returns no status field, read as false rather than unknown.
- **`object_lock_enabled`** _(boolean)_
  Whether write-once retention is enabled on the store.
- **`retention_policy_days`** _(integer)_
  Default retention period applied to objects, in days.
- **`retention_locked`** _(boolean)_
  Whether the retention period cannot be shortened or removed. On AWS this maps to a COMPLIANCE-mode default rule, which only governs future objects, not what's already stored.
- **`lifecycle_rules`** _(array<object>)_
  Lifecycle rules configured on the store.
  - **`id`** _(string)_
    The provider's own rule id.
  - **`status`** _(string)_
    Whether the rule is enabled.
  - **`prefix`** _(string)_
    Object key prefix the rule applies to, if scoped.
  - **`expiration_days`** _(integer)_
    Days after which matching objects expire.
- **`access_logging_enabled`** _(boolean)_
  Whether access logging is on. On AWS an unlogged bucket returns an empty document rather than an error, read as false.
- **`min_tls_version`** _(string)_
  Minimum TLS version accepted. AWS has no bucket-level setting — only a per-action policy condition, so requirements can vary by action. Null with not_supported_by_provider there.
- **`replication_targets`** _(array<string>)_
  Destination stores this store replicates to, as provider references. The destination region is not returned by the provider.
- **`replication_enabled`** _(boolean)_
  Whether any replication rule is configured and enabled.

## Methods

- [GET /unified/cloud-infrastructure/object_stores](/docs/api-reference/unified-cloud-infrastructure-api/objectstores/list) — List Object stores
- [GET /unified/cloud-infrastructure/object_stores/{id}](/docs/api-reference/unified-cloud-infrastructure-api/objectstores/get) — Get Object stores