identity.mmd
Part of the StackToIT package, published unchanged. A file of a proposal: nothing here is approved or applied.
%% PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.
%% Run `f6267c3f-2848-4aa5-89df-5fee8b15b3b9` · source digest `sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70`
%% What this view is: the identity transition of each AWS principal: the principal, the migration decision (the class and confidence the assessment gives it and the decisions the plans list for it), the STACKIT identity the plans draft, the role assignment and the scope of the target resource.
%% The plans hold no role assignment of their own: the step is drawn as drafted where a block of the draft assigns a role to the STACKIT identity, with the role (the draft supplies it by a variable the architect fills: an AWS action is not translated into a STACKIT role), the scope, the AWS policies it replaces and what it grants beyond them, all taken from the record the converter makes of that block; it is drawn as manual (a person chooses the roles) where neither a plan nor the draft holds one, and the roles and the scope are UNKNOWN (dashed) where the record of a drafted block states none. The manual actions the identity plan states are drawn either way. A principal no plan holds a STACKIT identity for is a dashed edge with the plan's reason; the draft may still write one that the plans do not type, and the box names the service the assessment proposes.
%% A thin arrow is a reference or a hand-over; a thick arrow is a path the plan permits; a dashed arrow is UNKNOWN; an orange arrow is MANUAL. assurance/identity-transition.md holds the credential and federation facts of each principal.
flowchart LR
subgraph g_principal["AWS principal"]
n_module_retail_app_ecs_module_carts_service_aws_iam_role_task_execution_role["module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role<br/><small>aws_iam_role</small>"]:::unit
n_module_retail_app_ecs_module_carts_service_aws_iam_role_task_role["module.retail_app_ecs.module.carts_service.aws_iam_role.task_role<br/><small>aws_iam_role</small>"]:::unit
n_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_execution_role["module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role<br/><small>aws_iam_role</small>"]:::unit
n_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_role["module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role<br/><small>aws_iam_role</small>"]:::unit
n_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_execution_role["module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role<br/><small>aws_iam_role</small>"]:::unit
n_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_role["module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role<br/><small>aws_iam_role</small>"]:::unit
n_module_retail_app_ecs_module_orders_service_aws_iam_role_task_execution_role["module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role<br/><small>aws_iam_role</small>"]:::unit
n_module_retail_app_ecs_module_orders_service_aws_iam_role_task_role["module.retail_app_ecs.module.orders_service.aws_iam_role.task_role<br/><small>aws_iam_role</small>"]:::unit
n_module_retail_app_ecs_module_ui_service_aws_iam_role_task_execution_role["module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role<br/><small>aws_iam_role</small>"]:::unit
n_module_retail_app_ecs_module_ui_service_aws_iam_role_task_role["module.retail_app_ecs.module.ui_service.aws_iam_role.task_role<br/><small>aws_iam_role</small>"]:::unit
end
subgraph g_decision["Migration decision"]
n_decision_module_retail_app_ecs_module_carts_service_aws_iam_role_task_execution_role["decision: RECONFIGURE · MEDIUM"]:::synthetic
n_decision_module_retail_app_ecs_module_carts_service_aws_iam_role_task_role["decision: RECONFIGURE · LOW"]:::synthetic
n_decision_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_execution_role["decision: RECONFIGURE · LOW"]:::synthetic
n_decision_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_role["decision: RECONFIGURE · MEDIUM"]:::synthetic
n_decision_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_execution_role["decision: RECONFIGURE · MEDIUM"]:::synthetic
n_decision_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_role["decision: RECONFIGURE · LOW"]:::synthetic
n_decision_module_retail_app_ecs_module_orders_service_aws_iam_role_task_execution_role["decision: RECONFIGURE · LOW"]:::synthetic
n_decision_module_retail_app_ecs_module_orders_service_aws_iam_role_task_role["decision: RECONFIGURE · MEDIUM"]:::synthetic
n_decision_module_retail_app_ecs_module_ui_service_aws_iam_role_task_execution_role["decision: RECONFIGURE · MEDIUM"]:::synthetic
n_decision_module_retail_app_ecs_module_ui_service_aws_iam_role_task_role["decision: RECONFIGURE · MEDIUM"]:::synthetic
end
subgraph g_identity["STACKIT identity"]
n_stackit_service_account_retail_app_ecs_carts_service_task_execution_role["stackit_service_account.retail_app_ecs_carts_service_task_execution_role<br/><small>stackit_service_account</small>"]:::unit
n_stackit_service_account_retail_app_ecs_carts_service_task_role["stackit_service_account.retail_app_ecs_carts_service_task_role<br/><small>stackit_service_account</small>"]:::unit
n_stackit_service_account_retail_app_ecs_catalog_service_task_execution_role["stackit_service_account.retail_app_ecs_catalog_service_task_execution_role<br/><small>stackit_service_account</small>"]:::unit
n_stackit_service_account_retail_app_ecs_catalog_service_task_role["stackit_service_account.retail_app_ecs_catalog_service_task_role<br/><small>stackit_service_account</small>"]:::unit
n_stackit_service_account_retail_app_ecs_checkout_service_task_execution_role["stackit_service_account.retail_app_ecs_checkout_service_task_execution_role<br/><small>stackit_service_account</small>"]:::unit
n_stackit_service_account_retail_app_ecs_checkout_service_task_role["stackit_service_account.retail_app_ecs_checkout_service_task_role<br/><small>stackit_service_account</small>"]:::unit
n_stackit_service_account_retail_app_ecs_orders_service_task_execution_role["stackit_service_account.retail_app_ecs_orders_service_task_execution_role<br/><small>stackit_service_account</small>"]:::unit
n_stackit_service_account_retail_app_ecs_orders_service_task_role["stackit_service_account.retail_app_ecs_orders_service_task_role<br/><small>stackit_service_account</small>"]:::unit
n_stackit_service_account_retail_app_ecs_ui_service_task_execution_role["stackit_service_account.retail_app_ecs_ui_service_task_execution_role<br/><small>stackit_service_account</small>"]:::unit
n_stackit_service_account_retail_app_ecs_ui_service_task_role["stackit_service_account.retail_app_ecs_ui_service_task_role<br/><small>stackit_service_account</small>"]:::unit
end
subgraph g_assignment["Role assignment"]
n_assignment_module_retail_app_ecs_module_carts_service_aws_iam_role_task_execution_role["role assignment<br/>drafted: stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role<br/>role decided by var.retail_app_ecs_carts_service_task_execution_role_project_roles (no default) @ project<br/>source AWS policy: arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]:::unit
n_assignment_module_retail_app_ecs_module_carts_service_aws_iam_role_task_role["role assignment<br/>drafted: stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role<br/>role decided by var.retail_app_ecs_carts_service_task_role_project_roles (no default) @ project<br/>source AWS policy: module.dependencies.aws_iam_policy.carts_dynamo, module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_logs, module.retail_app_ecs.module.carts_service.aws_iam_policy.ecs_exec<br/>not readable: module.dependencies.aws_iam_policy.carts_dynamo (Statement(0).Resource is not known statically (runtime-data)), module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_logs (Statement(0).Resource is not known statically (runtime-data)) (what it grants is not fully known, so what this widens may be more than shown)"]:::unit
n_assignment_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_execution_role["role assignment<br/>drafted: stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role<br/>role decided by var.retail_app_ecs_catalog_service_task_execution_role_project_roles (no default) @ project<br/>source AWS policy: arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy, module.retail_app_ecs.aws_iam_policy.catalog_policy<br/>not readable: module.retail_app_ecs.aws_iam_policy.catalog_policy (module.retail_app_ecs.data.aws_iam_policy_document.catalog_db_secret names statement.resources reads ( aws_secretsmanager_secret.catalog_db.arn, aws_secretsmanager_secret.catalog_opensearch.arn, aws_kms_key.cmk.arn ), which is not known statically) (what it grants is not fully known, so what this widens may be more than shown)"]:::unit
n_assignment_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_role["role assignment<br/>drafted: stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role<br/>role decided by var.retail_app_ecs_catalog_service_task_role_project_roles (no default) @ project<br/>source AWS policy: module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_logs, module.retail_app_ecs.module.catalog_service.aws_iam_policy.ecs_exec<br/>not readable: module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_logs (Statement(0).Resource is not known statically (runtime-data)) (what it grants is not fully known, so what this widens may be more than shown)"]:::unit
n_assignment_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_execution_role["role assignment<br/>drafted: stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role<br/>role decided by var.retail_app_ecs_checkout_service_task_execution_role_project_roles (no default) @ project<br/>source AWS policy: arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]:::unit
n_assignment_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_role["role assignment<br/>drafted: stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role<br/>role decided by var.retail_app_ecs_checkout_service_task_role_project_roles (no default) @ project<br/>source AWS policy: module.dependencies.aws_iam_policy.carts_dynamo, module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_logs, module.retail_app_ecs.module.checkout_service.aws_iam_policy.ecs_exec<br/>not readable: module.dependencies.aws_iam_policy.carts_dynamo (Statement(0).Resource is not known statically (runtime-data)), module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_logs (Statement(0).Resource is not known statically (runtime-data)) (what it grants is not fully known, so what this widens may be more than shown)"]:::unit
n_assignment_module_retail_app_ecs_module_orders_service_aws_iam_role_task_execution_role["role assignment<br/>drafted: stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role<br/>role decided by var.retail_app_ecs_orders_service_task_execution_role_project_roles (no default) @ project<br/>source AWS policy: arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy, module.retail_app_ecs.aws_iam_policy.orders_policy<br/>not readable: module.retail_app_ecs.aws_iam_policy.orders_policy (module.retail_app_ecs.data.aws_iam_policy_document.orders_db_secret names statement.resources reads ( aws_secretsmanager_secret.orders_db.arn, aws_secretsmanager_secret.mq.arn, aws_kms_key.cmk.arn ), which is not known statically) (what it grants is not fully known, so what this widens may be more than shown)"]:::unit
n_assignment_module_retail_app_ecs_module_orders_service_aws_iam_role_task_role["role assignment<br/>drafted: stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role<br/>role decided by var.retail_app_ecs_orders_service_task_role_project_roles (no default) @ project<br/>source AWS policy: module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_logs, module.retail_app_ecs.module.orders_service.aws_iam_policy.ecs_exec<br/>not readable: module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_logs (Statement(0).Resource is not known statically (runtime-data)) (what it grants is not fully known, so what this widens may be more than shown)"]:::unit
n_assignment_module_retail_app_ecs_module_ui_service_aws_iam_role_task_execution_role["role assignment<br/>drafted: stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role<br/>role decided by var.retail_app_ecs_ui_service_task_execution_role_project_roles (no default) @ project<br/>source AWS policy: arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]:::unit
n_assignment_module_retail_app_ecs_module_ui_service_aws_iam_role_task_role["role assignment<br/>drafted: stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role<br/>role decided by var.retail_app_ecs_ui_service_task_role_project_roles (no default) @ project<br/>source AWS policy: module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_logs, module.retail_app_ecs.module.ui_service.aws_iam_policy.ecs_exec<br/>not readable: module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_logs (Statement(0).Resource is not known statically (runtime-data)) (what it grants is not fully known, so what this widens may be more than shown)"]:::unit
end
subgraph g_scope["Target resource scope"]
n_scope_project["target resource scope<br/>project<br/><small>var.project_id</small>"]:::unit
end
n_assignment_module_retail_app_ecs_module_carts_service_aws_iam_role_task_execution_role -->|"role decided by var.retail_app_ecs_carts_service_task_execution_role_project_roles (no default) @ project"| n_scope_project
n_assignment_module_retail_app_ecs_module_carts_service_aws_iam_role_task_role -->|"role decided by var.retail_app_ecs_carts_service_task_role_project_roles (no default) @ project"| n_scope_project
n_assignment_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_execution_role -->|"role decided by var.retail_app_ecs_catalog_service_task_execution_role_project_roles (no default) @ project"| n_scope_project
n_assignment_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_role -->|"role decided by var.retail_app_ecs_catalog_service_task_role_project_roles (no default) @ project"| n_scope_project
n_assignment_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_execution_role -->|"role decided by var.retail_app_ecs_checkout_service_task_execution_role_project_roles (no default) @ project"| n_scope_project
n_assignment_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_role -->|"role decided by var.retail_app_ecs_checkout_service_task_role_project_roles (no default) @ project"| n_scope_project
n_assignment_module_retail_app_ecs_module_orders_service_aws_iam_role_task_execution_role -->|"role decided by var.retail_app_ecs_orders_service_task_execution_role_project_roles (no default) @ project"| n_scope_project
n_assignment_module_retail_app_ecs_module_orders_service_aws_iam_role_task_role -->|"role decided by var.retail_app_ecs_orders_service_task_role_project_roles (no default) @ project"| n_scope_project
n_assignment_module_retail_app_ecs_module_ui_service_aws_iam_role_task_execution_role -->|"role decided by var.retail_app_ecs_ui_service_task_execution_role_project_roles (no default) @ project"| n_scope_project
n_assignment_module_retail_app_ecs_module_ui_service_aws_iam_role_task_role -->|"role decided by var.retail_app_ecs_ui_service_task_role_project_roles (no default) @ project"| n_scope_project
n_decision_module_retail_app_ecs_module_carts_service_aws_iam_role_task_execution_role ==>|"drafted: a block of the draft, not a plan resource"| n_stackit_service_account_retail_app_ecs_carts_service_task_execution_role
n_decision_module_retail_app_ecs_module_carts_service_aws_iam_role_task_role ==>|"drafted: a block of the draft, not a plan resource"| n_stackit_service_account_retail_app_ecs_carts_service_task_role
n_decision_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_execution_role ==>|"drafted: a block of the draft, not a plan resource"| n_stackit_service_account_retail_app_ecs_catalog_service_task_execution_role
n_decision_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_role ==>|"drafted: a block of the draft, not a plan resource"| n_stackit_service_account_retail_app_ecs_catalog_service_task_role
n_decision_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_execution_role ==>|"drafted: a block of the draft, not a plan resource"| n_stackit_service_account_retail_app_ecs_checkout_service_task_execution_role
n_decision_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_role ==>|"drafted: a block of the draft, not a plan resource"| n_stackit_service_account_retail_app_ecs_checkout_service_task_role
n_decision_module_retail_app_ecs_module_orders_service_aws_iam_role_task_execution_role ==>|"drafted: a block of the draft, not a plan resource"| n_stackit_service_account_retail_app_ecs_orders_service_task_execution_role
n_decision_module_retail_app_ecs_module_orders_service_aws_iam_role_task_role ==>|"drafted: a block of the draft, not a plan resource"| n_stackit_service_account_retail_app_ecs_orders_service_task_role
n_decision_module_retail_app_ecs_module_ui_service_aws_iam_role_task_execution_role ==>|"drafted: a block of the draft, not a plan resource"| n_stackit_service_account_retail_app_ecs_ui_service_task_execution_role
n_decision_module_retail_app_ecs_module_ui_service_aws_iam_role_task_role ==>|"drafted: a block of the draft, not a plan resource"| n_stackit_service_account_retail_app_ecs_ui_service_task_role
n_module_retail_app_ecs_module_carts_service_aws_iam_role_task_execution_role -->|"migration decision"| n_decision_module_retail_app_ecs_module_carts_service_aws_iam_role_task_execution_role
n_module_retail_app_ecs_module_carts_service_aws_iam_role_task_role -->|"migration decision"| n_decision_module_retail_app_ecs_module_carts_service_aws_iam_role_task_role
n_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_execution_role -->|"migration decision"| n_decision_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_execution_role
n_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_role -->|"migration decision"| n_decision_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_role
n_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_execution_role -->|"migration decision"| n_decision_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_execution_role
n_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_role -->|"migration decision"| n_decision_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_role
n_module_retail_app_ecs_module_orders_service_aws_iam_role_task_execution_role -->|"migration decision"| n_decision_module_retail_app_ecs_module_orders_service_aws_iam_role_task_execution_role
n_module_retail_app_ecs_module_orders_service_aws_iam_role_task_role -->|"migration decision"| n_decision_module_retail_app_ecs_module_orders_service_aws_iam_role_task_role
n_module_retail_app_ecs_module_ui_service_aws_iam_role_task_execution_role -->|"migration decision"| n_decision_module_retail_app_ecs_module_ui_service_aws_iam_role_task_execution_role
n_module_retail_app_ecs_module_ui_service_aws_iam_role_task_role -->|"migration decision"| n_decision_module_retail_app_ecs_module_ui_service_aws_iam_role_task_role
n_stackit_service_account_retail_app_ecs_carts_service_task_execution_role ==>|"drafted: stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role (a block of the draft, not a plan resource)"| n_assignment_module_retail_app_ecs_module_carts_service_aws_iam_role_task_execution_role
n_stackit_service_account_retail_app_ecs_carts_service_task_role ==>|"drafted: stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role (a block of the draft, not a plan resource)"| n_assignment_module_retail_app_ecs_module_carts_service_aws_iam_role_task_role
n_stackit_service_account_retail_app_ecs_catalog_service_task_execution_role ==>|"drafted: stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role (a block of the draft, not a plan resource)"| n_assignment_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_execution_role
n_stackit_service_account_retail_app_ecs_catalog_service_task_role ==>|"drafted: stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role (a block of the draft, not a plan resource)"| n_assignment_module_retail_app_ecs_module_catalog_service_aws_iam_role_task_role
n_stackit_service_account_retail_app_ecs_checkout_service_task_execution_role ==>|"drafted: stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role (a block of the draft, not a plan resource)"| n_assignment_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_execution_role
n_stackit_service_account_retail_app_ecs_checkout_service_task_role ==>|"drafted: stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role (a block of the draft, not a plan resource)"| n_assignment_module_retail_app_ecs_module_checkout_service_aws_iam_role_task_role
n_stackit_service_account_retail_app_ecs_orders_service_task_execution_role ==>|"drafted: stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role (a block of the draft, not a plan resource)"| n_assignment_module_retail_app_ecs_module_orders_service_aws_iam_role_task_execution_role
n_stackit_service_account_retail_app_ecs_orders_service_task_role ==>|"drafted: stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role (a block of the draft, not a plan resource)"| n_assignment_module_retail_app_ecs_module_orders_service_aws_iam_role_task_role
n_stackit_service_account_retail_app_ecs_ui_service_task_execution_role ==>|"drafted: stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role (a block of the draft, not a plan resource)"| n_assignment_module_retail_app_ecs_module_ui_service_aws_iam_role_task_execution_role
n_stackit_service_account_retail_app_ecs_ui_service_task_role ==>|"drafted: stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role (a block of the draft, not a plan resource)"| n_assignment_module_retail_app_ecs_module_ui_service_aws_iam_role_task_role
classDef unit fill:#e1e5f5,stroke:#4b5ba6
classDef synthetic fill:#f3f3f3,stroke:#566663
classDef unknown fill:#f3f3f3,stroke:#566663,stroke-dasharray:4 3
classDef manual fill:#f6e7cf,stroke:#a8650c
classDef internet fill:#f8deda,stroke:#b1261b