Huawei Cloud VPC, subnets, NAT and security groups on STACKIT

The NAT gateway and its EIP, assessed

Left: the input, written for this page. Right: an excerpt of assessment.json for the NAT gateway, values exactly as the run wrote them. The NAT gateway is the one unit of the estate the run does not map.

resource "huaweicloud_nat_gateway" "egress" {
  name        = "billing-egress"
  spec        = "2"
  vpc_id      = huaweicloud_vpc.main.id
  subnet_id   = huaweicloud_vpc_subnet.data.id
  description = "Outbound internet for the data tier"
}

resource "huaweicloud_vpc_eip" "gateway" {
  publicip {
    type = "5_bgp"
  }
  bandwidth {
    share_type  = "PER"
    name        = "billing-egress"
    size        = 20
    charge_mode = "traffic"
  }
}

{
  "id": "huaweicloud_nat_gateway.egress",
  "result": {
    "class": "MANUAL_REVIEW",
    "confidence": "LOW",
    "reason": "NAT gateway rules do not carry over one to one. Whether the egress and any published port need a STACKIT network with a public address, or a NAT appliance on a server, is an architect's decision."
  }
}

• MANUAL_REVIEW, LOW confidence

  The run states that NAT gateway rules do not carry over one to one and names the two candidate designs: a STACKIT network with a public address, or a NAT appliance on a server.

• The EIP is mapped

  The EIP unit is classified RECONFIGURE with STACKIT public IP as target. The run states that the address itself changes, so DNS records and allow lists that name it change too. The bandwidth settings (size 20, traffic charge mode) are listed for your team, not carried.

• Five settings are listed

  description, name, spec, subnet_id and vpc_id of the NAT gateway are listed as settings left to you, so nothing is dropped silently.

How the network estate maps

The 11 resources of the demo became 8 units: the three security group rules are carried inside their two security group units. The run found no HIGH confidence unit, because the provider was not pinned by a lock file.

Where Huawei Cloud and STACKIT behave differently

Huawei column from the Huawei Cloud security group help page and, for the NAT gateway, the Huawei NAT Gateway page on SNAT rules; the VPC CIDR and the EIP bandwidth come from the demo input. STACKIT column from the STACKIT concepts pages listed under sources.

Security group rules: what the run says and what it leaves

The data tier group has two rules: PostgreSQL from the web group, and SSH from an office range. The run keeps both inside the group unit, rates it LOW and warns separately that the rule resources themselves are catalogued but not mapped. Right: the unit's class, target and reason from assessment.json.

resource "huaweicloud_networking_secgroup" "data" {
  name        = "billing-data"
  description = "Data tier"
}

resource "huaweicloud_networking_secgroup_rule" "data_from_web" {
  security_group_id = huaweicloud_networking_secgroup.data.id
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  ports             = "5432"
  remote_group_id   = huaweicloud_networking_secgroup.web.id
}

resource "huaweicloud_networking_secgroup_rule" "data_ssh_office" {
  security_group_id = huaweicloud_networking_secgroup.data.id
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  ports             = "22"
  remote_ip_prefix  = "198.51.100.0/24"
}

{
  "id": "huaweicloud_networking_secgroup.data",
  "result": {
    "class": "RECONFIGURE",
    "confidence": "LOW",
    "target": {
      "service": "STACKIT security groups"
    },
    "reason": "A security group becomes a STACKIT security group. STACKIT rules only allow traffic, so a deny rule or a priority order of the source needs a decision."
  }
}

• LOW confidence is the honest value

  The group is mapped, the rules are catalogued but not mapped. Ports, protocol, direction, remote_group_id and remote_ip_prefix are listed as settings left to you.

• A group reference stays a group reference

  The PostgreSQL rule names the web group as its source. On STACKIT a security group rule can match a remote security group instead of an IP range (remote_security_group_id in the STACKIT Terraform provider), so the web group must exist first. The run orders it that way: the data group depends on the web group.

• Review every source CIDR

  The SSH rule allows an office range. Decide on STACKIT whether that path still exists or whether administration moves behind a bastion or the Network Area.

The order the run proposes

The three waves are computed from dependencies. Units in one wave can move in parallel; the plan is a starting point for your wave plan, not a schedule.

1. 01

   Wave 1: VPC, web security group, EIP

   The three units with no dependency. The run groups the manual work of the estate into four packages: foundation (VPC, both subnets, NAT gateway), security (both groups) and the EIP go to the Network Architect, the server package to the Platform Architect.

2. 02

   Wave 2: both subnets and the data security group

   The subnets wait for the VPC, the data group waits for the web group it refers to.

3. 03

   Wave 3: the server and the NAT gateway

   The ECS instance waits for its subnet and group. The NAT gateway waits for the VPC and the data subnet, and carries the open decision.

4. 04

   Cutover

   The run states that it found no DNS record set or address re-binding in this estate. That is not a statement that nothing needs cutting over: names and addresses outside the scanned Terraform are not seen.

Sequencing as the run wrote it

The waves of this estate, verbatim from the run's migration plan.

## Wave 1 — 3 unit(s)

| Unit | Class | Target |
|---|---|---|
| `huaweicloud_networking_secgroup.web` | RECONFIGURE / LOW | STACKIT security groups |
| `huaweicloud_vpc.main` | RECONFIGURE / MEDIUM | STACKIT network |
| `huaweicloud_vpc_eip.gateway` | RECONFIGURE / MEDIUM | STACKIT public IP |

## Wave 2 — 3 unit(s)

| Unit | Class | Target |
|---|---|---|
| `huaweicloud_networking_secgroup.data` | RECONFIGURE / LOW | STACKIT security groups |
| `huaweicloud_vpc_subnet.data` | RECONFIGURE / MEDIUM | STACKIT network |
| `huaweicloud_vpc_subnet.web` | RECONFIGURE / MEDIUM | STACKIT network |

## Wave 3 — 2 unit(s)

| Unit | Class | Target |
|---|---|---|
| `huaweicloud_compute_instance.web` | RECONFIGURE / MEDIUM | STACKIT Compute Engine |
| `huaweicloud_nat_gateway.egress` | MANUAL_REVIEW / LOW | — |

## Cutover (decision support — performed by the customer)

No cutover facts: the scan and the draft established no DNS record set whose value the draft re-binds to a generated address, no public address re-binding, no DNS record unit, no certificate unit and no open cutover decision. That is not a statement that nothing has to be cut over: a name, an address or a certificate outside the scanned source is not seen, and a unit that exists only if OpenTofu decides so at plan time is not read here. StackToIT performs no cutover and gives no time estimate.

Questions network teams ask

Sources

• STACKIT Docs: security groups, concepts
• STACKIT Docs: virtual networks, concepts
• STACKIT Docs: Network Area, concepts
• STACKIT Docs: public IP addresses, concepts
• Huawei Cloud Help Center: security groups
• STACKIT Terraform provider 0.121.0: security group rule
• Huawei Cloud NAT Gateway: SNAT rule to share an EIP