AwsAccount

One AWS account the AwsConnection reaches, keyed on its account id within the tenant (two tenants may connect the same account). It takes the connection’s connector kind. Deploying puts the Vulnetix pipeline stack in the account through the connection; the per-account advancedNetworking column is written only from AwsConnection.spec.advancedNetworking today. Deleting the document turns the account off rather than forgetting it, because the deployed stack outlives the row and has to stay findable.

apiVersion	vulnetix.com/v1
kind	AwsAccount
Group	Cloud
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists AwsAccount in its kinds. See Management tokens.
Applied after	AwsConnection (deleted before them)
Terraform resource	vulnetix_aws_account, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.165.1 and later.
Pinned schema	v1.15.0/AwsAccount.schema.json
Newest schema	latest/AwsAccount.schema.json
First released in	v1.3.0
Print the built-in copy	vulnetix config schema AwsAccount

Minimal

Only the fields the kind requires. From examples/AwsAccount/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/AwsAccount.schema.json
apiVersion: vulnetix.com/v1
kind: AwsAccount
metadata:
  name: production
spec:
  accountId: "123456789012"

HCL (resource vulnetix_aws_account)

# Only the arguments the kind requires. From config-schemas examples/AwsAccount/minimal.yaml.

resource "vulnetix_aws_account" "production" {
  name       = "production"
  account_id = "123456789012"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/AwsAccount.schema.json
apiVersion: vulnetix.com/v1
kind: AwsAccount
metadata:
  name: production
spec:
  accountId: "123456789012"
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/AwsAccount/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/AwsAccount.schema.json
apiVersion: vulnetix.com/v1
kind: AwsAccount
metadata:
  name: production
  labels:
    environment: production
  annotations:
    owner: platform-team@example.com
spec:
  accountId: "123456789012"
  accountName: acme-production
  roleName: AdministratorAccess
  enabled: true
  deploy: true

HCL (resource vulnetix_aws_account)

# Every argument the kind supports. From config-schemas examples/AwsAccount/advanced.yaml.

resource "vulnetix_aws_account" "production" {
  name         = "production"
  account_id   = "123456789012"
  account_name = "acme-production"
  deploy       = true
  enabled      = true
  role_name    = "AdministratorAccess"
  labels = {
    environment = "production"
  }
  annotations = {
    owner = "platform-team@example.com"
  }
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/AwsAccount.schema.json
apiVersion: vulnetix.com/v1
kind: AwsAccount
metadata:
  name: production
  labels:
    environment: production
  annotations:
    owner: platform-team@example.com
spec:
  accountId: "123456789012"
  accountName: acme-production
  roleName: AdministratorAccess
  enabled: true
  deploy: true
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly AwsAccount	Always AwsAccount.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.accountId	string	yes		pattern ^[0-9]{12}$	A 12-digit AWS account id.
spec.accountName	string	no		length 1 to 256	A display name. AWS’s own alias replaces it when the account is read; nothing keys on it.
spec.roleName	string	no		pattern ^[\w+=,.@-]{1,64}$	For sso: the permission set the CloudFormation deploy runs as.
spec.enabled	boolean	no	true		Whether the account is swept. false leaves the other accounts and the deployed stack alone.
spec.deploy	boolean	no	false		Queue a deploy of the pipeline stack when apply creates the account or changes it. A deploy already running is not queued twice. sso deploys need a live Identity Center session.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Order. Applied after AwsConnection, so a document that refers to one by metadata.name can be in the same apply. Deleted before them.
• Status. stackStatus, the account’s CloudFormation deploy. The phases the engine reports are explained under status phases.

How apply treats it

• Names live in ConfigManagedObject. An account nobody declared exports as aws-<id>-<hash>.
• accountId cannot change under a name, and one account has one name.
• accountName is compared only while the account has none, because AWS’s alias replaces it.
• deploy: true queues the account’s stacks when apply creates or changes it. It is never read back.
• Delete stops the sweep and warns that the stacks and findings stay.

Terraform and OpenTofu

The resource is vulnetix_aws_account in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_aws_account.

Import an object that already exists by its name:

# Import an existing AwsAccount by its name (metadata.name).
terraform import vulnetix_aws_account.production production

Install, authentication and how state is read: Terraform and OpenTofu.

More examples

examples/AwsAccount/accounts.yaml from Vulnetix/config-schemas:

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/AwsAccount.schema.json
apiVersion: vulnetix.com/v1
kind: AwsAccount
metadata:
  name: production
spec:
  accountId: "123456789012"
  accountName: acme-production
  roleName: AdministratorAccess
  deploy: true
---
apiVersion: vulnetix.com/v1
kind: AwsAccount
metadata:
  name: sandpit
spec:
  accountId: "210987654321"
  roleName: VulnetixCloudscanDeploy
  enabled: false

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.