AWS Terraform to STACKIT Terraform

One real conversion: Aurora PostgreSQL to PostgreSQL Flex

The orders database of the AWS Retail Store Sample App, on the left exactly as AWS publishes it, on the right exactly as StackToIT wrote it in the published run.

module "orders_rds" {
  source  = "terraform-aws-modules/rds-aurora/aws"
  version = "7.7.1"

  name           = "${var.environment_name}-orders"
  engine         = "aurora-postgresql"
  engine_version = "15.10"
  instance_class = "db.t3.medium"

  instances = {
    one = {}
  }

  vpc_id  = var.vpc_id
  subnets = var.subnet_ids

  allowed_security_groups = concat(var.allowed_security_group_ids, [var.orders_security_group_id])

  master_password        = random_string.orders_db_master.result
  create_random_password = false
  database_name          = "orders"
  storage_encrypted      = true
  apply_immediately      = true
  skip_final_snapshot    = true

  create_db_parameter_group = true
  db_parameter_group_name   = "${var.environment_name}-orders"
  db_parameter_group_family = "aurora-postgresql15"

  create_db_cluster_parameter_group = true
  db_cluster_parameter_group_name   = "${var.environment_name}-orders"
  db_cluster_parameter_group_family = "aurora-postgresql15"

  tags = var.tags
}

resource "stackit_postgresflex_instance" "dependencies_orders_rds_this" {
  project_id = var.project_id
  name       = "retail-store-ecs-orders"
  version    = "15"
  flavor_id  = "2.4"
  storage = {
    class = var.postgresflex_storage_class
    size  = var.orders_rds_storage_size
  }
  backup_schedule = "0 2 * * *"
  network = {
    acl          = coalescelist(var.orders_rds_allowed_cidrs, stackit_ske_cluster.retail_app_ecs_cluster.egress_address_ranges)
    access_scope = var.orders_rds_access_scope == "SNA" ? "SNA" : null
  }
  retention_days = 32
}

• Engine and version carried over

  aurora-postgresql 15 becomes a PostgreSQL Flex instance on version 15, named after the source.

• Network access derived from the graph

  By default, the database ACL comes from the egress ranges of the SKE cluster that replaces the ECS services, so only the workloads reach it.

• Values to decide become variables

  Storage class and size are inputs with a stated origin, never invented defaults. Your team fills them once, and the next run reads them.

• Every attribute accounted for

  Of the 27 meaningful attributes set on this Aurora cluster, each one is consumed, mapped to a STACKIT contract or named as not carried over. None is left unaccounted.

How the conversion works

1. 01

   Resolve the estate

   Root modules, child modules from the Terraform Registry, variables and count or for_each expansions become one dependency graph.

2. 02

   Decide per resource

   A versioned rule base gives each resource a STACKIT target and a migration class, based on its actual configuration.

3. 03

   Write STACKIT code

   Files per domain: network, data, identity, Kubernetes, load balancing, messaging, security and observability, plus variables and provider pins.

4. 04

   Validate and trace

   Static validation with OpenTofu against the pinned STACKIT provider, and trace IDs from the STACKIT code back to each source resource.

What lands in terraform/

The STACKIT Terraform of the Retail Store run, organized the way a platform team maintains it.

network.tf

STACKIT networks for the former VPC and subnets

data.tf

PostgreSQL Flex, MariaDB, Key Value Store, OpenSearch and MongoDB Flex

kubernetes.tf

The SKE cluster and node pool for the ECS workloads

identity.tf

Service accounts and role assignments for the former IAM roles

loadbalancing.tf

STACKIT Application Load Balancer

messaging.tf

STACKIT RabbitMQ for Amazon MQ

security.tf

Security groups and rules

observability.tf

STACKIT Logs

variables.tf

Every value your team decides, with its origin

terraform.tf

Pinned STACKIT provider

Questions platform teams ask

Sources

• STACKIT Docs: Terraform provider
• STACKIT Docs: Developer Tools
• STACKIT Docs: Kubernetes Engine (SKE)
• STACKIT Docs: PostgreSQL Flex