ENDE
Discuss a Pilot

AWS Retail Store Sample App

Explore how StackToIT analyzed the AWS Retail Store Sample App and generated a structured migration assessment, proposed STACKIT infrastructure, architecture diagrams and a detailed migration plan.

AWS → STACKIT · assessed 2026-11-02 · StackToIT 0.6.0-11562-g1966ddf116 · knowledge base 0.384.0

View Full AssessmentBrowse the Terraform draft

Route
AWS STACKIT
Status
Migration assessment generated
Resources analyzed
282
Migration units identified
44
Target units drafted
38 of 52 considered
Original AWS source AWS Containers (aws-containers) / retail-store-sample-app Assessed commit d7a380b843e0 · root terraform/ecs/default · link above: current main
StackToIT generated outputs stacktoit-examples / examples / aws-retail-store assessment, STACKIT Terraform draft, architecture and migration decisions, published as the run wrote them · link: current main

Overview

A five-service retail application on Amazon ECS: Aurora, DynamoDB, OpenSearch, ElastiCache and Amazon MQ behind an Application Load Balancer. StackToIT read the ECS Terraform estate and wrote a STACKIT migration package.

Resources read282
Migration units44 + 8 decided at plan time
Files · module calls105 files · 23 calls (13 registry, 10 local)
Package statePartially executable migration package

What stood out

  1. Nothing is DIRECT

    All 44 present units need at least a reconfiguration: 34 RECONFIGURE, 9 REPLATFORM (ECS → SKE, Aurora → MariaDB/PostgreSQL Flex, OpenSearch), 1 REDESIGN (DynamoDB has no STACKIT counterpart; MongoDB Flex or PostgreSQL JSONB are the named options).

  2. The source provider is unpinned, so the source was not validated

    The upstream estate commits no .terraform.lock.hcl. StackToIT caps every unit at MEDIUM confidence, marks none automation-eligible, and does not run OpenTofu validation on the source, with or without a provider mirror, because no lock file states which provider version to validate against. It names the two remedies (commit a lock file with aws 5.100.0, or raise the constraint to ~> 6.0 and lock 6.67.0); only a lock file and a source validation show that either works.

  3. Catalog is deployment-blocked

    The catalog service depends on OpenSearch 3.3; the STACKIT region offers version 2. The draft stays blocked until a test shows the application works on that version or an architecture decision is recorded.

  4. Four STACKIT API steps wait for an opt-in

    Secrets Manager steps call a pre-release STACKIT API. The plan does not make the calls until the customer allows them in the decisions file; this is the first required action of the run.

  5. No cost comparison is stated

    The source does not name its AWS region, so no AWS price was fetched. 5 of 14 STACKIT lines are priced (878.34 EUR partial, list prices); the report refuses to call a one-sided subtotal a saving.

Source infrastructure

The retail-store-sample-app by AWS Containers is a sample retail application: five services (ui, catalog, carts, checkout, orders) on Amazon ECS behind an Application Load Balancer, with Aurora (catalog, orders), DynamoDB (carts), OpenSearch (catalog), ElastiCache (checkout) and Amazon MQ as managed dependencies in one VPC. The estate assessed is its terraform/ecs/default root module and the local terraform/lib modules it calls.

Repositoryhttps://github.com/aws-containers/retail-store-sample-app
Commitd7a380b843e0759e58754f74188ea18252a51415
Terraform rootterraform/ecs/default
Infrastructure codeTerraform (OpenTofu-readable)
Registry modules13 registry modules resolved by OpenTofu on 2026-10-26 (terraform-aws-modules, cloudposse)
Upstream licenceMIT-0 (upstream LICENSE)

The estate was assessed exactly as published upstream: nothing in it was edited. It ships no .terraform.lock.hcl. Because of that the source provider is UNPINNED and the OpenTofu validation of the source did not run, even with a provider mirror prepared beforehand: StackToIT validates a source only against the provider versions its lock file records, and will not pick one for it.

Source visibility as read by StackToIT: Partial runtime topology — 8 units have a count/for_each decided only when OpenTofu plans. Domains of the 44 units: network 16, identity 15, compute 6, data 5, observability 1, messaging 1.

Assessment summary

Classification of the 44 units present in the source, as the knowledge base 0.384.0 decided them. The strip shows the share of each class; the legend keeps the classes with zero units so that what did not happen is visible too.

  • 0 DIRECT same service, same settings
  • 34 RECONFIGURE same kind of service, settings change
  • 9 REPLATFORM a different managed service
  • 0 CONTAINERIZE packaged into a container first
  • 1 REDESIGN no counterpart; the architecture changes
  • 0 MANUAL_REVIEW a person decides
  • 0 BLOCKED cannot move as it stands
Confidence0 HIGH · 35 MEDIUM · 9 LOW capped at MEDIUM: the source provider is unpinned
Units the draft considered52 = 44 present + 8 decided when OpenTofu plans
Fate of those units38 generated (34 Terraform-only, 4 hybrid) · 11 need no resource · 3 left to the architect

Applications

5 applications proposed by StackToIT from the service structure, none confirmed by a customer: 0 ready · 1 blocked · 2 redesign · 2 not ready.

ApplicationStateWhy
cartsREDESIGNDynamoDB table is a REDESIGN (MongoDB Flex, data-model change)
catalogBLOCKEDOpenSearch engine downgrade 3.3 → 2 until tested or decided
checkoutREDESIGNshares the DynamoDB redesign; TLS-only Valkey endpoint for ElastiCache clients
ordersNOT READYenvironment values required; workload identity undecided
uiNOT READYworkload identity undecided; functional check not run

Cost

Financial comparisonNOT AVAILABLE
STACKIT partial estimate878.34 EUR / month 5 of 14 lines priced, list prices, not a bill
Source lines priced0 of 30
Price sourceStackToIT price cache (STACKIT list prices retrieved 2026-10-26); AWS prices not fetched because the region is not stated in the source

Source region unknown (30 AWS lines wait for source.aws.region); 9 of 14 STACKIT lines have no price; 10 billable source resources are outside the model.

Architecture

Three views StackToIT draws from the same graph: the source as read, the proposed STACKIT target, and the delta between them. The Mermaid sources are published beside the renderings.

Current (AWS, as read)SVGMermaid
Current architecture diagram of the AWS estate as StackToIT read it
Target (STACKIT, proposed)SVGMermaid
Proposed STACKIT target architecture diagram
Delta (what changes)SVGMermaid
Delta diagram between the AWS source and the STACKIT target

Also in the package: data flows, dependencies (Mermaid only), identity (Mermaid only), network security.

Migration readiness

StackToIT states readiness as three measures with their denominators and lists what closes each open item. On this estate the package is Partially executable migration package; the full register is in the report.

ApprovalNOT READY FOR APPROVAL Live verificationNever applied to STACKIT — no plan was run against a live project

Three measures, not one

Automated steps that can run now48 of 571 waits for a manual prerequisite · 8 require a design decision · 9 of the 48 rest on a default nobody confirmed · 0 approved
Automation-eligible units0 of 4417 more become eligible once their open items are answered · 27 cannot be automated in this build
Critical settings resolved36 of 319the rest are listed with an owner and the condition that closes them

The plan, step by step

Plan steps314
Terraform steps49
STACKIT API steps4 4 wait for an opt-in
Manual steps254 114 can start now
Lifecycle steps (cutover, verify, retire)84
Refused3 cannot be carried out whatever is decided
Not runnable now147
Decisions to make16 8 draft defaults to confirm

8 unanswered decisions rest on a draft default (public endpoint 5, size derived from the source 3); the register groups them in 2 records.

Open decisions and inputs

First required actionAllow the calls of STACKIT APIs that are not generally available (Secrets Manager v1) — Owner: Platform Architect
Open input requests47 14 block parts of the draft

The full register is the report's Decisions page; the answer files a customer would fill in are published unanswered under review/. The executive brief restates every figure above with its owner and closing condition.

Generated infrastructure

The STACKIT Terraform draft as StackToIT wrote it: 38 of the 52 units the draft considered (44 present in the source, 8 decided only when OpenTofu plans) have a generated resource; 11 need none and 3 are left to the architect. 60 variables. OpenTofu static validation PASSED. It is a draft for an architect, validated against the provider schema, never planned against a live project. Each file opens in a read-only viewer; the raw file is linked from there.

Plans and documents

The execution package under execution/ holds the Terraform apply notes, the STACKIT API scripts and the manual actions; migration/ holds the waves, work packages and data-movement plan as CSV, Markdown and JSON.

Full assessment

The Migration Intelligence Workspace is the HTML report StackToIT writes beside its files. Its content is published here unchanged, under one added navigation bar; every link inside it resolves within the package.

View Full Assessment

Pages of the report

Provenance

Commandstacktoit assess terraform/ecs/default ./aws-retail-store --provider-mirror /path/to/mirrorRun from the vendored copy of the upstream repository. A local OpenTofu provider mirror (hashicorp/aws 5.100.0, the version the constraints resolve to) was prepared first with `tofu providers mirror`, as the first run's console suggested; the source validation still did not run because the source has no lock file. The output directory is this example's output/ folder, unchanged.
Verificationstacktoit verify ./aws-retail-storeVERIFIED — 143 files match manifest.json (size and SHA-256); 7 of 7 checks PASS
StackToIT0.6.0-11562-g1966ddf116 commit 1966ddf116
Knowledge base0.384.0 sha256 fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9
Assessment schema · OpenTofu0.24.0 · 1.13.1
Runf6267c3f-2848-4aa5-89df-5fee8b15b3b9 2026-11-02T12:08:24Z
Source digestsha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70
Modeonline (default options; a local OpenTofu provider mirror with hashicorp/aws 5.100.0 was prepared beforehand as the console suggests; prices from the local price cache retrieved 2026-10-26)

What has been established, and what has not

CheckStateScope
Source completenessPARTIALsource status RUNTIME_TOPOLOGY_PARTIAL: 8 unit(s) have a count/for_each that is not known statically; whether and how often they exist is decided at plan time
Source providerUNPINNEDaws constraints ~> 5.0, tested against 5.100.0; No lock file entry pins this provider, so the version a plan would use is not proven; the knowledge base was checked against one version only. Until the exact version is pinned (commit .terraform.lock.hcl), the units of this provider are capped at MEDIUM confidence and are not automation eligible.
Source validation (OpenTofu)NOT_RUNLOCK_FILE — the source has no dependency lock file (.terraform.lock.hcl), so provider identity and integrity cannot be verified; the validation never updates it (Provider dependency changes detected). No validation result exists; this is neither a pass nor a failure of the source.
Draft generationGENERATEDthe draft is in terraform/
Draft checks (StackToIT)PASSED100 checks, none found a violation
Global invariantsPASSED12 of 12 invariants PASS
Draft validation (OpenTofu)PASSEDtofu init -backend=false and tofu validate accepted the draft; tofu 1.13.1 — static validation of the draft against the pinned provider schema — not target behaviour, not approval
Run folder (stacktoit verify)VERIFIED143 files match manifest.json; EVIDENCE, SCHEMA, RUN_ID, BASIS, INPUTS_DIGEST, INVALIDATION_KEYS, EXECUTION_PLAN PASS
Stackit PlanNOT_RUNthis build runs no plan against a STACKIT project
Architect ApprovalNOT_PROVIDEDno review decision is recorded for this run
Semantic EquivalenceNOT_ASSESSEDthis build has no measure for it
Safe To ApplyNOT_ASSERTEDStackToIT never asserts it

Publication

The output folder is published exactly as StackToIT wrote it. No file was removed, edited or redacted; stacktoit verify passes on the published copy.

Files published147
Files in manifest.json142
Outside the manifestmanifest.json, review/applications.yaml, review/decisions.yaml, review/inputs.yaml, review/progress.yamlreview/ is the customer's answer area the run writes beside its files; it is excluded from the manifest by design. manifest.json lists every other file.
Excluded for publicationnone
Modified for publicationnone
Metadataexample.json · schema

Planning a migration to STACKIT?

Let's explore how StackToIT can help assess your infrastructure and prepare a structured migration plan.

Discuss a Pilot connect@stacktoit.com