The complete Oracle Cloud to STACKIT migration guide

The migration in nine steps

Each step names the file of the run that holds the answer.

1. 01

   1. Collect the Terraform

   Gather every root module that declares Oracle Cloud resources. StackToIT reads Terraform and OpenTofu and does not connect to your tenancy.

2. 02

   2. Run the assessment

   One command produces the whole package. The console summary tells you how many units there are and what is left to people.

3. 03

   3. Read the architect report

   engineering/architect-report.md gives each unit a class, a confidence, a target and the reason, with the settings left to you.

4. 04

   4. Fix the owners and decisions

   execution/manual/actions.md and migration/work-packages.csv name an owner role per package. review/decisions.yaml and inputs.yaml take your answers.

5. 05

   5. Build the landing zone

   STACKIT organisation, projects and the network come first. Network units sit in the early waves.

6. 06

   6. Build in waves

   migration/technical-sequencing.md orders the units by dependency. Units of one wave can move in parallel.

7. 07

   7. Move the data

   migration/data-movement.md lists every stateful unit and the decisions still open. Choose a mechanism per unit.

8. 08

   8. Cut over

   Switch clients to the new endpoints and credentials, with the source kept as the way back.

9. 09

   9. Retire the source

   Verify the target, then switch off the OCI resources, in reverse dependency order.

Step 2: run the assessment

A mixed demo estate written for this guide: a VCN with two private subnets, a network security group, a compute instance with a block volume, a load balancer, a PostgreSQL DB system, a bucket, a cache cluster and an IAM policy. The run is from 4 November 2026. The first pane is the command as it was run, from inside the demo's input folder; the other panes are lines copied from the console output of that run: the source line, the target lines and the class counts.

# run from inside the demo's input folder; the output folder sits next to it
stacktoit assess . ../out --offline --no-validate

Source        11 resources · 11 units · visibility: Complete

TARGET
Migration     0 drafted · 11 manual (of 11 units the draft considered)

DIRECT              0  
RECONFIGURE         9  ████████████████████████ 81%
REPLATFORM          1  ██ 9%
CONTAINERIZE        0  
REDESIGN            0  
MANUAL_REVIEW       1  ██ 9%

• 11 resources, 11 units

  Every resource is its own unit here. Nine are RECONFIGURE, one is REPLATFORM and one is MANUAL_REVIEW. Ten carry MEDIUM confidence and one, the IAM policy, LOW.

• Nothing drafted, and said so

  The console reports 0 drafted and 11 manual. For an Oracle estate this build writes no STACKIT resource block; the value is the assessment, the order and the work packages.

• Offline and unvalidated

  The run used --offline and --no-validate, so the source was checked by built-in checks only. With a lock file and a provider mirror you can add OpenTofu validation of the source.

Step 3: how the estate maps

Classes as the run decided them: nine units RECONFIGURE (the two subnets share a row), one REPLATFORM, one MANUAL_REVIEW.

Reading a unit: the compute instance

The compute instance as written (lines 54 to 74 of main.tf) and the result the run recorded for it, an excerpt of assessment.json with the values exactly as the run wrote them. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged.

resource "oci_core_instance" "web" {
  compartment_id      = var.compartment_id
  availability_domain = var.availability_domain
  display_name        = "web-01"
  shape               = "VM.Standard.E5.Flex"

  shape_config {
    ocpus         = 2
    memory_in_gbs = 16
  }

  source_details {
    source_type = "image"
    source_id   = var.image_id
  }

  create_vnic_details {
    subnet_id = oci_core_subnet.app.id
    nsg_ids   = [oci_core_network_security_group.app.id]
  }
}

[
  {
    "id": "oci_core_instance.web",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT Compute Engine"
      },
      "reason": "A compute instance becomes a STACKIT server. The shape becomes a STACKIT flavor, the image is rebuilt or imported, and the attached volumes and network interfaces move with it."
    }
  }
]

• The shape becomes a flavor

  The instance runs the shape VM.Standard.E5.Flex with 2 OCPUs and 16 GB. On STACKIT the shape becomes a flavor, and the image is rebuilt or imported.

• Attached things move with it

  Volumes and network interfaces are part of the server’s move, which is why the instance waits for the subnet and the group.

Reading a unit: database and bucket

The PostgreSQL DB system as written (lines 96 to 120 of main.tf), and the result for it and for the bucket, an excerpt of assessment.json with the values exactly as the run wrote them. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged.

resource "oci_psql_db_system" "orders" {
  compartment_id = var.compartment_id
  display_name   = "orders"
  db_version     = "16"
  shape          = "PostgreSQL.VM.Standard.E5.Flex.2.32GB"
  instance_count = 2

  network_details {
    subnet_id = oci_core_subnet.data.id
  }

  storage_details {
    is_regionally_durable = true
    system_type           = "OCI_OPTIMIZED_STORAGE"
  }

  credentials {
    username = "orders_admin"

    password_details {
      password_type = "PLAIN_TEXT"
      password      = "change-me"
    }
  }
}

[
  {
    "id": "oci_psql_db_system.orders",
    "result": {
      "class": "REPLATFORM",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT PostgreSQL Flex"
      },
      "reason": "Managed PostgreSQL to managed PostgreSQL: data moves with pg_dump/pg_restore or logical replication, and the shape becomes a Flex flavor."
    }
  },
  {
    "id": "oci_objectstorage_bucket.media",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT Object Storage"
      },
      "reason": "A bucket becomes a STACKIT Object Storage bucket with an S3 API. Clients change endpoint and credentials; lifecycle, replication and access rules are rewritten."
    }
  }
]

• Managed to managed

  The database is the only REPLATFORM unit. The run points to pg_dump and pg_restore or logical replication, and says the shape becomes a Flex flavor.

• Buckets change endpoint

  A bucket gets an S3 API on STACKIT. Clients change endpoint and credentials, and lifecycle, replication and access rules are rewritten.

Step 6: the waves

The run orders the eleven units into three waves from their dependencies.

1. 01

   Wave 1

   The VCN, the block volume, the IAM policy and the bucket: the units that depend on nothing.

2. 02

   Wave 2

   The security group and the two subnets.

3. 03

   Wave 3

   The instance, the load balancer, the PostgreSQL DB system and the cache cluster, which need the network.

Steps 4 and 7: the decisions you own

The run proposes. These items stay with people, and the run says so.

• Four data units, no mechanism

  The volume, the bucket, the database and the cache are stateful. Their mechanism is UNKNOWN, with the data class, the recovery point and the downtime tolerance not provided.

• Seven work packages, five roles

  The 11 manual steps fall into 7 packages with owners: Network Architect, Identity Architect, Data Architect, Storage Architect and Platform Architect. Each package can be started now.

• The public address changes

  The load balancer’s listeners, backends and certificates are rewritten, and its public address changes. DNS and client allow-lists are yours.

• Reachability is designed

  On STACKIT a network reaches the internet outbound through source NAT, and inbound reachability needs a public IP address. The public or private role of each subnet is reviewed.

• Identity is rebuilt

  The OCI policy has no document-level counterpart. People and workloads are mapped to STACKIT roles and service accounts.

Questions migration leads ask

Sources

• STACKIT: Network Area, concepts
• STACKIT: Security groups, concepts
• STACKIT: Virtual Network, concepts
• Oracle Cloud Infrastructure: Networking overview
• Oracle Cloud Infrastructure: Network security groups