> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/api-documentation/api-reference/api--cloud-security/types/objects/cloud-item.md). # cloudItem Represents a comprehensive cloud security item with security context. ### Examples ```graphql type CloudItem { id: String assetName: String service: String resourceId: String cbomId: String cbomProvider: String resourceType: String resourceName: String accountId: String firstSeen: String cloudProvider: String serviceCategory: String applications: [AppInfo] isExposed: String isPermissiveIdentity: Boolean isHighPrivilege: Boolean isSensitiveData: Boolean contextFactors: [String] imageSource: String registryType: String registryName: String imageScanStatus: String exposurePath: [ExposurePathItem] accountName: String subService: String region: String resourceTags: JSON authenticationRequired: Boolean reachability: CloudItemReachability resourceArn: String images: [CloudItemImage] relatedIssues: Severities issueSeverityBreakdown: [CloudIssueSeverityBreakdown] issuesStats: IssuesStats cluster: String link: String imageHash: String workloads: [Workload] artifactIds: [String] attachedIdentities: CbomAttachedIdentities compliance: [CloudItemCompliance] usageSeries: CloudUsageSeries isAiAsset: Boolean isTrainingData: Boolean modelInfo: CloudModelInfo trainingDataInfo: CloudTrainingDataInfo tools: [CloudTool] dataAccess: [CloudDataAccess] probeResults: [CloudProbeResult] } ``` ### Fields | Field | Description | Supported fields | | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | id `String` | Unique identifier for the cloud item | | | assetName `String` | Name of the cloud asset or resource | | | service `String` | Cloud service type (EC2, S3, Lambda, etc.) | | | resourceId `String` | Cloud provider's resource identifier | | | cbomId `String` | Cloud Bill of Materials identifier | | | cbomProvider `String` | Cloud provider name | | | resourceType `String` | Type of cloud resource | | | resourceName `String` | Name of the cloud resource | | | accountId `String` | Cloud account identifier | | | firstSeen `String` | Date when the resource was first discovered | | | cloudProvider `String` | Cloud provider (AWS, Azure, GCP, etc.) | | | serviceCategory `String` | Category of the cloud service | | | applications [`[AppInfo]`](/api-documentation/api-reference/api--cloud-security/types/objects/app-info.md) | Applications associated with this cloud resource |

id String
name String
type String

| | isExposed `String` | Whether the resource is exposed to the internet | | | isPermissiveIdentity `Boolean` | Whether the resource has a permissive (high-privilege) identity attached. | | | isHighPrivilege `Boolean` | Whether the resource itself has high-privilege access. | | | isSensitiveData `Boolean` | Whether the resource holds sensitive data (confirmed secrets or PII). | | | contextFactors `[String]` | Severity-factor context labels for the asset. Set for runtime image assets. | | | imageSource `String` | Source of the container image if applicable | | | registryType `String` | Type of container registry | | | registryName `String` | Name of the container registry | | | imageScanStatus `String` | Status of the image security scan | | | exposurePath [`[ExposurePathItem]`](/api-documentation/api-reference/api--cloud-security/types/objects/exposure-path-item.md) | Path showing how the resource is exposed |

type String
name String
cbomId String

| | accountName `String` | Human-readable name of the cloud account | | | subService `String` | Sub-service or component within the main service | | | region `String` | Cloud region where the resource is located | | | resourceTags `JSON` | Tags associated with the cloud resource | | | authenticationRequired `Boolean` | Whether authentication is required to access the asset. Asset-level verdict: the live-probe result when the asset was probed, otherwise the static config/service-model determination. | | | reachability [`CloudItemReachability`](/api-documentation/api-reference/api--cloud-security/types/objects/cloud-item-reachability.md) | Result of the reachability probe for the asset, including whether reachability was confirmed and the observed HTTP response. |

confirmed Boolean
responseCode String
authTagValue String
conclusion String
playbook String
steps \[String]
manualCheck String
response String

| | resourceArn `String` | Amazon Resource Name (ARN) for AWS resources | | | images [`[CloudItemImage]`](/api-documentation/api-reference/api--cloud-security/types/objects/cloud-item-image.md) | Container images associated with this resource |

name String
hashes \[CloudItemImageHash]
tags \[String]

| | relatedIssues [`Severities`](/api-documentation/api-reference/api--application/types/objects/severities.md) | Security issues found in this resource, categorized by severity |

info Int
low Int
medium Int
high Int
critical Int
appox Int

| | issueSeverityBreakdown [`[CloudIssueSeverityBreakdown]`](/api-documentation/api-reference/api--cloud-security/types/objects/cloud-issue-severity-breakdown.md) | Breakdown of issues by policy category with severity details |

name String
severities Severities

| | issuesStats [`IssuesStats`](/api-documentation/api-reference/api--cloud-security/types/objects/issues-stats.md) | Statistics about security issues found |

totalIssues Int
sourceTools \[IssueStat]
categories \[IssueStat]
severities \[IssueStat]

| | cluster `String` | Kubernetes cluster name if applicable | | | link `String` | URL link to view the resource in the cloud console | | | imageHash `String` | Hash of the container image | | | workloads [`[Workload]`](/api-documentation/api-reference/api--cloud-security/types/objects/workload.md) | Kubernetes workloads associated with this resource |

type String
namespace String
name String
cluster String
region String
isExposed String
consoleLink String
exposurePath \[ExposurePathItem]

| | artifactIds `[String]` | List of artifact identifiers associated with this resource | | | attachedIdentities [`CbomAttachedIdentities`](/api-documentation/api-reference/api--cloud-security/types/objects/cbom-attached-identities.md) | CBOM asset related identities |

users \[String]
groups \[String]
servicePrincipals \[String]
serviceAccounts \[String]
iamPolicies \[String]
attachedResources \[String]
trustedBy \[String]

| | compliance [`[CloudItemCompliance]`](/api-documentation/api-reference/api--cloud-security/types/objects/cloud-item-compliance.md) | Per-asset compliance results: each entry is a single compliance check evaluated for this asset, with its status and the framework controls it maps to. |

checkId String
status String
frameworks JSON

| | usageSeries [`CloudUsageSeries`](/api-documentation/api-reference/api--cloud-security/types/objects/cloud-usage-series.md) | Generative AI usage time-series for the asset, covering invocation and token volumes over a rolling window. Set for AI service assets that publish usage metrics. |

source String
countMetric String
tokenMetric String
windowDays Int
daily \[CloudUsageDaily]

| | isAiAsset `Boolean` | Indicates whether the asset is classified as an AI asset. | | | isTrainingData `Boolean` | Indicates whether the asset holds data used to train or tune a model. | | | modelInfo [`CloudModelInfo`](/api-documentation/api-reference/api--cloud-security/types/objects/cloud-model-info.md) | Structured identity of the foundation model associated with the asset. |

moduleName String
moduleVersion String
vendor String
family String
modelClass String
where String
matched String

| | trainingDataInfo [`CloudTrainingDataInfo`](/api-documentation/api-reference/api--cloud-security/types/objects/cloud-training-data-info.md) | Structured identity of the training data associated with the asset. |

dataType String
location String
locationType String
locationPath String
storageType String

| | tools [`[CloudTool]`](/api-documentation/api-reference/api--cloud-security/types/objects/cloud-tool.md) | Tools the AI agent can invoke at inference time. |

name String
type String
target String
where String
matched String
args \[String]

| | dataAccess [`[CloudDataAccess]`](/api-documentation/api-reference/api--cloud-security/types/objects/cloud-data-access.md) | Data systems the asset depends on. |

name String
where String
matched String

| | probeResults [`[CloudProbeResult]`](/api-documentation/api-reference/api--cloud-security/types/objects/cloud-probe-result.md) | Connectivity probe results collected for the asset during attack surface simulation. |

url String
type String
statusCode Int
curl String
connectedAsset CloudProbeConnectedAsset

| ### References #### Queries using this object: * [\ getSingleCloudBomItem](/api-documentation/api-reference/api--cloud-security/queries/get-single-cloud-bom-item.md) #### Fields with this object: * [{} CloudItemsResponse.cloudItems](/api-documentation/api-reference/api--cloud-security/types/objects/cloud-items-response.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.ox.security/api-documentation/api-reference/api--cloud-security/types/objects/cloud-item.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.