Alibaba DNS, CDN and Log Service migration runbook

The edge of a small estate, assessed

A small Alibaba Cloud estate written for this page and assessed by StackToIT on 4 November 2026. Left: one DNS record, the CDN domain and the logstore block of the input. Right: the result the run recorded, an excerpt of assessment.json with the values as the run wrote them. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged. The input blocks are shown in separate panes because they are not next to each other in main.tf.

resource "alicloud_alidns_record" "www" {
  domain_name = "shop.example"
  rr          = "www"
  type        = "CNAME"
  value       = "shop.example.cdn.example-edge.net"
  ttl         = 600
}

resource "alicloud_cdn_domain_new" "static" {
  domain_name = "static.shop.example"
  cdn_type    = "web"
  scope       = "overseas"
  sources {
    content  = "origin.shop.example"
    type     = "domain"
    port     = 443
    priority = 20
    weight   = 15
  }
}

resource "alicloud_log_store" "access" {
  project_name          = alicloud_log_project.app.project_name
  logstore_name         = "access"
  retention_period      = 30
  shard_count           = 2
  auto_split            = true
  max_split_shard_count = 8
}

[
  {
    "id": "alicloud_alidns_record.www",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT DNS"
      },
      "reason": "An Alibaba Cloud DNS record becomes a record in a STACKIT DNS zone. Weighted and line-based resolution of the source need review."
    }
  },
  {
    "id": "alicloud_cdn_domain_new.static",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT CDN"
      },
      "reason": "A CDN domain becomes a STACKIT CDN distribution. Cache rules and certificates are rewritten, and the origin moves with the workload."
    }
  },
  {
    "id": "alicloud_log_project.app",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "LOW",
      "target": {
        "service": "STACKIT Logs"
      }
    }
  },
  {
    "id": "alicloud_log_store.access",
    "result": {
      "class": "MANUAL_REVIEW",
      "confidence": "LOW",
      "reason": "alicloud_log_store is not in the knowledge base catalogue; an architect has to decide the target. Nothing of this resource is assessed or drafted (unknown source type)."
    }
  }
]

• Three targets named

  DNS record to a record in a STACKIT DNS zone, CDN domain to a STACKIT CDN distribution, log project to a STACKIT Logs instance, all RECONFIGURE.

• One unit is unknown to the run

  alicloud_log_store is not in the catalogue of this build, so it is MANUAL_REVIEW and nothing of it is assessed. Your logstore settings, shard count, retention and splitting, are yours to carry over.

• Confidence differs

  The log project has confidence LOW in this run, while the same resource type, with the same description-only block, has MEDIUM in our complete-guide and Function Compute demo runs, where no logstore references it. The run does not say why, so read it as a signal to check the project by hand.

Order from the run

The waves as the run wrote them. The execution plan files the two DNS records under the cutover phase and the other three units under platform services.

## Wave 1 — 4 unit(s)

| Unit | Class | Target |
|---|---|---|
| `alicloud_alidns_record.api` | RECONFIGURE / MEDIUM | STACKIT DNS |
| `alicloud_alidns_record.www` | RECONFIGURE / MEDIUM | STACKIT DNS |
| `alicloud_cdn_domain_new.static` | RECONFIGURE / MEDIUM | STACKIT CDN |
| `alicloud_log_project.app` | RECONFIGURE / LOW | STACKIT Logs |

## Wave 2 — 1 unit(s)

| Unit | Class | Target |
|---|---|---|
| `alicloud_log_store.access` | MANUAL_REVIEW / LOW | — |

• Owners come from the plan

  WP-01 CDN: Network Architect. WP-02 log project: Platform Architect. WP-03 logstore: no owner, because the unit has no category, so you assign one. WP-04 the two DNS records, in the cutover phase: Network Architect.

• Rollback is left to you

  Every step says the plan does not know how it is undone and the person who carries it out records how. The package notes that from the cutover on, the DNS steps cannot be undone in full by a tool, so decide how before the cutover starts.

The runbook, step by step

Steps 1, 3, 4 and 5 follow the manual steps of the run. Steps 2, 7 and 8 are general practice. Dates are yours: the run writes "timing to be scheduled by the owner".

Where the platforms differ

Facts about the platforms come from the pages listed under sources, read on the day this page was written.

• DNS record behaviour

  The run flags weighted and line-based resolution of the source for review. The STACKIT DNS overview lists forward, reverse and secondary zones, many record types including ALIAS and CAA, and states that DNSSEC zone signing is currently not available.

• Import path

  Alibaba Cloud DNS exports .xlsx and zone files and imports .xls, .xlsx or zone files, with a mode that skips duplicates and a high-risk mode that deletes existing records first. The STACKIT DNS overview states that zone data can be saved and restored manually through the DNS API or the Portal; keep the zone file as your common format and your rollback copy.

• CDN origins and certificates

  STACKIT CDN takes an HTTP origin or an S3-compatible bucket origin, maps custom domains with a CNAME to the managed domain, and offers managed Let's Encrypt certificates or your own PEM files, which you rotate yourself. Terraform support for several CDN features is still in progress per the documentation.

• CNAME constraints

  On Alibaba Cloud, a CNAME cannot share a host with an A, AAAA, MX or TXT record, and a CNAME on the root domain can break mail. The same DNS rule applies after the move, so put the CDN on a subdomain.

• Logs model

  STACKIT Logs is built on Grafana Loki and allows at most 15 label names per stream, so decide which fields of a Simple Log Service logstore become labels. Queries written for Simple Log Service are rewritten, and so are the collectors, as the run states.

Rollback, per area

• DNS

  Keep the Alibaba Cloud zone untouched until the observation window ends. To roll back, restore the previous delegation or the previous records from the export. Write the exact values down before step 7.

• CDN

  Keep the old distribution and its CNAME value. Alibaba Cloud advises backing up the original record before changing it and switching off-peak, which is the same discipline in reverse.

• Logs

  Send logs to both targets during the overlap (practice), so the Alibaba Cloud project remains complete if you return.

• Who decides

  The run assigns no rollback owner. Name one per step, in your copy of progress-template.yaml or your change record, before the cutover begins.

Questions operations teams ask

Sources

• STACKIT docs: DNS product overview
• STACKIT docs: CDN features and options
• STACKIT docs: Introduction to Logs
• STACKIT docs: Limits for Logs
• Alibaba Cloud docs: Import and export DNS records
• Alibaba Cloud docs: Configure a CNAME record for CDN