Alibaba Cloud Terraform: a complete assessment walkthrough

The run in numbers

A web portal on two ECS instances behind a load balancer, with PostgreSQL, Redis sessions, an OSS bucket, a KMS key and secret, and a RAM role. Written for this page and assessed by StackToIT on 4 November 2026.

The 12 global checks of the run pass, but with no resource drafted they have nothing to check. Read them as plumbing, not as an assurance.

The data tier, assessed

Left: the PostgreSQL and Redis resources of the input. Right: the result StackToIT recorded for them, an excerpt of assessment.json with the values exactly as the run wrote them. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged.

resource "alicloud_db_instance" "main" {
  engine           = "PostgreSQL"
  engine_version   = "15.0"
  instance_type    = "pg.n2.medium.1"
  instance_storage = 100
  instance_name    = "portal-db"
  vswitch_id       = alicloud_vswitch.app_a.id
}

resource "alicloud_kvstore_instance" "sessions" {
  db_instance_name = "portal-sessions"
  instance_class   = "redis.master.small.default"
  instance_type    = "Redis"
  engine_version   = "7.0"
  vswitch_id       = alicloud_vswitch.app_a.id
}

[
  {
    "id": "alicloud_db_instance.main",
    "result": {
      "class": "REPLATFORM",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT PostgreSQL Flex"
      },
      "reason": "Managed PostgreSQL to managed PostgreSQL: data moves with pg_dump/pg_restore or logical replication, and the instance class becomes a Flex flavor."
    }
  },
  {
    "id": "alicloud_kvstore_instance.sessions",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT Key Value Store (Valkey)"
      },
      "reason": "An ApsaraDB for Redis instance becomes a Valkey instance. The application changes its endpoint and credentials; confirm that no Tair-specific commands are in use."
    }
  }
]

• PostgreSQL to PostgreSQL Flex

  The class is REPLATFORM with a named target. The run says data moves with pg_dump and pg_restore or logical replication, and the instance class becomes a Flex flavor.

• Redis to Valkey

  RECONFIGURE: the application changes endpoint and credentials, and the run asks you to confirm that no Tair-specific commands are in use.

• The version is yours to compare

  The source runs PostgreSQL 15.0. STACKIT's extension reference covers PostgreSQL 14 to 18, so the major version is offered; compare your extensions with that list.

• Replica set or single node

  STACKIT's PostgreSQL Flex is a single node or a three-node replica set. The Terraform does not say which one you need.

A dependency decides the order

The secret names the key, so the run puts the key in wave 1 and the secret in wave 2. Left: the two resources. Right: the three waves, verbatim from migration/technical-sequencing.md.

resource "alicloud_kms_key" "data" {
  description = "portal-data"
  key_spec    = "Aliyun_AES_256"
}

resource "alicloud_kms_secret" "db_password" {
  secret_name       = "portal-db-password"
  secret_data       = var.db_password
  version_id        = "v1"
  encryption_key_id = alicloud_kms_key.data.id
}

## Wave 1 — 5 unit(s)

| Unit | Class | Target |
|---|---|---|
| `alicloud_kms_key.data` | RECONFIGURE / MEDIUM | STACKIT KMS |
| `alicloud_oss_bucket.uploads` | RECONFIGURE / MEDIUM | STACKIT Object Storage |
| `alicloud_ram_role.app` | MANUAL_REVIEW / LOW | — |
| `alicloud_slb_load_balancer.web` | RECONFIGURE / MEDIUM | STACKIT Network Load Balancer |
| `alicloud_vpc.main` | RECONFIGURE / MEDIUM | STACKIT network |

## Wave 2 — 4 unit(s)

| Unit | Class | Target |
|---|---|---|
| `alicloud_kms_secret.db_password` | RECONFIGURE / MEDIUM | STACKIT Secrets Manager |
| `alicloud_security_group.app` | RECONFIGURE / MEDIUM | STACKIT security groups |
| `alicloud_vswitch.app_a` | RECONFIGURE / MEDIUM | STACKIT network |
| `alicloud_vswitch.app_b` | RECONFIGURE / MEDIUM | STACKIT network |

## Wave 3 — 4 unit(s)

| Unit | Class | Target |
|---|---|---|
| `alicloud_db_instance.main` | REPLATFORM / MEDIUM | STACKIT PostgreSQL Flex |
| `alicloud_instance.app_a` | RECONFIGURE / MEDIUM | STACKIT Compute Engine |
| `alicloud_instance.app_b` | RECONFIGURE / MEDIUM | STACKIT Compute Engine |
| `alicloud_kvstore_instance.sessions` | RECONFIGURE / MEDIUM | STACKIT Key Value Store (Valkey) |

• Technical order, not a schedule

  The run itself says the waves are a starting point for the architect's plan. Units in the same wave can move in parallel.

• Networks sit across waves

  The VPC is in wave 1 and the vSwitches in wave 2. The servers, the database and the cache follow in wave 3.

• The RAM role is in wave 1

  It depends on nothing in the Terraform, but every workload that assumes it depends on the design you make for it.

• Cutover facts are empty

  No DNS record, certificate or address re-binding exists in this estate, and the run says that is not a statement that nothing has to be cut over.

Stateful units and the services to enable

Two excerpts from the same run: the stateful units from migration/data-movement.md and the STACKIT services that the mapped units would need, from migration/landing-zone-requirements.md.

| Unit | Source service | Target service | Application | Mechanism | State | Data class | RPO | Downtime tolerance |
|---|---|---|---|---|---|---|---|---|
| alicloud_db_instance.main | alicloud_db_instance | STACKIT PostgreSQL Flex |  | UNKNOWN | DECISION_REQUIRED | NOT_PROVIDED | NOT_PROVIDED | NOT_PROVIDED |
| alicloud_kvstore_instance.sessions | alicloud_kvstore_instance | STACKIT Key Value Store (Valkey) |  | UNKNOWN | DECISION_REQUIRED | NOT_PROVIDED | NOT_PROVIDED | NOT_PROVIDED |
| alicloud_oss_bucket.uploads | alicloud_oss_bucket | STACKIT Object Storage |  | UNKNOWN | DECISION_REQUIRED | NOT_PROVIDED | NOT_PROVIDED | NOT_PROVIDED |

| Service | Resource types | Source units mapped |
|---|---|---|
| IaaS | `stackit_network`, `stackit_network_interface`, `stackit_security_group`, `stackit_security_group_rule`, `stackit_server`, `stackit_volume` | 6 |
| Key Management (KMS) | `stackit_kms_key`, `stackit_kms_keyring` | 1 |
| Load Balancing | `stackit_loadbalancer` | 1 |
| Object Storage | `stackit_objectstorage_bucket`, `stackit_objectstorage_credential`, `stackit_objectstorage_credentials_group` | 1 |
| PostgreSQL Flex | `stackit_postgresflex_database`, `stackit_postgresflex_instance`, `stackit_postgresflex_user` | 1 |
| Secrets Manager | `stackit_secretsmanager_instance`, `stackit_secretsmanager_user` | 1 |
| Valkey | `stackit_valkey_credential`, `stackit_valkey_instance` | 1 |

• No mechanism is chosen

  All three units show the mechanism UNKNOWN and the state DECISION_REQUIRED. The run never moves data and does not pick the tool.

• Seven service families

  IaaS carries six units, the other six families one each. The run notes that the draft itself needs none enabled because it writes no resource block; for the target build, this is the list of services your project will use.

• Data class, RPO and downtime

  They are NOT_PROVIDED until you give them in the applications file, which the run then quotes word for word. They are the inputs for choosing between a dump and restore and replication.

• OSS to Object Storage

  The run notes an S3 API on the target. Applications that use the OSS SDK change their client.

Who does what

The work packages of the same run, verbatim from execution/README.md. Every step is manual because the draft writes no STACKIT resource.

| Package | Owner | Phase | Steps | Resources | Decisions to answer | State |
|---|---|---|---|---|---|---|
| [`WP-01`](manual/actions.md) Set up by hand the resources the draft writes nothing for (foundation) | Network Architect | foundation | 3 | 3 | — | a person can start it now |
| [`WP-02`](manual/actions.md) Set up by hand the resources the draft writes nothing for (security) | Identity Architect | security | 1 | 1 | — | a person can start it now |
| [`WP-03`](manual/actions.md) Set up by hand the resources the draft writes nothing for (security) | Network Architect | security | 1 | 1 | — | a person can start it now |
| [`WP-04`](manual/actions.md) Set up by hand the resources the draft writes nothing for (security) | Owner assignment required | security | 2 | 2 | — | a person can start it now |
| [`WP-05`](manual/actions.md) Set up by hand the resources the draft writes nothing for (data services) | Data Architect | data services | 2 | 2 | — | a person can start it now |
| [`WP-06`](manual/actions.md) Set up by hand the resources the draft writes nothing for (data services) | Storage Architect | data services | 1 | 1 | — | a person can start it now |
| [`WP-07`](manual/actions.md) Set up by hand the resources the draft writes nothing for (platform services) | Network Architect | platform services | 1 | 1 | — | a person can start it now |
| [`WP-08`](manual/actions.md) Set up by hand the resources the draft writes nothing for (workloads) | Platform Architect | workloads | 2 | 2 | — | a person can start it now |

• Owner assignment required

  WP-04 holds the KMS key and the secret. The owner table has no role for the security category of these units, so the run asks you to name one.

• A person can start now

  The plan marks all eight packages as startable; none waits for a decision. WP-04 still needs an owner first, and none of this is an approval.

• Security work is split three ways

  The RAM role goes to the Identity Architect, the security group to the Network Architect, and the key and secret wait for you.

The decisions this estate forces

• Target region

  Answer eu01 or eu02 in inputs-template.yaml. It blocks the draft, and requests that depend on the region are derived from the eu01 catalogue until you answer.

• The db_password variable

  The template takes no value for it because it is sensitive: supply it through a tfvars file or TF_VAR_db_password in a private run. Until then the run reports that the migration of the secret could not be assessed.

• RAM role to service account

  The role is trusted by the ECS service. On STACKIT the workload gets a service account and roles in the project.

• Public exposure

  The load balancer is internet-facing, and the run says its public address changes. The run lists ingress and egress as target settings to configure in the target environment.

• Zones

  The two vSwitches sit in two zones at the source. Review zone placement of the two servers on STACKIT.

• Data mechanism and window

  Choose per stateful unit: dump and restore, replication, copy by object. Record RPO and downtime in the applications file.

Questions about this walkthrough

Sources

• Terraform Registry: alicloud_kms_secret (provider 2.1.0)
• Terraform Registry: alicloud_kvstore_instance (provider 2.1.0)
• STACKIT: Architecture of PostgreSQL Flex
• STACKIT: PostgreSQL Flex supported extensions
• STACKIT: Key Value Store
• STACKIT: Secrets Manager