Alibaba Cloud vs STACKIT: service mapping

The mapping, as one run decided it

A web shop estate written for this page: network, one server, a load balancer, three data services, object storage, two messaging services, a function, a RAM role and a KMS key. StackToIT assessed it on 4 November 2026 without connecting to any account.

Classes and targets are copied from the run. The run drafted no STACKIT resource blocks for Alibaba Cloud estates, so every row ends as a manual step with an owner.

Three data and messaging services, assessed

Left: three resources of the input. Right: an excerpt of assessment.json with the values the run wrote. Three stateful services, three different classes: the PostgreSQL instance is a replatform, the PolarDB cluster a redesign and the Kafka instance a containerize. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged. The input blocks are shown in separate panes because they are not next to each other in main.tf.

resource "alicloud_db_instance" "orders" {
  engine               = "PostgreSQL"
  engine_version       = "16.0"
  instance_type        = "pg.n2.2c.2m"
  instance_storage     = 100
  instance_name        = "shop-orders"
  vswitch_id           = alicloud_vswitch.app.id
}

resource "alicloud_polardb_cluster" "ledger" {
  db_type       = "MySQL"
  db_version    = "8.0"
  db_node_class = "polar.mysql.g2.medium"
  pay_type      = "PostPaid"
  vswitch_id    = alicloud_vswitch.app.id
  description   = "shop-ledger"
}

resource "alicloud_alikafka_instance" "events" {
  name          = "shop-events"
  partition_num = 50
  disk_type     = 1
  disk_size     = 500
  deploy_type   = 5
  io_max        = 20
  vswitch_id    = alicloud_vswitch.app.id
}

[
  {
    "id": "alicloud_db_instance.orders",
    "result": {
      "class": "REPLATFORM",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT PostgreSQL Flex"
      },
      "reason": "Managed PostgreSQL to managed PostgreSQL: data moves with pg_dump/pg_restore or logical replication, and the instance class becomes a Flex flavor."
    }
  },
  {
    "id": "alicloud_polardb_cluster.ledger",
    "result": {
      "class": "REDESIGN",
      "confidence": "LOW",
      "reason": "PolarDB separates compute from shared storage, which has no STACKIT counterpart. Choose the target by its compatible engine: PostgreSQL Flex or MariaDB, and test the workload there."
    }
  },
  {
    "id": "alicloud_alikafka_instance.events",
    "result": {
      "class": "CONTAINERIZE",
      "confidence": "MEDIUM",
      "target": {
        "service": "a self-managed Kafka-compatible broker on SKE"
      },
      "reason": "STACKIT has no managed Kafka service. The broker runs self-managed on SKE, or the messaging design changes to RabbitMQ."
    }
  }
]

• Same engine, direct target

  ApsaraDB RDS for PostgreSQL maps to STACKIT PostgreSQL Flex. Data moves with pg_dump and pg_restore or logical replication, and the instance class becomes a Flex flavor.

• No target without a decision

  PolarDB separates compute from shared storage, which has no STACKIT counterpart. The run proposes no target and asks you to pick one by compatible engine, then test the workload there.

• Kafka stays yours to run

  The run names no managed Kafka service on STACKIT. The broker runs self-managed on SKE, or the messaging design changes to RabbitMQ.

Differences that bite in practice

Each point is taken from the reason the run recorded for the resource, with the vendor documentation where it explains the mechanism.

• A VPC becomes several networks

  Alibaba Cloud documents a vSwitch as a zone-level subnet of a VPC. On STACKIT each vSwitch becomes a network with its own address range, and routing between them is planned with a Network Area where needed.

• Security groups only allow

  STACKIT security groups are an allow-list with default deny and are attached through network interfaces. The run states that a deny rule or a priority order from Alibaba Cloud needs a decision. The group in this estate carries no rules, so the run rates it MEDIUM; rules you add later need that check one by one.

• The load balancer gets a new address

  The run maps the SLB instance to a STACKIT Network Load Balancer: listeners and backends are rewritten and the public address changes. On STACKIT a public address is a separate Public IP resource attached to the load balancer, so DNS records and partner allow lists that name the old address change at cut-over.

• Clients change for storage and cache

  OSS becomes an S3-API bucket, so applications using the OSS SDK change their client. Redis becomes Valkey: confirm that no Tair-specific commands are in use.

• Keys are not moved

  Key material of an Alibaba Cloud KMS key does not move. Data encrypted with it is re-encrypted under a STACKIT KMS key.

• Functions become containers

  The run states that STACKIT has no function service. A function is packaged as a container for SKE or Cloud Foundry and its triggers are replaced.

Reading the result: waves and owners

The run orders the 14 units by dependency into three waves and groups the manual work into nine work packages.

1. 01

   Wave 1, six units

   The VPC, the RabbitMQ instance, the function, the KMS key, the OSS bucket and the RAM role depend on nothing else in the estate.

2. 02

   Wave 2, two units

   The vSwitch and the security group follow the VPC.

3. 03

   Wave 3, six units

   The server, load balancer, PostgreSQL, PolarDB, Redis and Kafka instances come last, because they sit on the vSwitch.

4. 04

   Four data units need a mechanism

   The data movement file lists the PostgreSQL instance, the Redis instance, the OSS bucket and PolarDB as DECISION_REQUIRED. No mechanism is chosen, since size, change rate and tolerated downtime are not in the Terraform.

5. 05

   One owner is open

   The work package for the KMS key lists its owner as NOT_STATED. Assign it when you hand out the packages.

Questions architects ask about the mapping

Sources

• Alibaba Cloud: VPCs and vSwitches
• STACKIT Virtual Network: concepts
• STACKIT Security Groups: concepts
• STACKIT RabbitMQ product page