README.md

Execution package

Generated by StackToIT from execution-plan.json. Nothing in this folder has been run: StackToIT reads and writes files and creates, changes and deletes nothing in any cloud. Every step is carried out by a person, by OpenTofu or by a script of this folder that a person runs. Paths are relative to the output folder.

Partially executable migration package · Proposal only · Not approved.

What will be created. OpenTofu creates 53 resource blocks; the scripts of this package make 4 STACKIT API calls. 11 source resources need no STACKIT resource. Architect work: 254 manual steps in 41 work packages.

What can run now. 48 of the 57 automated steps (OpenTofu or a script) can run now (1 waits for a manual prerequisite, 8 require a design decision) · 9 of those 48 rest on a default you have not confirmed (public endpoint, size derived from the source); a person can start 114 of the 254 manual steps now (4 wait for a manual prerequisite, 71 require a design decision, 65 are not executable as the plan stands); 3 steps are permanently unsupported (refused); 1 step has its verification incomplete: it carries critical settings of the source that no check validates, which a person confirms in the draft.

Readiness levels. 57 automated steps can be generated · 48 can run now · 39 are ready for migration (they rest on no default that is not confirmed) · 0 are approved (every default and decision they rest on is confirmed in the decisions file). 9 steps can run now and wait only for the confirmation of a default (DEC-GEN-CONVERT-EXPOSURE-WIDENED, DEC-GEN-CONVERT-SIZE-FROM-SOURCE): confirm the default, or choose another option, in decisions.yaml.

What the figures count. Three measures, not one: "can run now" means the preconditions of the step in the plan are met (48 of the 57 automated steps); "automation-eligible" means the critical settings of the unit are closed (0 of 44 units; 17 more become eligible once their open items are answered; 27 cannot be automated in this build: a critical setting STACKIT does not support (13 units) and 4 more reasons, every one on the Automation eligibility line of index.html); "actually runnable" means the values the step reads are supplied as well (0 of the 48 steps that can run now: the plan still lists 43 OpenTofu variables, the STACKIT project id among them, as needing a value).

What cannot be preserved. 307 critical settings of 48 source resources that the draft does not carry are open as manual or refused steps ([engineering/not-carried.csv](../engineering/not-carried.csv) lists what the draft does not carry, property by property). 3 steps are refused: the target has no equivalent (see What cannot be migrated).

Decisions required. 9 decisions (17 questions) must be answered before the steps that wait for them can be carried out ([Required decisions](#required-decisions); described in [executive/decisions.md](../executive/decisions.md)).

First work package. [WP-02](manual/actions.md), Set up the identities and access (prepare) — owner: Identity Architect, 10 steps. The next package that waits, WP-08 (Write the security group rules the draft does not write (security)), waits for decisions (10 of 13 steps). It opens when DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this are answered.

Work packages

The 254 manual steps of this plan in 41 work packages: the steps of one phase that one role carries out together, of one kind of work. execution/manual/actions.md lists each package with its steps in full and migration/work-packages.csv has one row per package; every step is also listed once under Execution order. A package is as far as its least advanced step.

How the package is carried out

This is an operator-executable migration plan: a person, OpenTofu or a script that a person runs carries out each step, in the order below, and nothing in this folder runs by itself. OpenTofu applies the OpenTofu steps together in one tofu apply, so the manual steps and STACKIT API calls that come before it are not enforced: execution/terraform/apply.md lists them as a checklist to complete first. An executor that would carry the plan out step by step (stacktoit execute) is designed and not implemented.

Verdict

Partially executable migration package

Steps: partially executable: some steps cannot be carried out as the plan stands, whatever is decided: they are marked not executable under Execution order.

The verdict is of the 314 steps of this package. Every resource and data block of the draft (53) is a step of it. Every source resource of the assessment (52) is a step of it, or needs neither a STACKIT resource nor a step (0). Of them, 11 need no STACKIT resource (terraform/README.md lists them under Not needed on STACKIT); 11 of them still have a step of the plan. These files of the draft hold no step of the plan at all: terraform/terraform.tf, terraform/variables.tf.

Execution completeness: COMPLETE (each of the 254 manual steps states what it is, why, who carries it out and when it is done, and the input it needs where it depends on one).

48 of the 57 automated steps (OpenTofu or a script) can run now (1 waits for a manual prerequisite, 8 require a design decision) · 9 of those 48 rest on a default you have not confirmed (public endpoint, size derived from the source); a person can start 114 of the 254 manual steps now (4 wait for a manual prerequisite, 71 require a design decision, 65 are not executable as the plan stands); 3 steps are permanently unsupported (refused); 1 step has its verification incomplete: it carries critical settings of the source that no check validates, which a person confirms in the draft. Migration ready: NO — 307 critical settings of 48 source resources have manual or refused steps open (293 manual, 14 refused); 147 steps cannot be carried out now (79 wait only for a decision, 65 are not executable whatever is decided, 3 are refused).

The critical settings of the source that the draft does not carry, by source resource: each is a manual or refused step under Execution order (a source resource the draft writes no resource for carries them in its own step); assurance/critical-semantics.json says why each is open and what closes it. A setting the knowledge base names by a generated id is said in words before its id: the source attribute it is, as the step of the setting states it, or else its id in words where the plan states no attribute for it.

• module.dependencies.aws_mq_broker.mq — manual (steps 142, 143, 144, 145): broker-network, broker-users, engine-version, network-exposure, its broker name (tc-mq-broker-broker-name), its user password (tc-user--password), its user username (tc-user--username), its deployment mode (tcp-deployment-mode)
• module.dependencies.aws_security_group.catalog_opensearch_sg — manual (step 40): egress-restriction, network-topology-boundary, standalone-rule-not-generated, standalone-rule-remote-not-resolved, stateful; refused (step 71): security-group-vpc-membership
• module.dependencies.aws_security_group.mq — manual (step 41): egress-restriction, network-topology-boundary, standalone-rule-not-generated, stateful; refused (step 71): security-group-vpc-membership
• module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this — manual (steps 114, 115, 116, 117): access-and-encryption-settings, cluster-layout-settings, domain-settings, encryption-at-rest, engine-version, fine-grained-access, nbr-aws-opensearch-domain-policy, network-settings, opensearch-domain-policy-resource, private-endpoint, storage-settings, its domain name (tc-opensearch-domain-domain-name); refused (steps 135, 136): credentials-and-keys-settings, domain-credentials-and-keys
• module.dependencies.module.catalog_rds.aws_rds_cluster.this — manual (steps 118, 119, 120, 121, 122): admin-password, admin-username-not-carried, backup-retention, db-network-placement, engine, engine-version, final-snapshot, member-engine, member-settings, parameter-and-option-groups, security-groups, storage-encryption, its database name (tc-database-name), the identifier of its aws_rds_cluster_instance (tcf-rds-cluster-instance--identifier)
• module.dependencies.module.catalog_rds.aws_security_group.this — manual (step 42): egress-restriction, network-topology-boundary, rule-ports, standalone-rule-values, stateful; refused (step 71): security-group-vpc-membership
• module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default — manual (steps 123, 124, 125, 126): at-rest-encryption-off, failover-off, network-placement, parameter-group, parameter-group-default, seed-snapshot, snapshots-off, its replication group id (tc-elasticache-replication-group-replication-group-id), its transit encryption enabled (tcp-elasticache-replication-group-transit-encryption-enabled)
• module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd — manual (step 43): network-topology-boundary, rule-ports, standalone-rule-empty-sources, standalone-rule-other-sources, standalone-rule-values, stateful; refused (step 71): security-group-vpc-membership
• module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this — manual (steps 127, 128, 129): encryption-at-rest, index-projection-and-name, key-schema, point-in-time-recovery, its name (tc-dynamodb-table-name), ttl
• module.dependencies.module.orders_rds.aws_rds_cluster.this — manual (steps 130, 131, 132, 133, 134): admin-password, admin-username-not-carried, db-network-placement, final-snapshot, member-settings, parameter-and-option-groups, security-groups, storage-encryption, the identifier of its aws_rds_cluster_instance (tcf-rds-cluster-instance--identifier)
• module.dependencies.module.orders_rds.aws_security_group.this — manual (step 44): egress-restriction, network-topology-boundary, rule-ports, standalone-rule-values, stateful; refused (step 71): security-group-vpc-membership
• module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks — manual (step 175): its name (tc-name)
• module.retail_app_ecs.aws_kms_key.cmk — manual (step 45): deletion-window
• module.retail_app_ecs.aws_secretsmanager_secret.catalog_db — manual (steps 46, 47): customer-managed-key, secret-value, its name (tc-secretsmanager-secret-name)
• module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch — manual (steps 48, 49): customer-managed-key, secret-value, its name (tc-secretsmanager-secret-name)
• module.retail_app_ecs.aws_secretsmanager_secret.mq — manual (steps 50, 51): secret-value, its name (tc-secretsmanager-secret-name)
• module.retail_app_ecs.aws_secretsmanager_secret.orders_db — manual (steps 52, 53): secret-value, its name (tc-secretsmanager-secret-name)
• module.retail_app_ecs.module.alb.aws_lb.this — manual (steps 146, 147): client-restriction, lb-connection-timeouts, lb-routing-and-addressing, lb-subnets, network-exposure, request-handling, request-header-options, its name (tc-lb-name)
• module.retail_app_ecs.module.alb.aws_security_group.this — manual (step 54): egress-restriction, network-topology-boundary, stateful; refused (step 71): security-group-vpc-membership
• module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix — manual (step 55): network-topology-boundary, rule-ports, standalone-rule-empty-sources, standalone-rule-other-sources, standalone-rule-values, stateful; refused (step 71): security-group-vpc-membership
• module.retail_app_ecs.module.carts_service.aws_ecs_service.this — manual (steps 148, 149, 150, 151): service-connect-values, service-desired-count, service-discovery, service-execute-command, service-network-placement, service-public-ip-setting, service-task-definition, task-definition, td-container-definitions, td-container-image-registry, td-container-plaintext-secret-env, td-container-secret-references, td-execution-role-arn, td-network-mode, td-task-role-arn
• module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role — manual (step 56): iam-managed-ecs, iam-trust-service-workload, permissions, trust
• module.retail_app_ecs.module.carts_service.aws_iam_role.task_role — manual (step 57): iam-managed-customer-policy, iam-trust-service-workload, permissions, trust
• module.retail_app_ecs.module.carts_service.aws_security_group.this — manual (step 58): egress-rule-protocol, egress-sources, ingress-sources, network-topology-boundary, rule-ports, stateful; refused (step 71): security-group-vpc-membership
• module.retail_app_ecs.module.catalog_service.aws_ecs_service.this — manual (steps 152, 153, 154, 155): service-connect-values, service-desired-count, service-discovery, service-execute-command, service-network-placement, service-public-ip-setting, service-task-definition, task-definition, td-container-definitions, td-container-image-registry, td-container-plaintext-secret-env, td-container-secret-references, td-execution-role-arn, td-network-mode, td-task-role-arn
• module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role — manual (step 59): iam-managed-ecs, iam-trust-service-workload, permissions, trust
• module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role — manual (step 60): iam-managed-customer-policy, iam-trust-service-workload, permissions, trust
• module.retail_app_ecs.module.catalog_service.aws_security_group.this — manual (step 61): egress-rule-protocol, egress-sources, ingress-sources, network-topology-boundary, rule-ports, stateful; refused (step 71): security-group-vpc-membership
• module.retail_app_ecs.module.checkout_service.aws_ecs_service.this — manual (steps 156, 157, 158, 159): service-connect-values, service-desired-count, service-discovery, service-execute-command, service-network-placement, service-public-ip-setting, service-task-definition, task-definition, td-container-definitions, td-container-image-registry, td-container-plaintext-secret-env, td-container-secret-references, td-execution-role-arn, td-network-mode, td-task-role-arn
• module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role — manual (step 62): iam-managed-ecs, iam-trust-service-workload, permissions, trust
• module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role — manual (step 63): iam-managed-customer-policy, iam-trust-service-workload, permissions, trust
• module.retail_app_ecs.module.checkout_service.aws_security_group.this — manual (step 64): egress-rule-protocol, egress-sources, ingress-sources, network-topology-boundary, rule-ports, stateful; refused (step 71): security-group-vpc-membership
• module.retail_app_ecs.module.orders_service.aws_ecs_service.this — manual (steps 160, 161, 162, 163): service-connect-values, service-desired-count, service-discovery, service-execute-command, service-network-placement, service-public-ip-setting, service-task-definition, task-definition, td-container-definitions, td-container-image-registry, td-container-plaintext-secret-env, td-container-secret-references, td-execution-role-arn, td-network-mode, td-task-role-arn
• module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role — manual (step 65): iam-managed-ecs, iam-trust-service-workload, permissions, trust
• module.retail_app_ecs.module.orders_service.aws_iam_role.task_role — manual (step 66): iam-managed-customer-policy, iam-trust-service-workload, permissions, trust
• module.retail_app_ecs.module.orders_service.aws_security_group.this — manual (step 67): egress-rule-protocol, egress-sources, ingress-sources, network-topology-boundary, rule-ports, stateful; refused (step 71): security-group-vpc-membership
• module.retail_app_ecs.module.ui_service.aws_ecs_service.this — manual (steps 164, 165, 166, 167): service-connect-values, service-desired-count, service-discovery, service-execute-command, service-load-balancer-target, service-network-placement, service-public-ip-setting, service-task-definition, task-definition, td-container-definitions, td-container-image-registry, td-container-plaintext-secret-env, td-container-secret-references, td-execution-role-arn, td-network-mode, td-task-role-arn
• module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role — manual (step 68): iam-managed-ecs, iam-trust-service-workload, permissions, trust
• module.retail_app_ecs.module.ui_service.aws_iam_role.task_role — manual (step 69): iam-managed-customer-policy, iam-trust-service-workload, permissions, trust
• module.retail_app_ecs.module.ui_service.aws_security_group.this — manual (step 70): egress-rule-protocol, egress-sources, ingress-sources, network-topology-boundary, rule-ports, stateful; refused (step 71): security-group-vpc-membership
• module.vpc.module.vpc.aws_eip.nat — manual (step 16): public-address
• module.vpc.module.vpc.aws_internet_gateway.this — manual (step 17): network-topology-boundary
• module.vpc.module.vpc.aws_nat_gateway.this — manual (step 18): fixed-egress-ip, nat-placement, network-topology-boundary
• module.vpc.module.vpc.aws_route_table.private — manual (step 19): egress-restriction, nat-fixed-egress-address, network-topology-boundary, route-destinations, route-targets, routes, subnet-association-target, its vpc id (tcr-route-table-vpc-id)
• module.vpc.module.vpc.aws_route_table.public — manual (step 20): network-topology-boundary, route-destinations, route-targets, routes, its vpc id (tcr-route-table-vpc-id)
• module.vpc.module.vpc.aws_subnet.private — manual (steps 21, 22): availability-zone, network-topology-boundary, prefix, private-egress-ipv4, subnet-vpc-membership
• module.vpc.module.vpc.aws_subnet.public — manual (steps 23, 24): availability-zone, effective-route-table, network-topology-boundary, prefix, private-egress-ipv4, subnet-vpc-membership
• module.vpc.module.vpc.aws_vpc.this — manual (steps 25, 26): default-nacl-rules, default-route-table, default-security-group-omitted-direction, dns-settings, main-table-set, network-topology-boundary

What will be created

OpenTofu creates 53 resource blocks; 48 of the OpenTofu steps can be carried out now and 1 once the manual step before it is done. The scripts of this package make 4 STACKIT API calls.

• stackit_application_load_balancer: 1
• stackit_authorization_project_role_assignment: 10
• stackit_kms_key: 1
• stackit_kms_keyring: 1
• stackit_logs_instance: 1
• stackit_mariadb_credential: 1
• stackit_mariadb_instance: 1
• stackit_mongodbflex_instance: 1
• stackit_network: 2
• stackit_opensearch_credential: 1
• stackit_opensearch_instance: 1
• stackit_postgresflex_database: 1
• stackit_postgresflex_instance: 1
• stackit_postgresflex_user: 1
• stackit_rabbitmq_credential: 1
• stackit_rabbitmq_instance: 1
• stackit_secretsmanager_instance: 1
• stackit_secretsmanager_user: 1
• stackit_security_group: 7
• stackit_security_group_rule: 5
• stackit_service_account: 10
• stackit_ske_cluster: 1
• stackit_valkey_credential: 1
• stackit_valkey_instance: 1

A repeated block creates one object for each instance: stackit_network.vpc_vpc_private (count = var.vpc_vpc_private_count: the number of objects is decided when OpenTofu plans), stackit_network.vpc_vpc_public (count = var.vpc_vpc_public_count: the number of objects is decided when OpenTofu plans), stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role (for_each = toset(var.retail_app_ecs_carts_service_task_execution_role_project_roles): the number of objects is decided when OpenTofu plans), stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role (for_each = toset(var.retail_app_ecs_carts_service_task_role_project_roles): the number of objects is decided when OpenTofu plans), stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role (for_each = toset(var.retail_app_ecs_catalog_service_task_execution_role_project_roles): the number of objects is decided when OpenTofu plans), stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role (for_each = toset(var.retail_app_ecs_catalog_service_task_role_project_roles): the number of objects is decided when OpenTofu plans), stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role (for_each = toset(var.retail_app_ecs_checkout_service_task_execution_role_project_roles): the number of objects is decided when OpenTofu plans), stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role (for_each = toset(var.retail_app_ecs_checkout_service_task_role_project_roles): the number of objects is decided when OpenTofu plans), stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role (for_each = toset(var.retail_app_ecs_orders_service_task_execution_role_project_roles): the number of objects is decided when OpenTofu plans), stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role (for_each = toset(var.retail_app_ecs_orders_service_task_role_project_roles): the number of objects is decided when OpenTofu plans), stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role (for_each = toset(var.retail_app_ecs_ui_service_task_execution_role_project_roles): the number of objects is decided when OpenTofu plans), stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role (for_each = toset(var.retail_app_ecs_ui_service_task_role_project_roles): the number of objects is decided when OpenTofu plans).

What cannot be migrated

• the VPC membership (the critical setting security-group-vpc-membership) of 12 AWS security groups: module.retail_app_ecs.module.alb.aws_security_group.this, module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, module.retail_app_ecs.module.carts_service.aws_security_group.this, module.retail_app_ecs.module.catalog_service.aws_security_group.this, module.retail_app_ecs.module.checkout_service.aws_security_group.this, module.retail_app_ecs.module.orders_service.aws_security_group.this, module.retail_app_ecs.module.ui_service.aws_security_group.this, module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this, module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, module.dependencies.module.orders_rds.aws_security_group.this; 7 of the drafted STACKIT security groups are orphaned (no block of the draft attaches the group, so its rules restrict nothing on STACKIT as drafted): stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix, stackit_security_group.retail_app_ecs_alb_this, stackit_security_group.retail_app_ecs_carts_service_this, stackit_security_group.retail_app_ecs_catalog_service_this, stackit_security_group.retail_app_ecs_checkout_service_this, stackit_security_group.retail_app_ecs_orders_service_this, stackit_security_group.retail_app_ecs_ui_service_this: the target has no network-scoped security group: a STACKIT security group belongs to the project, not to a network, so the VPC boundary of the source groups is one design parity gap of the target for the whole estate, with alternatives; the draft still writes each group and its rules. A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.; This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. A redesign could close it once for the estate by one of these alternatives: confirm that the estate has one VPC (the project the draft creates is then that VPC's boundary, and the setting closes); give each source VPC a STACKIT project of its own, joined through a Network Area where their networks must reach each other; or keep one project and attach each group only to the interfaces of the networks that replace its VPC, with no rule's remote_security_group_id naming a group whose members sit in a network the source VPC kept apart. A difference that is accepted instead (the groups stay project-wide) is recorded as an accepted design difference, with who accepted it and why, never as equivalent. Reason: the target's scope model differs from the source's, so the source's boundary has no one-to-one counterpart (TARGET_SCOPE_MODEL_DIFFERS).
• the critical setting credentials-and-keys-settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: the target has no counterpart that carries the setting credentials-and-keys-settings of aws_opensearch_domain (the knowledge base marks it UNSUPPORTED). The mapping rule for this kind of unit found a setting the target has no counterpart for. The IAM master user, the master user name and password, the customer KMS key and the custom endpoint certificate, read where they are set whatever their value. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) - UNSUPPORTED; a password is never carried. Reason: the target has no counterpart that carries this setting of the source (TARGET_SETTING_UNSUPPORTED).
• the critical setting domain-credentials-and-keys of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: the target has no counterpart that carries the setting domain-credentials-and-keys of aws_opensearch_domain (the knowledge base marks it UNSUPPORTED). The mapping rule for this kind of unit found a setting the target has no counterpart for. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) — UNSUPPORTED. Reason: the target has no counterpart that carries this setting of the source (TARGET_SETTING_UNSUPPORTED).

The draft writes no resource for 3 source resources: a person decides how each moves to STACKIT and sets its target up by hand (Manual steps):

• module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events — Decided when OpenTofu plans: its count is (var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0, which reads 0 as the variables stand, so the draft writes no resource for it. It is not dropped: assess again with a --var-file that sets the input, or decide it after a plan.
• module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights — Decided when OpenTofu plans: its count is (var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0, which reads 0 as the variables stand, so the draft writes no resource for it. It is not dropped: assess again with a --var-file that sets the input, or decide it after a plan.
• module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs — Decided when OpenTofu plans: its count is (var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0, which reads 0 as the variables stand, so the draft writes no resource for it. It is not dropped: assess again with a --var-file that sets the input, or decide it after a plan.

65 steps are not executable whatever is decided; each says why under Execution order. In all, 147 steps cannot be carried out now (79 wait only for a decision, 65 are not executable whatever is decided, 3 are refused).

Required decisions

9 decisions (17 questions) must be answered before the steps that wait for them can be carried out. Each is described under its id in executive/decisions.md and decisions.json.

• DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION — Decide which instance of stackit_network.vpc_vpc_public the networks of stackit_application_load_balancer.retail_app_ecs_alb_this means: set var.retail_app_ecs_alb_this_network_id_target to its index — holds back 66 steps: stackit_application_load_balancer.retail_app_ecs_alb_this; a manual step on stackit_application_load_balancer.retail_app_ecs_alb_this (2 times); a manual step (58 times); a manual step on stackit_opensearch_instance.dependencies_catalog_opensearch_this; a manual step on stackit_mariadb_instance.dependencies_catalog_rds_this; a manual step on stackit_valkey_instance.dependencies_checkout_elasticache_redis_default; a manual step on stackit_mongodbflex_instance.dynamodb_tables; a manual step on stackit_postgresflex_database.dependencies_orders_rds_this_orders, stackit_postgresflex_instance.dependencies_orders_rds_this
• DEC-GEN-CONVERT-API-OPT-IN — Allow calls of the Secrets Manager Vault-compatible API, whose maturity is not established, for this migration (the API may change or vanish)? Accept: the calls of the Secrets Manager Vault-compatible API (WriteSecret) are carried out for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db. Refuse: no call is made, a refusal selects no other path (the draft holds no other carrier of what the calls set), and what they set stays open for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db. — holds back 74 steps: the call WriteSecret of secrets-manager-vault (4 times); a manual step on stackit_secretsmanager_instance.migrated_secrets (4 times); a manual step (58 times); a manual step on stackit_opensearch_instance.dependencies_catalog_opensearch_this (2 times); a manual step on stackit_mariadb_instance.dependencies_catalog_rds_this; a manual step on stackit_valkey_instance.dependencies_checkout_elasticache_redis_default; a manual step on stackit_mongodbflex_instance.dynamodb_tables; a manual step on stackit_postgresflex_database.dependencies_orders_rds_this_orders, stackit_postgresflex_instance.dependencies_orders_rds_this; a manual step on stackit_rabbitmq_instance.dependencies_mq; a manual step on stackit_application_load_balancer.retail_app_ecs_alb_this
• DEC-GEN-CONVERT-DATA-MOVEMENT — 5 questions of this kind: DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this — Choose how the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this moves from aws_opensearch_domain to STACKIT OpenSearch (stackit_opensearch_instance.dependencies_catalog_opensearch_this): the method, the downtime it needs and the check that the copy is complete; DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this — Choose how the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this moves from aws_rds_cluster to STACKIT MariaDB (stackit_mariadb_instance.dependencies_catalog_rds_this): a dump loaded with the mysql client inside the write freeze, or a tool of your own; DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default — Choose how the keys of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default move from aws_elasticache_replication_group to STACKIT Key Value Store (stackit_valkey_instance.dependencies_checkout_elasticache_redis_default): the keys copied by a client inside the write freeze, or a tool of your own; DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this — Choose how the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this moves from aws_dynamodb_table to STACKIT MongoDB Flex (stackit_mongodbflex_instance.dynamodb_tables): the method, the downtime it needs and the check that the copy is complete; DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this — Choose how the data of module.dependencies.module.orders_rds.aws_rds_cluster.this moves from aws_rds_cluster to PostgreSQL Flex (stackit_postgresflex_instance.dependencies_orders_rds_this): a dump restored inside the write freeze, the engine's logical replication, or a tool of your own — holds back 114 steps: a manual step (95 times); a manual step on stackit_mariadb_instance.dependencies_catalog_rds_this (2 times); a manual step on stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (2 times); a manual step on stackit_mongodbflex_instance.dynamodb_tables (2 times); a manual step on stackit_postgresflex_database.dependencies_orders_rds_this_orders, stackit_postgresflex_instance.dependencies_orders_rds_this (2 times); a manual step on stackit_secretsmanager_instance.migrated_secrets (4 times); a manual step on stackit_rabbitmq_instance.dependencies_mq (2 times); a manual step on stackit_opensearch_instance.dependencies_catalog_opensearch_this (3 times); a manual step on stackit_application_load_balancer.retail_app_ecs_alb_this (2 times)
• DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE — Choose how module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch 3.3) reaches STACKIT, which offers 2 in eu01: move the data into 2 by re-reading it from the source, run OpenSearch 3.3 yourself on SKE, or wait until STACKIT offers it — holds back 84 steps: stackit_opensearch_instance.dependencies_catalog_opensearch_this; stackit_opensearch_credential.dependencies_catalog_opensearch_this; a manual step (67 times); a manual step on stackit_secretsmanager_instance.migrated_secrets (4 times); a manual step on stackit_rabbitmq_instance.dependencies_mq (2 times); a manual step on stackit_opensearch_instance.dependencies_catalog_opensearch_this (3 times); a manual step on stackit_application_load_balancer.retail_app_ecs_alb_this (2 times); a manual step on stackit_mariadb_instance.dependencies_catalog_rds_this; a manual step on stackit_valkey_instance.dependencies_checkout_elasticache_redis_default; a manual step on stackit_mongodbflex_instance.dynamodb_tables; a manual step on stackit_postgresflex_database.dependencies_orders_rds_this_orders, stackit_postgresflex_instance.dependencies_orders_rds_this
• DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH — Decide how the clients of module.retail_app_ecs.module.alb.aws_lb.this reach the workloads of module.retail_app_ecs.module.ui_service.aws_ecs_service.this on SKE (aws.ingress.exposure-path): option nodeport-alb-target-pool (the drafted path: a NodePort Service of each workload and the target pool on its node port at the private IPs of the cluster's nodes, an input), ingress-controller-behind-alb (an Ingress controller on the cluster, reached by the load balancer on the controller's node port, routes to the ClusterIP Services), or stackit-alb-ingress-controller (the SKE Application Load Balancer extension provisions the load balancer from an Ingress of the IngressClass stackit-alb over NodePort Services; the drafted stackit_application_load_balancer.retail_app_ecs_alb_this is not applied) — holds back 66 steps: stackit_application_load_balancer.retail_app_ecs_alb_this; a manual step on stackit_application_load_balancer.retail_app_ecs_alb_this (2 times); a manual step (58 times); a manual step on stackit_opensearch_instance.dependencies_catalog_opensearch_this; a manual step on stackit_mariadb_instance.dependencies_catalog_rds_this; a manual step on stackit_valkey_instance.dependencies_checkout_elasticache_redis_default; a manual step on stackit_mongodbflex_instance.dynamodb_tables; a manual step on stackit_postgresflex_database.dependencies_orders_rds_this_orders, stackit_postgresflex_instance.dependencies_orders_rds_this
• DEC-GEN-CONVERT-POD-SEGMENTATION — 5 questions of this kind: DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this — Decide how the segmentation that the security group module.retail_app_ecs.module.carts_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.carts_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_carts_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it); DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this — Decide how the segmentation that the security group module.retail_app_ecs.module.catalog_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_catalog_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it); DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this — Decide how the segmentation that the security group module.retail_app_ecs.module.checkout_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_checkout_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it); DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this — Decide how the segmentation that the security group module.retail_app_ecs.module.orders_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.orders_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_orders_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it); DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this — Decide how the segmentation that the security group module.retail_app_ecs.module.ui_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.ui_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_ui_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it) — holds back 96 steps: a manual step (81 times); a manual step on stackit_secretsmanager_instance.migrated_secrets (4 times); a manual step on stackit_rabbitmq_instance.dependencies_mq (2 times); a manual step on stackit_opensearch_instance.dependencies_catalog_opensearch_this (3 times); a manual step on stackit_application_load_balancer.retail_app_ecs_alb_this (2 times); a manual step on stackit_mariadb_instance.dependencies_catalog_rds_this; a manual step on stackit_valkey_instance.dependencies_checkout_elasticache_redis_default; a manual step on stackit_mongodbflex_instance.dynamodb_tables; a manual step on stackit_postgresflex_database.dependencies_orders_rds_this_orders, stackit_postgresflex_instance.dependencies_orders_rds_this
• DEC-GEN-CONVERT-WORKLOAD-PLACEMENT — Decide where the source consumers of module.vpc.module.vpc.aws_subnet.private are placed on STACKIT: the source places module.dependencies.aws_mq_broker.mq, module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, module.dependencies.module.orders_rds.aws_rds_cluster.this, module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this and module.retail_app_ecs.module.ui_service.aws_ecs_service.this in it, and the draft places none of them in stackit_network.vpc_vpc_private (the target networks the draft generates for the subnets of the same VPC: stackit_network.vpc_vpc_private and stackit_network.vpc_vpc_public); the drafted Kubernetes cluster stackit_ske_cluster.retail_app_ecs_cluster of these consumers sets no network.id — option one-network-for-the-cluster-and-services (the cluster and the servers in one network, the managed services reached by access lists naming its range), keep-the-networks-and-place-by-tier, redesign-the-network-placement, or accept-the-consumers-outside-the-network (the network as drafted, holding none of them) — holds back 3 steps: stackit_network.vpc_vpc_private; a manual step (2 times)
• DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST — Decide the egress address of module.vpc.module.vpc.aws_route_table.private: keep the changing address of the STACKIT network, or give each server that an allow-list names a STACKIT public IP — holds back 8 steps: a manual step (8 times)
• DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS — Decide whether the logs of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks older than 180 days are kept in an archive outside the Logs instance — holds back 2 steps: a manual step (2 times)

To answer: write a decisions file (YAML or JSON, at most 1 MiB) with schema_version 0.2.0 and the head of decisions.json (source_digest, kb_version and kb_sha256), and under decisions copy the entry of each record you answer from the template of decisions.json. Fill in resolution (RESOLVED_BY_ARCHITECT, ACCEPTED_DIFFERENCE, ACCEPTED_LOSS, ACCEPTED_REDESIGN, or REJECTED when the proposal is not accepted: the decision then stays open), reviewed_by (the role that answers), reviewed_at (the date), rationale, evidence_refs (at least one reference for an answer that accepts) and, for a record that states options, chosen_option; keep id, members, members_sha256 and artifact_sha256 as the template gives them. Then run stacktoit assess --decisions FILE on the same source: an answer frees only the steps its effect allows, and a freed step says which answer freed it.

Required credentials

• OpenTofu: the STACKIT provider reads its credentials from the environment, for example STACKIT_SERVICE_ACCOUNT_KEY_PATH (the path of a service account key file); the account needs the roles that create the resources of the steps. terraform/README.md says what the draft needs.
• OpenTofu variables a step needs a value for before it runs (a variable without a default, or one the plan does not take as given): alb_interval_jitter, dependencies_catalog_opensearch_this_plan_name, dependencies_catalog_opensearch_this_version, dependencies_catalog_rds_this_plan_name, dependencies_checkout_elasticache_redis_default_allowed_cidrs, dependencies_checkout_elasticache_redis_default_version, dependencies_mq_version, dependencies_orders_rds_this_storage_size, dynamodb_tables_allowed_cidrs, dynamodb_tables_cpu, dynamodb_tables_pitr_hours, dynamodb_tables_ram, dynamodb_tables_storage_gb, kms_access_scope, kms_protection, mongodbflex_storage_class, postgresflex_storage_class, project_id, retail_app_ecs_alb_this_health_ok_status, retail_app_ecs_alb_this_network_id_target, retail_app_ecs_alb_this_target_ips, retail_app_ecs_carts_service_task_execution_role_project_roles, retail_app_ecs_carts_service_task_role_project_roles, retail_app_ecs_catalog_service_task_execution_role_project_roles, retail_app_ecs_catalog_service_task_role_project_roles, retail_app_ecs_checkout_service_task_execution_role_project_roles, retail_app_ecs_checkout_service_task_role_project_roles, retail_app_ecs_cluster_machine_type, retail_app_ecs_cluster_nodes_max, retail_app_ecs_cluster_nodes_min, retail_app_ecs_orders_service_task_execution_role_project_roles, retail_app_ecs_orders_service_task_role_project_roles, retail_app_ecs_ui_service_task_execution_role_project_roles, retail_app_ecs_ui_service_task_role_project_roles, sg_retail_app_ecs_carts_service_this_name, sg_retail_app_ecs_catalog_service_this_name, sg_retail_app_ecs_checkout_service_this_name, sg_retail_app_ecs_orders_service_this_name, sg_retail_app_ecs_ui_service_this_name, vpc_vpc_private_count, vpc_vpc_private_ipv4_prefixes, vpc_vpc_public_count, vpc_vpc_public_ipv4_prefixes.
• OpenTofu variables the steps read with the default the draft declares (check each): availability_zones, default_ipv4_nameservers, dependencies_catalog_opensearch_this_allowed_cidrs, dependencies_catalog_rds_this_allowed_cidrs, dependencies_catalog_rds_this_version, dependencies_checkout_elasticache_redis_default_plan_name, dependencies_mq_allowed_cidrs, dependencies_mq_plan_name, dependencies_orders_rds_this_access_scope, dependencies_orders_rds_this_admin_roles, dependencies_orders_rds_this_allowed_cidrs, dynamodb_tables_version, retail_app_ecs_alb_this_labels, retail_app_ecs_alb_this_plan_id, sg_retail_app_ecs_alb_sg_this_name_prefix_labels, sg_retail_app_ecs_alb_this_labels.
• API scripts: each reads its credentials and inputs from the environment when it runs, and stops when one is not set: STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_CATALOG_DB, STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_CATALOG_OPENSEARCH, STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_MQ, STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_ORDERS_DB, STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB, STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH, STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ, STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB. No script holds a secret. STACKIT_INPUT_INSTANCEID, STACKIT_INPUT_PASSWORD, STACKIT_INPUT_USERNAME: the override of a value the draft writes as an output; when it is not set and tofu is installed, the script reads it with tofu -chdir=terraform output -raw <output> once the draft is applied (the request file lists the output of each). STACKIT_API_URL_SECRETS_MANAGER_VAULT may name another base address; without it the script uses the documented address of the service for the region of the draft.

Execution order

The steps in the order they are carried out: a step comes after every step it depends on. A step is named here without the name of the generator that made it; execution-plan.json holds the full id of each.

A text that many steps share word for word is written once here, with what is the step's own in braces ({name} for the name of a resource, {address} for an IP address or network, {steps} for the steps a state names). A line below names the wording of what its step does (W) and the state it is in (S), and gives after "Where" what stands for the braces.

• S1 (39 steps): not executable as the plan stands: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this

Prepare

1. The decision step of module.vpc.module.vpc.aws_route_table.private (DEC/routing/DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST) — manual step: Answer decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST: Decide the egress address of module.vpc.module.vpc.aws_route_table.private: keep the changing address of the STACKIT network, or give each server that an allow-list names a STACKIT public IP. (not executable — requires a design decision — blocked by DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST)
2. The step "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this…" (MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.execution_role_arn-586451) — manual step: …pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach. (executable: a person can start it now)
3. The step "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this gets…" (MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.task_role_arn-686488) — manual step: …its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it. (executable: a person can start it now)
4. The step "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this…" (MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.execution_role_arn-dedc98) — manual step: …pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach. (executable: a person can start it now)
5. The step "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this…" (MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.task_role_arn-15a967) — manual step: …gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it. (executable: a person can start it now)
6. The step "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this…" (MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.execution_role_arn-b70bc2) — manual step: …pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach. (executable: a person can start it now)
7. The step "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this…" (MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.task_role_arn-9651e2) — manual step: …gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it. (executable: a person can start it now)
8. The step "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this…" (MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.execution_role_arn-eacc48) — manual step: …pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach. (executable: a person can start it now)
9. The step "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this…" (MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.task_role_arn-d0b927) — manual step: …gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it. (executable: a person can start it now)
10. The step "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this pulls…" (MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.execution_role_arn-2d22d2) — manual step: …images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach. (executable: a person can start it now)
11. The step "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this gets…" (MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.task_role_arn-0c66b7) — manual step: …its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it. (executable: a person can start it now)
12. The routing precondition of module.vpc.module.vpc.aws_route_table.private (MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.private) — manual step: Create the target project outside a Network Area: module.vpc.module.vpc.aws_route_table.private is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area. (executable: a person can start it now)
13. The routing precondition of module.vpc.module.vpc.aws_route_table.public (MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.public) — manual step: Create the target project outside a Network Area: module.vpc.module.vpc.aws_route_table.public is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area. (executable: a person can start it now)
14. The step "Place the source rule…" (MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules.0-217968) — manual step: …module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] on the security group it belongs to and write it. (executable: a person can start it now)
15. The step "Place the source rule…" (MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules.0-f26028) — manual step: …module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] on the security group it belongs to and write it. (executable: a person can start it now)

Foundation

1. The setting public-address of module.vpc.module.vpc.aws_eip.nat (MAN/semantic/module.vpc.module.vpc.aws_eip.nat/public-address) — manual step: Decide what the STACKIT target of module.vpc.module.vpc.aws_eip.nat (aws_eip) does for its critical setting public-address, which the draft does not carry, and set it up by hand, or record that production does not need it. (executable: a person can start it now)
2. The setting network-topology-boundary of module.vpc.module.vpc.aws_internet_gateway.this (MAN/semantic/module.vpc.module.vpc.aws_internet_gateway.this/network-topology-boundary) — manual step: Decide what the STACKIT target of module.vpc.module.vpc.aws_internet_gateway.this (aws_internet_gateway) does for its critical setting network-topology-boundary, which the draft does not carry, and set it up by hand, or record that production does not need it. (executable: a person can start it now)
3. The review of the open settings of module.vpc.module.vpc.aws_nat_gateway.this (MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings) — manual step: Review the 3 open critical settings of module.vpc.module.vpc.aws_nat_gateway.this (aws_nat_gateway) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, fixed-egress-ip, nat-placement). (executable: a person can start it now)
4. The review of the open settings of module.vpc.module.vpc.aws_route_table.private (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings) — manual step: Review the 8 open critical settings of module.vpc.module.vpc.aws_route_table.private (aws_route_table) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (routes, route-destinations, route-targets, nat-fixed-egress-address, egress-restriction, subnet-association-target, tcr-route-table-vpc-id, network-topology-boundary). (executable: a person can start it now)
5. The review of the open settings of module.vpc.module.vpc.aws_route_table.public (MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings) — manual step: Review the 5 open critical settings of module.vpc.module.vpc.aws_route_table.public (aws_route_table) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (routes, route-destinations, route-targets, tcr-route-table-vpc-id, network-topology-boundary). (executable: a person can start it now)
6. The setting availability-zone of module.vpc.module.vpc.aws_subnet.private (MAN/semantic/module.vpc.module.vpc.aws_subnet.private/availability-zone) — manual step: Decide what the STACKIT target of module.vpc.module.vpc.aws_subnet.private (aws_subnet) does for its critical setting availability-zone, which the draft does not carry, and set it up by hand, or record that production does not need it. (executable: a person can start it now)
7. The review of the open settings of module.vpc.module.vpc.aws_subnet.private (MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect) — manual step: Review the 4 open critical settings of module.vpc.module.vpc.aws_subnet.private (aws_subnet) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (subnet-vpc-membership, network-topology-boundary, private-egress-ipv4, prefix). (executable: a person can start it now)
8. The setting availability-zone of module.vpc.module.vpc.aws_subnet.public (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/availability-zone) — manual step: Decide what the STACKIT target of module.vpc.module.vpc.aws_subnet.public (aws_subnet) does for its critical setting availability-zone, which the draft does not carry, and set it up by hand, or record that production does not need it. (executable: a person can start it now)
9. The review of the open settings of module.vpc.module.vpc.aws_subnet.public (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect) — manual step: Review the 5 open critical settings of module.vpc.module.vpc.aws_subnet.public (aws_subnet) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (subnet-vpc-membership, network-topology-boundary, effective-route-table, private-egress-ipv4, prefix). (executable: a person can start it now)
10. The setting dns-settings of module.vpc.module.vpc.aws_vpc.this (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/dns-settings) — manual step: Decide what the STACKIT target of module.vpc.module.vpc.aws_vpc.this (aws_vpc) does for its critical setting dns-settings, which the draft does not carry, and set it up by hand, or record that production does not need it. (executable: a person can start it now)
11. The review of the open settings of module.vpc.module.vpc.aws_vpc.this (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect) — manual step: Review the 5 open critical settings of module.vpc.module.vpc.aws_vpc.this (aws_vpc) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, default-nacl-rules, default-route-table, default-security-group-omitted-direction, main-table-set). (executable: a person can start it now)
12. The OpenTofu step for stackit_network.vpc_vpc_private (TF/stackit_network.vpc_vpc_private) — OpenTofu: creates stackit_network.vpc_vpc_private (terraform/network.tf). After step 12. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-WORKLOAD-PLACEMENT; it also comes after step 12, a manual prerequisite; and, as the plan states: the migration of module.vpc.module.vpc.aws_subnet.private is not complete with this step: 5 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (5 manual, 0 refused): subnet-vpc-membership, network-topology-boundary, private-egress-ipv4, prefix, availability-zone; the source creates module.vpc.module.vpc.aws_subnet.private only under a condition (applies only if its count (local.create_private_subnets ? local.len_private_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source): this step creates its target as the variables of the draft decide, so check that they create it exactly when the source's condition holds)
13. The OpenTofu step for stackit_network.vpc_vpc_public (TF/stackit_network.vpc_vpc_public) — OpenTofu: creates stackit_network.vpc_vpc_public (terraform/network.tf). After step 13. (executable once its manual prerequisite is done: it waits for step 13, a manual prerequisite)

Security

1. The security acceptance of module.retail_app_ecs.module.alb.aws_lb.this (MAN/security/accept/module.retail_app_ecs.module.alb.aws_lb.this:plaintext-public-listener) — manual step: Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.alb.aws_lb.this (PLAINTEXT_PUBLIC_LISTENER): The source load balancer module.retail_app_ecs.module.alb.aws_lb.this is internet-facing and every listener it states is HTTP (port 80 forwards to its targets, no listener is HTTPS or TLS): clients reach the application without transport encryption. (executable: a person can start it now)
2. The step "Design the security attachment of…" (MAN/security/attachment-design:module.retail_app_ecs.module.carts_service.aws_security_group.this) — manual step: …module.retail_app_ecs.module.carts_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.carts_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this)
3. The security acceptance of module.retail_app_ecs.module.carts_service.aws_security_group.this (MAN/security/accept/module.retail_app_ecs.module.carts_service.aws_security_group.this:open-ingress-application-port) — manual step: Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.carts_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.carts_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. After step 30. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this; it also comes after step 30, a manual prerequisite)
4. The step "Design the security attachment of…" (MAN/security/attachment-design:module.retail_app_ecs.module.catalog_service.aws_security_group.this) — manual step: …module.retail_app_ecs.module.catalog_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this)
5. The security acceptance of module.retail_app_ecs.module.catalog_service.aws_security_group.this (MAN/security/accept/module.retail_app_ecs.module.catalog_service.aws_security_group.this:open-ingress-application-port) — manual step: Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.catalog_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.catalog_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. After step 32. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this; it also comes after step 32, a manual prerequisite)
6. The step "Design the security attachment of…" (MAN/security/attachment-design:module.retail_app_ecs.module.checkout_service.aws_security_group.this) — manual step: …module.retail_app_ecs.module.checkout_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this)
7. The security acceptance of module.retail_app_ecs.module.checkout_service.aws_security_group.this (MAN/security/accept/module.retail_app_ecs.module.checkout_service.aws_security_group.this:open-ingress-application-port) — manual step: Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.checkout_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.checkout_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. After step 34. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this; it also comes after step 34, a manual prerequisite)
8. The step "Design the security attachment of…" (MAN/security/attachment-design:module.retail_app_ecs.module.orders_service.aws_security_group.this) — manual step: …module.retail_app_ecs.module.orders_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.orders_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this)
9. The security acceptance of module.retail_app_ecs.module.orders_service.aws_security_group.this (MAN/security/accept/module.retail_app_ecs.module.orders_service.aws_security_group.this:open-ingress-application-port) — manual step: Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.orders_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.orders_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. After step 36. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this; it also comes after step 36, a manual prerequisite)
10. The step "Design the security attachment of…" (MAN/security/attachment-design:module.retail_app_ecs.module.ui_service.aws_security_group.this) — manual step: …module.retail_app_ecs.module.ui_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.ui_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
11. The security acceptance of module.retail_app_ecs.module.ui_service.aws_security_group.this (MAN/security/accept/module.retail_app_ecs.module.ui_service.aws_security_group.this:open-ingress-application-port) — manual step: Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.ui_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.ui_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. After step 38. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this; it also comes after step 38, a manual prerequisite)
12. The review of the open settings of module.dependencies.aws_security_group.catalog_opensearch_sg (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings) — manual step: Review the 5 open critical settings of module.dependencies.aws_security_group.catalog_opensearch_sg (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, egress-restriction, standalone-rule-not-generated, standalone-rule-remote-not-resolved). (executable: a person can start it now)
13. The review of the open settings of module.dependencies.aws_security_group.mq (MAN/semantic/module.dependencies.aws_security_group.mq/open-settings) — manual step: Review the 4 open critical settings of module.dependencies.aws_security_group.mq (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, egress-restriction, standalone-rule-not-generated). (executable: a person can start it now)
14. The review of the open settings of module.dependencies.module.catalog_rds.aws_security_group.this (MAN/semantic/module.dependencies.module.catalog_rds.aws_security_group.this/open-settings) — manual step: Review the 5 open critical settings of module.dependencies.module.catalog_rds.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, egress-restriction, rule-ports, standalone-rule-values). (executable: a person can start it now)
15. The review of the open settings of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings) — manual step: Review the 6 open critical settings of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, rule-ports, standalone-rule-values, standalone-rule-other-sources, standalone-rule-empty-sources). (executable: a person can start it now)
16. The review of the open settings of module.dependencies.module.orders_rds.aws_security_group.this (MAN/semantic/module.dependencies.module.orders_rds.aws_security_group.this/open-settings) — manual step: Review the 5 open critical settings of module.dependencies.module.orders_rds.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, egress-restriction, rule-ports, standalone-rule-values). (executable: a person can start it now)
17. The setting deletion-window of module.retail_app_ecs.aws_kms_key.cmk (MAN/semantic/module.retail_app_ecs.aws_kms_key.cmk/deletion-window) — manual step: Decide what the STACKIT target of module.retail_app_ecs.aws_kms_key.cmk (aws_kms_key) does for its critical setting deletion-window, which the draft does not carry, and set it up by hand, or record that production does not need it. (executable: a person can start it now)
18. The review of the open settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/open-settings-security-architect) — manual step: Review the 2 open critical settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (secret-value, customer-managed-key). (executable: a person can start it now)
19. The setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/tc-secretsmanager-secret-name) — manual step: Choose the Vault path the secret module.retail_app_ecs.aws_secretsmanager_secret.catalog_db is written under in the Secrets Manager instance of the draft, set it in STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB (the input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db), and point the applications that look the secret up by name at that path. (executable: a person can start it now)
20. The review of the open settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/open-settings-security-architect) — manual step: Review the 2 open critical settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (secret-value, customer-managed-key). (executable: a person can start it now)
21. The setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/tc-secretsmanager-secret-name) — manual step: Choose the Vault path the secret module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch is written under in the Secrets Manager instance of the draft, set it in STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH (the input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch), and point the applications that look the secret up by name at that path. (executable: a person can start it now)
22. The setting secret-value of module.retail_app_ecs.aws_secretsmanager_secret.mq (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.mq/secret-value) — manual step: Supply the value of the secret module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret) through the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq: put the JSON object of its key/value pairs in a file outside the package and keep it out of version control, name the file in STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_MQ, the sensitive input of that step, and run the step; the value is not set up by hand and the script of the step is what sends it. (executable: a person can start it now)
23. The setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.mq (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.mq/tc-secretsmanager-secret-name) — manual step: Choose the Vault path the secret module.retail_app_ecs.aws_secretsmanager_secret.mq is written under in the Secrets Manager instance of the draft, set it in STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ (the input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq), and point the applications that look the secret up by name at that path. (executable: a person can start it now)
24. The setting secret-value of module.retail_app_ecs.aws_secretsmanager_secret.orders_db (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.orders_db/secret-value) — manual step: Supply the value of the secret module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret) through the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db: put the JSON object of its key/value pairs in a file outside the package and keep it out of version control, name the file in STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_ORDERS_DB, the sensitive input of that step, and run the step; the value is not set up by hand and the script of the step is what sends it. (executable: a person can start it now)
25. The setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.orders_db (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.orders_db/tc-secretsmanager-secret-name) — manual step: Choose the Vault path the secret module.retail_app_ecs.aws_secretsmanager_secret.orders_db is written under in the Secrets Manager instance of the draft, set it in STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB (the input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db), and point the applications that look the secret up by name at that path. (executable: a person can start it now)
26. The review of the open settings of module.retail_app_ecs.module.alb.aws_security_group.this (MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings) — manual step: Review the 3 open critical settings of module.retail_app_ecs.module.alb.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, egress-restriction). (executable: a person can start it now)
27. The review of the open settings of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings) — manual step: Review the 6 open critical settings of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, rule-ports, standalone-rule-values, standalone-rule-other-sources, standalone-rule-empty-sources). (executable: a person can start it now)
28. The review of the open settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-ecs). (executable: a person can start it now)
29. The review of the open settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-customer-policy). (executable: a person can start it now)
30. The review of the open settings of module.retail_app_ecs.module.carts_service.aws_security_group.this (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_security_group.this/open-settings) — manual step: Review the 6 open critical settings of module.retail_app_ecs.module.carts_service.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, rule-ports, egress-rule-protocol, ingress-sources, egress-sources). (executable: a person can start it now)
31. The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-ecs). (executable: a person can start it now)
32. The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-customer-policy). (executable: a person can start it now)
33. The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_security_group.this (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_security_group.this/open-settings) — manual step: Review the 6 open critical settings of module.retail_app_ecs.module.catalog_service.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, rule-ports, egress-rule-protocol, ingress-sources, egress-sources). (executable: a person can start it now)
34. The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-ecs). (executable: a person can start it now)
35. The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-customer-policy). (executable: a person can start it now)
36. The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_security_group.this (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_security_group.this/open-settings) — manual step: Review the 6 open critical settings of module.retail_app_ecs.module.checkout_service.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, rule-ports, egress-rule-protocol, ingress-sources, egress-sources). (executable: a person can start it now)
37. The review of the open settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-ecs). (executable: a person can start it now)
38. The review of the open settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-customer-policy). (executable: a person can start it now)
39. The review of the open settings of module.retail_app_ecs.module.orders_service.aws_security_group.this (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_security_group.this/open-settings) — manual step: Review the 6 open critical settings of module.retail_app_ecs.module.orders_service.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, rule-ports, egress-rule-protocol, ingress-sources, egress-sources). (executable: a person can start it now)
40. The review of the open settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-ecs). (executable: a person can start it now)
41. The review of the open settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-customer-policy). (executable: a person can start it now)
42. The review of the open settings of module.retail_app_ecs.module.ui_service.aws_security_group.this (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_security_group.this/open-settings) — manual step: Review the 6 open critical settings of module.retail_app_ecs.module.ui_service.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, rule-ports, egress-rule-protocol, ingress-sources, egress-sources). (executable: a person can start it now)
43. The refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more (REF/root/security-group-membership-parity) — refused: not migrated: the VPC membership (the critical setting security-group-vpc-membership) of 12 AWS security groups: module.retail_app_ecs.module.alb.aws_security_group.this, module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, module.retail_app_ecs.module.carts_service.aws_security_group.this, module.retail_app_ecs.module.catalog_service.aws_security_group.this, module.retail_app_ecs.module.checkout_service.aws_security_group.this, module.retail_app_ecs.module.orders_service.aws_security_group.this, module.retail_app_ecs.module.ui_service.aws_security_group.this, module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this, module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, module.dependencies.module.orders_rds.aws_security_group.this; 7 of the drafted STACKIT security groups are orphaned (no block of the draft attaches the group, so its rules restrict nothing on STACKIT as drafted): stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix, stackit_security_group.retail_app_ecs_alb_this, stackit_security_group.retail_app_ecs_carts_service_this, stackit_security_group.retail_app_ecs_catalog_service_this, stackit_security_group.retail_app_ecs_checkout_service_this, stackit_security_group.retail_app_ecs_orders_service_this, stackit_security_group.retail_app_ecs_ui_service_this. (permanently unsupported: refused, not migrated (not executable))
44. The OpenTofu step for stackit_kms_keyring.migrated (TF/stackit_kms_keyring.migrated) — OpenTofu: creates stackit_kms_keyring.migrated (terraform/security.tf). (executable: it can run now)
45. The OpenTofu step for stackit_kms_key.retail_app_ecs_cmk (TF/stackit_kms_key.retail_app_ecs_cmk) — OpenTofu: creates stackit_kms_key.retail_app_ecs_cmk (terraform/security.tf). After step 72. (executable: it can run now)
46. The OpenTofu step for stackit_secretsmanager_instance.migrated_secrets (TF/stackit_secretsmanager_instance.migrated_secrets) — OpenTofu: creates stackit_secretsmanager_instance.migrated_secrets (terraform/security.tf). (executable: it can run now)
47. The OpenTofu step for stackit_secretsmanager_user.migration (TF/stackit_secretsmanager_user.migration) — OpenTofu: creates stackit_secretsmanager_user.migration (terraform/security.tf). After step 74. (executable: it can run now)
48. The STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db) — STACKIT API call: secrets-manager-vault WriteSecret (execution/api/secrets-manager-vault/001-writesecret.sh). Step state: generated, tested offline. After steps 74, 75. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-API-OPT-IN; and, as the plan states: Required input: STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_CATALOG_DB names a file (keep it outside the package and out of version control) that holds the JSON object of the key/value pairs the secret at the path STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB names has on STACKIT. StackToIT never reads the value of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db from the source, so the document is yours: the same value from a secure source, or a new one. The source builds the value (its version resource, attribute secret_string) from module.dependencies.module.catalog_rds.aws_rds_cluster.this: the document holds the matching values on STACKIT, under the keys the consumers of the secret read (the key names are in the source's secret_string, which the scan does not read); The password in the document is the one of the master user the draft creates on STACKIT, not the AWS one (module.dependencies.module.catalog_rds.aws_rds_cluster.this: the sensitive output dependencies_catalog_rds_this_admin_password): read it with tofu output after that database step has run, and write it into the file yourself; the host and the port are in the connection data of the drafted instance; The path of the secret is an input: STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB names it (the source does not state the name as a literal the plan can rely on), so this step does not carry the setting name and its manual step stays; the applications read the secret by the path you choose; The step logs in as the migration user stackit_secretsmanager_user.migration (write_enabled = true), which reaches every secret of stackit_secretsmanager_instance.migrated_secrets and whose generated password is in the OpenTofu state (a sensitive attribute): delete the user (remove its block from the draft and apply) once the secrets are written. The script reads the username and password with tofu output, or from STACKIT_INPUT_USERNAME and STACKIT_INPUT_PASSWORD, and prints neither; The write makes a new version of the secret. The script reads the secret first (ReadSecret) and stops without writing (exit 4) when it already has a current version, unless STACKIT_CONFIRM_REPLACE is set to the path of the secret; it does not read the values back and prints none; STACKIT's page shows neither the answer of the login nor the status of a read of a secret that has no version: the script takes the token from auth.client_token and reads 404 as "no current version" (the Vault KV version 2 API the page calls compatible), and stops on any other answer. The API states no release status, so the call waits for the opt-in to it; The call carries the path and the value of the secret only; its customer-managed key: it has no counterpart in the call, so it stays open in the steps of the setting (a rotation is never carried); the maturity of the Secrets Manager Vault-compatible API is not established (its documentation states no release status): a call of it is not executed without an explicit opt-in (DEC-GEN-CONVERT-API-OPT-IN); the migration of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db is not complete with this step: 3 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (3 manual, 0 refused): secret-value, customer-managed-key, tc-secretsmanager-secret-name)
49. The STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch) — STACKIT API call: secrets-manager-vault WriteSecret (execution/api/secrets-manager-vault/002-writesecret.sh). Step state: generated, tested offline. After steps 74, 75. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-API-OPT-IN; and, as the plan states: Required input: STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_CATALOG_OPENSEARCH names a file (keep it outside the package and out of version control) that holds the JSON object of the key/value pairs the secret at the path STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH names has on STACKIT. StackToIT never reads the value of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch from the source, so the document is yours: the same value from a secure source, or a new one. The source builds the value (its version resource, attribute secret_string) from a value it generates itself (module.dependencies.random_string.catalog_opensearch_master): the document holds the matching values on STACKIT (for a generated value, one you generate or choose for STACKIT: the generated one is only in the source's state), under the keys the consumers of the secret read (the key names are in the source's secret_string, which the scan does not read); The path of the secret is an input: STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH names it (the source does not state the name as a literal the plan can rely on), so this step does not carry the setting name and its manual step stays; the applications read the secret by the path you choose; The step logs in as the migration user stackit_secretsmanager_user.migration (write_enabled = true), which reaches every secret of stackit_secretsmanager_instance.migrated_secrets and whose generated password is in the OpenTofu state (a sensitive attribute): delete the user (remove its block from the draft and apply) once the secrets are written. The script reads the username and password with tofu output, or from STACKIT_INPUT_USERNAME and STACKIT_INPUT_PASSWORD, and prints neither; The write makes a new version of the secret. The script reads the secret first (ReadSecret) and stops without writing (exit 4) when it already has a current version, unless STACKIT_CONFIRM_REPLACE is set to the path of the secret; it does not read the values back and prints none; STACKIT's page shows neither the answer of the login nor the status of a read of a secret that has no version: the script takes the token from auth.client_token and reads 404 as "no current version" (the Vault KV version 2 API the page calls compatible), and stops on any other answer. The API states no release status, so the call waits for the opt-in to it; The call carries the path and the value of the secret only; its customer-managed key: it has no counterpart in the call, so it stays open in the steps of the setting (a rotation is never carried); the maturity of the Secrets Manager Vault-compatible API is not established (its documentation states no release status): a call of it is not executed without an explicit opt-in (DEC-GEN-CONVERT-API-OPT-IN); the migration of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch is not complete with this step: 3 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (3 manual, 0 refused): secret-value, customer-managed-key, tc-secretsmanager-secret-name)
50. The STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq (API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq) — STACKIT API call: secrets-manager-vault WriteSecret (execution/api/secrets-manager-vault/003-writesecret.sh). Step state: generated, tested offline. After steps 74, 75. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-API-OPT-IN; and, as the plan states: Required input: STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_MQ names a file (keep it outside the package and out of version control) that holds the JSON object of the key/value pairs the secret at the path STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ names has on STACKIT. StackToIT never reads the value of module.retail_app_ecs.aws_secretsmanager_secret.mq from the source, so the document is yours: the same value from a secure source, or a new one. The source builds the value (its version resource, attribute secret_string) from module.dependencies.aws_mq_broker.mq and a value it generates itself (module.dependencies.random_password.mq_password): the document holds the matching values on STACKIT (for a generated value, one you generate or choose for STACKIT: the generated one is only in the source's state), under the keys the consumers of the secret read (the key names are in the source's secret_string, which the scan does not read); The path of the secret is an input: STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ names it (the source does not state the name as a literal the plan can rely on), so this step does not carry the setting name and its manual step stays; the applications read the secret by the path you choose; The step logs in as the migration user stackit_secretsmanager_user.migration (write_enabled = true), which reaches every secret of stackit_secretsmanager_instance.migrated_secrets and whose generated password is in the OpenTofu state (a sensitive attribute): delete the user (remove its block from the draft and apply) once the secrets are written. The script reads the username and password with tofu output, or from STACKIT_INPUT_USERNAME and STACKIT_INPUT_PASSWORD, and prints neither; The write makes a new version of the secret. The script reads the secret first (ReadSecret) and stops without writing (exit 4) when it already has a current version, unless STACKIT_CONFIRM_REPLACE is set to the path of the secret; it does not read the values back and prints none; STACKIT's page shows neither the answer of the login nor the status of a read of a secret that has no version: the script takes the token from auth.client_token and reads 404 as "no current version" (the Vault KV version 2 API the page calls compatible), and stops on any other answer. The API states no release status, so the call waits for the opt-in to it; the maturity of the Secrets Manager Vault-compatible API is not established (its documentation states no release status): a call of it is not executed without an explicit opt-in (DEC-GEN-CONVERT-API-OPT-IN); the migration of module.retail_app_ecs.aws_secretsmanager_secret.mq is not complete with this step: 2 critical settings of it that the draft does not carry are steps of their own (2 manual, 0 refused): secret-value, tc-secretsmanager-secret-name)
51. The STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db (API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db) — STACKIT API call: secrets-manager-vault WriteSecret (execution/api/secrets-manager-vault/004-writesecret.sh). Step state: generated, tested offline. After steps 74, 75. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-API-OPT-IN; and, as the plan states: Required input: STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_ORDERS_DB names a file (keep it outside the package and out of version control) that holds the JSON object of the key/value pairs the secret at the path STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB names has on STACKIT. StackToIT never reads the value of module.retail_app_ecs.aws_secretsmanager_secret.orders_db from the source, so the document is yours: the same value from a secure source, or a new one. The source builds the value (its version resource, attribute secret_string) from module.dependencies.module.orders_rds.aws_rds_cluster.this: the document holds the matching values on STACKIT, under the keys the consumers of the secret read (the key names are in the source's secret_string, which the scan does not read); The password in the document is the one of the master user the draft creates on STACKIT, not the AWS one (module.dependencies.module.orders_rds.aws_rds_cluster.this: the sensitive output dependencies_orders_rds_this_admin_password): read it with tofu output after that database step has run, and write it into the file yourself; the host and the port are in the connection data of the drafted instance; The path of the secret is an input: STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB names it (the source does not state the name as a literal the plan can rely on), so this step does not carry the setting name and its manual step stays; the applications read the secret by the path you choose; The step logs in as the migration user stackit_secretsmanager_user.migration (write_enabled = true), which reaches every secret of stackit_secretsmanager_instance.migrated_secrets and whose generated password is in the OpenTofu state (a sensitive attribute): delete the user (remove its block from the draft and apply) once the secrets are written. The script reads the username and password with tofu output, or from STACKIT_INPUT_USERNAME and STACKIT_INPUT_PASSWORD, and prints neither; The write makes a new version of the secret. The script reads the secret first (ReadSecret) and stops without writing (exit 4) when it already has a current version, unless STACKIT_CONFIRM_REPLACE is set to the path of the secret; it does not read the values back and prints none; STACKIT's page shows neither the answer of the login nor the status of a read of a secret that has no version: the script takes the token from auth.client_token and reads 404 as "no current version" (the Vault KV version 2 API the page calls compatible), and stops on any other answer. The API states no release status, so the call waits for the opt-in to it; the maturity of the Secrets Manager Vault-compatible API is not established (its documentation states no release status): a call of it is not executed without an explicit opt-in (DEC-GEN-CONVERT-API-OPT-IN); the migration of module.retail_app_ecs.aws_secretsmanager_secret.orders_db is not complete with this step: 2 critical settings of it that the draft does not carry are steps of their own (2 manual, 0 refused): secret-value, tc-secretsmanager-secret-name)
52. The OpenTofu step for stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix (TF/stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix) — OpenTofu: creates stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix (terraform/security.tf). (executable: it can run now)
53. The step "Re-create the rules beyond the known set of group…" (MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules-b506f3) — manual step: …module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules). After step 80. (executable: a person can start it now)
54. The step "Re-create the rules beyond the known set of group…" (MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules-a538f6) — manual step: …module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules). After step 80. (executable: a person can start it now)
55. The OpenTofu step for stackit_security_group.retail_app_ecs_alb_this (TF/stackit_security_group.retail_app_ecs_alb_this) — OpenTofu: creates stackit_security_group.retail_app_ecs_alb_this (terraform/security.tf). (executable: it can run now)
56. The OpenTofu step for stackit_security_group.retail_app_ecs_carts_service_this (TF/stackit_security_group.retail_app_ecs_carts_service_this) — OpenTofu: creates stackit_security_group.retail_app_ecs_carts_service_this (terraform/security.tf). (executable: it can run now)
57. The OpenTofu step for stackit_security_group.retail_app_ecs_catalog_service_this (TF/stackit_security_group.retail_app_ecs_catalog_service_this) — OpenTofu: creates stackit_security_group.retail_app_ecs_catalog_service_this (terraform/security.tf). (executable: it can run now)
58. The OpenTofu step for stackit_security_group.retail_app_ecs_checkout_service_this (TF/stackit_security_group.retail_app_ecs_checkout_service_this) — OpenTofu: creates stackit_security_group.retail_app_ecs_checkout_service_this (terraform/security.tf). (executable: it can run now)
59. The OpenTofu step for stackit_security_group.retail_app_ecs_orders_service_this (TF/stackit_security_group.retail_app_ecs_orders_service_this) — OpenTofu: creates stackit_security_group.retail_app_ecs_orders_service_this (terraform/security.tf). (executable: it can run now)
60. The OpenTofu step for stackit_security_group.retail_app_ecs_ui_service_this (TF/stackit_security_group.retail_app_ecs_ui_service_this) — OpenTofu: creates stackit_security_group.retail_app_ecs_ui_service_this (terraform/security.tf). (executable: it can run now)
61. The OpenTofu step for stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1 (TF/stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1) — OpenTofu: creates stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1 (terraform/security.tf). After step 84. (executable: it can run now)
62. The OpenTofu step for stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1 (TF/stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1) — OpenTofu: creates stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1 (terraform/security.tf). After step 85. (executable: it can run now)
63. The OpenTofu step for stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1 (TF/stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1) — OpenTofu: creates stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1 (terraform/security.tf). After step 86. (executable: it can run now)
64. The OpenTofu step for stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1 (TF/stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1) — OpenTofu: creates stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1 (terraform/security.tf). After step 87. (executable: it can run now)
65. The OpenTofu step for stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1 (TF/stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1) — OpenTofu: creates stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1 (terraform/security.tf). After step 88. (executable: it can run now)
66. The OpenTofu step for stackit_service_account.retail_app_ecs_carts_service_task_execution_role (TF/stackit_service_account.retail_app_ecs_carts_service_task_execution_role) — OpenTofu: creates stackit_service_account.retail_app_ecs_carts_service_task_execution_role (terraform/identity.tf). (executable: it can run now)
67. The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role (TF/stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role) — OpenTofu: creates stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role (terraform/identity.tf). After step 94. (executable: it can run now)
68. The OpenTofu step for stackit_service_account.retail_app_ecs_carts_service_task_role (TF/stackit_service_account.retail_app_ecs_carts_service_task_role) — OpenTofu: creates stackit_service_account.retail_app_ecs_carts_service_task_role (terraform/identity.tf). (executable: it can run now)
69. The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role (TF/stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role) — OpenTofu: creates stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role (terraform/identity.tf). After step 96. (executable: it can run now)
70. The OpenTofu step for stackit_service_account.retail_app_ecs_catalog_service_task_execution_role (TF/stackit_service_account.retail_app_ecs_catalog_service_task_execution_role) — OpenTofu: creates stackit_service_account.retail_app_ecs_catalog_service_task_execution_role (terraform/identity.tf). (executable: it can run now)
71. The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role (TF/stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role) — OpenTofu: creates stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role (terraform/identity.tf). After step 98. (executable: it can run now)
72. The OpenTofu step for stackit_service_account.retail_app_ecs_catalog_service_task_role (TF/stackit_service_account.retail_app_ecs_catalog_service_task_role) — OpenTofu: creates stackit_service_account.retail_app_ecs_catalog_service_task_role (terraform/identity.tf). (executable: it can run now)
73. The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role (TF/stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role) — OpenTofu: creates stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role (terraform/identity.tf). After step 100. (executable: it can run now)
74. The OpenTofu step for stackit_service_account.retail_app_ecs_checkout_service_task_execution_role (TF/stackit_service_account.retail_app_ecs_checkout_service_task_execution_role) — OpenTofu: creates stackit_service_account.retail_app_ecs_checkout_service_task_execution_role (terraform/identity.tf). (executable: it can run now)
75. The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role (TF/stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role) — OpenTofu: creates stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role (terraform/identity.tf). After step 102. (executable: it can run now)
76. The OpenTofu step for stackit_service_account.retail_app_ecs_checkout_service_task_role (TF/stackit_service_account.retail_app_ecs_checkout_service_task_role) — OpenTofu: creates stackit_service_account.retail_app_ecs_checkout_service_task_role (terraform/identity.tf). (executable: it can run now)
77. The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role (TF/stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role) — OpenTofu: creates stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role (terraform/identity.tf). After step 104. (executable: it can run now)
78. The OpenTofu step for stackit_service_account.retail_app_ecs_orders_service_task_execution_role (TF/stackit_service_account.retail_app_ecs_orders_service_task_execution_role) — OpenTofu: creates stackit_service_account.retail_app_ecs_orders_service_task_execution_role (terraform/identity.tf). (executable: it can run now)
79. The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role (TF/stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role) — OpenTofu: creates stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role (terraform/identity.tf). After step 106. (executable: it can run now)
80. The OpenTofu step for stackit_service_account.retail_app_ecs_orders_service_task_role (TF/stackit_service_account.retail_app_ecs_orders_service_task_role) — OpenTofu: creates stackit_service_account.retail_app_ecs_orders_service_task_role (terraform/identity.tf). (executable: it can run now)
81. The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role (TF/stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role) — OpenTofu: creates stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role (terraform/identity.tf). After step 108. (executable: it can run now)
82. The OpenTofu step for stackit_service_account.retail_app_ecs_ui_service_task_execution_role (TF/stackit_service_account.retail_app_ecs_ui_service_task_execution_role) — OpenTofu: creates stackit_service_account.retail_app_ecs_ui_service_task_execution_role (terraform/identity.tf). (executable: it can run now)
83. The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role (TF/stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role) — OpenTofu: creates stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role (terraform/identity.tf). After step 110. (executable: it can run now)
84. The OpenTofu step for stackit_service_account.retail_app_ecs_ui_service_task_role (TF/stackit_service_account.retail_app_ecs_ui_service_task_role) — OpenTofu: creates stackit_service_account.retail_app_ecs_ui_service_task_role (terraform/identity.tf). (executable: it can run now)
85. The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role (TF/stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role) — OpenTofu: creates stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role (terraform/identity.tf). After step 112. (executable: it can run now)

Data services

1. The setting encryption-at-rest of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/encryption-at-rest) — manual step: Decide what the STACKIT target of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) does for its critical setting encryption-at-rest, which the draft does not carry, and set it up by hand, or record that production does not need it. (executable: a person can start it now)
2. The review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect) — manual step: Review the 5 open critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (fine-grained-access, domain-settings, access-and-encryption-settings, nbr-aws-opensearch-domain-policy, opensearch-domain-policy-resource). (executable: a person can start it now)
3. The review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect) — manual step: Review the 2 open critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (private-endpoint, network-settings). (executable: a person can start it now)
4. The review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect) — manual step: Review the 4 open critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (engine-version, cluster-layout-settings, storage-settings, tc-opensearch-domain-domain-name). (executable: a person can start it now)
5. The setting admin-username-not-carried of module.dependencies.module.catalog_rds.aws_rds_cluster.this (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/admin-username-not-carried) — manual step: Decide what the STACKIT target of module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) does for its critical setting admin-username-not-carried, which the draft does not carry, and set it up by hand, or record that production does not need it. (executable: a person can start it now)
6. The review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect) — manual step: Review the 2 open critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (backup-retention, final-snapshot). (executable: a person can start it now)
7. The review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-network-architect) — manual step: Review the 3 open critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (db-network-placement, security-groups, member-settings). (executable: a person can start it now)
8. The review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect) — manual step: Review the 5 open critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (engine, engine-version, member-engine, tc-database-name, tcf-rds-cluster-instance--identifier). (executable: a person can start it now)
9. The review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect) — manual step: Review the 3 open critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (storage-encryption, admin-password, parameter-and-option-groups). (executable: a person can start it now)
10. The setting network-placement of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/network-placement) — manual step: Decide what the STACKIT target of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) does for its critical setting network-placement, which the draft does not carry, and set it up by hand, or record that production does not need it. (executable: a person can start it now)
11. The review of the open settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect) — manual step: Review the 2 open critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (snapshots-off, seed-snapshot). (executable: a person can start it now)
12. The review of the open settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect) — manual step: Review the 4 open critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (parameter-group, parameter-group-default, failover-off, tc-elasticache-replication-group-replication-group-id). (executable: a person can start it now)
13. The review of the open settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect) — manual step: Review the 2 open critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (at-rest-encryption-off, tcp-elasticache-replication-group-transit-encryption-enabled). (executable: a person can start it now)
14. The setting encryption-at-rest of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/encryption-at-rest) — manual step: Decide what the STACKIT target of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) does for its critical setting encryption-at-rest, which the draft does not carry, and set it up by hand, or record that production does not need it. (executable: a person can start it now)
15. The review of the open settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect) — manual step: Review the 3 open critical settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (key-schema, point-in-time-recovery, ttl). (executable: a person can start it now)
16. The review of the open settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect) — manual step: Review the 2 open critical settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (index-projection-and-name, tc-dynamodb-table-name). (executable: a person can start it now)
17. The setting admin-username-not-carried of module.dependencies.module.orders_rds.aws_rds_cluster.this (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/admin-username-not-carried) — manual step: Decide what the STACKIT target of module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) does for its critical setting admin-username-not-carried, which the draft does not carry, and set it up by hand, or record that production does not need it. (executable: a person can start it now)
18. The setting final-snapshot of module.dependencies.module.orders_rds.aws_rds_cluster.this (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-snapshot) — manual step: Decide what the STACKIT target of module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) does for its critical setting final-snapshot, which the draft does not carry, and set it up by hand, or record that production does not need it. (executable: a person can start it now)
19. The review of the open settings of module.dependencies.module.orders_rds.aws_rds_cluster.this (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-network-architect) — manual step: Review the 3 open critical settings of module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (db-network-placement, security-groups, member-settings). (executable: a person can start it now)
20. The review of the open settings of module.dependencies.module.orders_rds.aws_rds_cluster.this (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect) — manual step: Review the 3 open critical settings of module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (storage-encryption, admin-password, parameter-and-option-groups). (executable: a person can start it now)
21. The setting "identifier of the RDS cluster instance" of module.dependencies.module.orders_rds.aws_rds_cluster.this (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/tcf-rds-cluster-instance--identifier) — manual step: Decide what the STACKIT target of module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) does for its critical setting tcf-rds-cluster-instance--identifier, which the draft does not carry, and set it up by hand, or record that production does not need it. (executable: a person can start it now)
22. The refusal of the setting credentials-and-keys-settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/credentials-and-keys-settings) — refused: not migrated: the critical setting credentials-and-keys-settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this. (permanently unsupported: refused, not migrated (not executable))
23. The refusal of the setting domain-credentials-and-keys of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/domain-credentials-and-keys) — refused: not migrated: the critical setting domain-credentials-and-keys of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this. (permanently unsupported: refused, not migrated (not executable))
24. The OpenTofu step for stackit_mongodbflex_instance.dynamodb_tables (TF/stackit_mongodbflex_instance.dynamodb_tables) — OpenTofu: creates stackit_mongodbflex_instance.dynamodb_tables (terraform/data.tf). (executable: it can run now)
25. The OpenTofu step for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default) — OpenTofu: creates stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (terraform/data.tf). (executable: it can run now)
26. The OpenTofu step for stackit_valkey_credential.dependencies_checkout_elasticache_redis_default (TF/stackit_valkey_credential.dependencies_checkout_elasticache_redis_default) — OpenTofu: creates stackit_valkey_credential.dependencies_checkout_elasticache_redis_default (terraform/data.tf). After step 138. (executable: it can run now)
27. The data preflight of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/preflight) — manual step: Close what the plan lists as UNKNOWN, from the move host, with read-only commands; no password goes on a command line or into the history of the shell. Source (valkey-cli -h \<source-host> -p \<source-port> --tls, without --tls where the source has none): INFO server (the engine and its version), INFO keyspace and DBSIZE (the keys and the keys with an expiry; on every primary when cluster mode is on, listed with CLUSTER NODES), INFO memory (used_memory and maxmemory), SCAN 0 COUNT 100 with TYPE, DUMP and PTTL of a few keys of each family (the commands of the copy; the types the copy has no branch for show here), and the credential the copy signs in with. Target (after the draft is applied and the instance and a service key exist; valkey-cli -u rediss://\<target-user>@\<target-host>:\<target-port> --tls --sni \<target-host>): INFO server (Valkey 8), DBSIZE (0) and INFO memory; do not expect CONFIG, ACL or MODULE, which a probe found denied to the service key. Check that the move host is in parameters.sgw_acl of the instance (remove it afterwards), reaches both ends, and that the clients of the cache are listed with the TLS and the credential each uses. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#preflight. (terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md) After steps 138, 139. (executable: a person can start it now)
28. The data rehearsal of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/rehearsal) — manual step: Rehearse the copy on a sample into a scratch Key Value Store instance of the same plan and version as the draft's instance (a second instance, deleted afterwards: the real instance must stay empty for the final copy): copy the keys of a prefix or a few thousand keys of every family with the client of the copy (SCAN with MATCH, DUMP, PTTL, RESTORE with the remaining time to live), note the keys a second, the bytes a second and the keys RESTORE refuses, point one copy of the application at the scratch instance with TLS and run its own test suite, and compute the freeze window from the throughput: keys / (keys a second) is the lower bound of the copy. Delete the scratch instance afterwards. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#rehearsal. After step 140. (executable once its manual prerequisite is done: it waits for step 140, a manual prerequisite)

Platform services

1. The setting broker-network of module.dependencies.aws_mq_broker.mq (MAN/semantic/module.dependencies.aws_mq_broker.mq/broker-network) — manual step: Decide what the STACKIT target of module.dependencies.aws_mq_broker.mq (aws_mq_broker) does for its critical setting broker-network, which the draft does not carry, and set it up by hand, or record that production does not need it. (executable: a person can start it now)
2. The review of the open settings of module.dependencies.aws_mq_broker.mq (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect) — manual step: Review the 2 open critical settings of module.dependencies.aws_mq_broker.mq (aws_mq_broker) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (broker-users, tc-user--username). (executable: a person can start it now)
3. The review of the open settings of module.dependencies.aws_mq_broker.mq (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect) — manual step: Review the 3 open critical settings of module.dependencies.aws_mq_broker.mq (aws_mq_broker) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (engine-version, tcp-deployment-mode, tc-mq-broker-broker-name). (executable: a person can start it now)
4. The review of the open settings of module.dependencies.aws_mq_broker.mq (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect) — manual step: Review the 2 open critical settings of module.dependencies.aws_mq_broker.mq (aws_mq_broker) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-exposure, tc-user--password). (executable: a person can start it now)
5. The review of the open settings of module.retail_app_ecs.module.alb.aws_lb.this (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect) — manual step: Review the 5 open critical settings of module.retail_app_ecs.module.alb.aws_lb.this (aws_lb) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-exposure, client-restriction, request-handling, lb-routing-and-addressing, lb-subnets). (executable: a person can start it now)
6. The review of the open settings of module.retail_app_ecs.module.alb.aws_lb.this (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect) — manual step: Review the 3 open critical settings of module.retail_app_ecs.module.alb.aws_lb.this (aws_lb) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (lb-connection-timeouts, request-header-options, tc-lb-name). (executable: a person can start it now)
7. The review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-identity-architect) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-task-definition, service-execute-command, td-execution-role-arn, td-task-role-arn). (executable: a person can start it now)
8. The review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-network-architect) — manual step: Review the 5 open critical settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-discovery, service-network-placement, service-public-ip-setting, service-connect-values, td-network-mode). (executable: a person can start it now)
9. The review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-platform-architect) — manual step: Review the 2 open critical settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (task-definition, service-desired-count). (executable: a person can start it now)
10. The review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (td-container-definitions, td-container-secret-references, td-container-plaintext-secret-env, td-container-image-registry). (executable: a person can start it now)
11. The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-identity-architect) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-task-definition, service-execute-command, td-execution-role-arn, td-task-role-arn). (executable: a person can start it now)
12. The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-network-architect) — manual step: Review the 5 open critical settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-discovery, service-network-placement, service-public-ip-setting, service-connect-values, td-network-mode). (executable: a person can start it now)
13. The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-platform-architect) — manual step: Review the 2 open critical settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (task-definition, service-desired-count). (executable: a person can start it now)
14. The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (td-container-definitions, td-container-secret-references, td-container-plaintext-secret-env, td-container-image-registry). (executable: a person can start it now)
15. The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-identity-architect) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-task-definition, service-execute-command, td-execution-role-arn, td-task-role-arn). (executable: a person can start it now)
16. The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-network-architect) — manual step: Review the 5 open critical settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-discovery, service-network-placement, service-public-ip-setting, service-connect-values, td-network-mode). (executable: a person can start it now)
17. The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-platform-architect) — manual step: Review the 2 open critical settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (task-definition, service-desired-count). (executable: a person can start it now)
18. The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-security-architect) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (td-container-definitions, td-container-secret-references, td-container-plaintext-secret-env, td-container-image-registry). (executable: a person can start it now)
19. The review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-identity-architect) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-task-definition, service-execute-command, td-execution-role-arn, td-task-role-arn). (executable: a person can start it now)
20. The review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-network-architect) — manual step: Review the 5 open critical settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-discovery, service-network-placement, service-public-ip-setting, service-connect-values, td-network-mode). (executable: a person can start it now)
21. The review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-platform-architect) — manual step: Review the 2 open critical settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (task-definition, service-desired-count). (executable: a person can start it now)
22. The review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (td-container-definitions, td-container-secret-references, td-container-plaintext-secret-env, td-container-image-registry). (executable: a person can start it now)
23. The review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-identity-architect) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-task-definition, service-execute-command, td-execution-role-arn, td-task-role-arn). (executable: a person can start it now)
24. The review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect) — manual step: Review the 6 open critical settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-discovery, service-load-balancer-target, service-network-placement, service-public-ip-setting, service-connect-values, td-network-mode). (executable: a person can start it now)
25. The review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-platform-architect) — manual step: Review the 2 open critical settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (task-definition, service-desired-count). (executable: a person can start it now)
26. The review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-security-architect) — manual step: Review the 4 open critical settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (td-container-definitions, td-container-secret-references, td-container-plaintext-secret-env, td-container-image-registry). (executable: a person can start it now)
27. The manual migration of module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events (MAN/unit/module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events) — manual step: Decide how module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events (aws_cloudwatch_event_rule) moves to STACKIT and set its target up by hand, or record that it needs none: the draft writes no resource for it. (executable: a person can start it now)
28. The manual migration of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights (MAN/unit/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights) — manual step: Decide how module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights (aws_cloudwatch_log_group) moves to STACKIT and set its target up by hand, or record that it needs none: the draft writes no resource for it. (executable: a person can start it now)
29. The manual migration of module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs (MAN/unit/module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs) — manual step: Decide how module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs (aws_cloudwatch_log_resource_policy) moves to STACKIT and set its target up by hand, or record that it needs none: the draft writes no resource for it. (executable: a person can start it now)
30. The OpenTofu step for stackit_application_load_balancer.retail_app_ecs_alb_this (TF/stackit_application_load_balancer.retail_app_ecs_alb_this) — OpenTofu: creates stackit_application_load_balancer.retail_app_ecs_alb_this (terraform/loadbalancing.tf). After step 28. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH; it also comes after step 13, a manual prerequisite; and, as the plan states: the draft carries a value of stackit_application_load_balancer.retail_app_ecs_alb_this only as a guess (module.retail_app_ecs.module.alb.aws_lb.this subnets: the source load balancer names every instance of the repeated subnet module.vpc.module.vpc.aws_subnet.public, each a network of its own on STACKIT; the draft places the load balancer in one network (its layout choice; other layouts are a redesign): which instance is the placement is a decision): it is applied after a person confirms it; the migration of module.retail_app_ecs.module.alb.aws_lb.this is not complete with this step: 8 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (8 manual, 0 refused): lb-connection-timeouts, network-exposure, client-restriction, request-handling, request-header-options, lb-routing-and-addressing, lb-subnets, tc-lb-name; the support resources this step reads state 14 critical settings its block does not carry — a person decides each with this step, none is a step of its own: module.retail_app_ecs.module.alb.aws_lb_target_group.main deregistration_delay: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its deregistration_delay — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; module.retail_app_ecs.module.alb.aws_lb_target_group.main health_check.enabled: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.enabled — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; module.retail_app_ecs.module.alb.aws_lb_target_group.main health_check.healthy_threshold: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.healthy_threshold — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; module.retail_app_ecs.module.alb.aws_lb_target_group.main health_check.interval: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.interval — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; module.retail_app_ecs.module.alb.aws_lb_target_group.main health_check.path: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.path — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; module.retail_app_ecs.module.alb.aws_lb_target_group.main health_check.port: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.port — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; module.retail_app_ecs.module.alb.aws_lb_target_group.main health_check.protocol: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.protocol — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; module.retail_app_ecs.module.alb.aws_lb_target_group.main health_check.timeout: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.timeout — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; module.retail_app_ecs.module.alb.aws_lb_target_group.main health_check.unhealthy_threshold: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.unhealthy_threshold — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; module.retail_app_ecs.module.alb.aws_lb_target_group.main port: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its port — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; module.retail_app_ecs.module.alb.aws_lb_target_group.main protocol: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its protocol — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; module.retail_app_ecs.module.alb.aws_lb_target_group.main proxy_protocol_v2: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its proxy_protocol_v2 — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; module.retail_app_ecs.module.alb.aws_lb_target_group.main target_type: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its target_type — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; module.retail_app_ecs.module.alb.aws_lb_target_group.main vpc_id: a STACKIT target pool has no network of its own: the load balancer reaches the targets through the networks of its block (terraform/loadbalancing.tf, block stackit_application_load_balancer.retail_app_ecs_alb_this, target pool retail-app-ecs-alb-main), so the VPC of the target group is not carried as such)
31. The OpenTofu step for stackit_logs_instance.logs_retention_180d (TF/stackit_logs_instance.logs_retention_180d) — OpenTofu: creates stackit_logs_instance.logs_retention_180d (terraform/observability.tf). (executable: it can run now)
32. The step "Configure a cold-storage log flow for…" (MAN/logs/archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks) — manual step: …module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: send a copy of its logs, in parallel to the Logs instance stackit_logs_instance.logs_retention_180d, to a long-term store (for example a separate Object Storage bucket) that keeps them for the retention beyond 180 days. After step 172. (not executable — requires a design decision — blocked by DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS; and, as the plan states: this step holds only once DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS is answered: it is of the path archive-longer-retention-elsewhere of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks, not of a path the draft carries out by default)
33. The step "Before any log source writes to stackit_logs_instance.logs_retention_180d" (MAN/logs/token:stackit_logs_instance.logs_retention_180d) — manual step: create a write access token for the instance (stackit_logs_access_token with the permission write), set the access control list of the instance, and point the shipper at the instance's ingest_url (Loki API) or ingest_otlp_url (OpenTelemetry). After step 172. (executable: a person can start it now)
34. The step "Choose a static label and send the name of…" (MAN/logs/label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks) — manual step: …module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (and of its streams) from its log producers as the value of that label. After steps 172, 174. (executable once its manual prerequisite is done: it waits for step 174, a manual prerequisite)
35. The OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster (TF/stackit_ske_cluster.retail_app_ecs_cluster) — OpenTofu: creates stackit_ske_cluster.retail_app_ecs_cluster (terraform/kubernetes.tf). (executable: it can run now)
36. The step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health" (MAN/draft/handover/cluster-access/kubeconfig-md) — manual step: (terraform/handover/cluster-access/kubeconfig.md) After step 176. (executable: a person can start it now)
37. The OpenTofu step for stackit_mariadb_instance.dependencies_catalog_rds_this (TF/stackit_mariadb_instance.dependencies_catalog_rds_this) — OpenTofu: creates stackit_mariadb_instance.dependencies_catalog_rds_this (terraform/data.tf). After step 176. (executable: it can run now)
38. The OpenTofu step for stackit_mariadb_credential.dependencies_catalog_rds_this (TF/stackit_mariadb_credential.dependencies_catalog_rds_this) — OpenTofu: creates stackit_mariadb_credential.dependencies_catalog_rds_this (terraform/data.tf). After step 178. (executable: it can run now)
39. The data preflight of module.dependencies.module.catalog_rds.aws_rds_cluster.this (MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/preflight) — manual step: Close what the plan lists as UNKNOWN, from the move host, with read-only statements; no password goes on a command line (the client prompts for it). Source (mysql --host=\<source-host> --port=\<source-port> --user=\<source-user> --password): SELECT VERSION();, SELECT table_schema, table_collation, COUNT(*) FROM information_schema.tables GROUP BY 1, 2; and the same over information_schema.columns for the collations the columns use, SELECT routine_schema, routine_type, COUNT(*) FROM information_schema.routines GROUP BY 1, 2; and the triggers, events and views the same way, the DEFINER accounts (SELECT DISTINCT definer FROM information_schema.routines, and for the views and events), SELECT user, host, plugin FROM mysql.user ORDER BY 1, 2; and SHOW GRANTS FOR '\<user>'@'\<host>'; for each (names and plugins, never the authentication string), SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone, @@GLOBAL.gtid_mode;, SHOW DATABASES; and the engines and the tables without a primary key (the queries of the check table-engines-and-keys). Target (after the draft is applied and the instance and its service key exist; mysql --host=\<target-host> --port=\<target-port> --user=\<target-user> --password --database=\<target-database>): SELECT VERSION();, SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone;, SHOW VARIABLES LIKE 'character_set%';, SHOW VARIABLES LIKE 'collation%';, SHOW COLLATION WHERE Collation LIKE 'utf8mb4%0900%'; and SHOW GRANTS;. Check that the move host is in parameters.sgw_acl of the instance (remove it afterwards), reaches both ends and uses the custom port of the instance's service key. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#preflight. (terraform/handover/database-dependencies_catalog_rds_this/data-move.md) After steps 178, 179. (executable: a person can start it now)
40. The data rehearsal of module.dependencies.module.catalog_rds.aws_rds_cluster.this (MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/rehearsal) — manual step: Rehearse the dump and the load into a scratch instance of the same plan and version as the draft's instance (a second STACKIT MariaDB instance, deleted afterwards: the real instance must stay empty for the final load) from a copy of the source (a restore of a snapshot into a scratch RDS or Aurora database, so that production is not loaded): mysqldump --host=\<source-host> --port=\<source-port> --user=\<source-user> --password --single-transaction --routines --triggers --events --set-gtid-purged=OFF --no-tablespaces --databases \<database-1> \<database-2> --result-file=\<dump-file>.sql, then mysql --host=\<target-host> --port=\<target-port> --user=\<target-user> --password --database=\<target-database> < \<dump-file>.sql 2> load.log into the scratch instance. Note the elapsed time of the dump, of the load and of the verification, read every line of load.log, run the application's own test suite against the scratch instance, and compare the routines, triggers, events and views that were created with the source's. Delete the scratch instance and the dump afterwards. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#rehearsal. After step 180. (executable once its manual prerequisite is done: it waits for step 180, a manual prerequisite)
41. The OpenTofu step for stackit_opensearch_instance.dependencies_catalog_opensearch_this (TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this) — OpenTofu: creates stackit_opensearch_instance.dependencies_catalog_opensearch_this (terraform/data.tf). After step 176. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE; and, as the plan states: the decision DEC-GEN-CONVERT-EXPOSURE-WIDENED is open and this step stands on its DEFAULT, option accept-the-public-endpoint: StackToIT carried out the option accept-the-public-endpoint for stackit_opensearch_instance.dependencies_catalog_opensearch_this by default: the OpenSearch instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.catalog_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_catalog_opensearch_this_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default; placed in the platform services phase after the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster, which it depends on; its own phase is data services; the migration of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is not complete with this step: 14 critical settings of it that the draft does not carry are open in 6 steps, a step standing for several of them (12 manual, 2 refused): engine-version, fine-grained-access, private-endpoint, encryption-at-rest, domain-settings, domain-credentials-and-keys, access-and-encryption-settings, cluster-layout-settings, credentials-and-keys-settings, network-settings, storage-settings, tc-opensearch-domain-domain-name, nbr-aws-opensearch-domain-policy, opensearch-domain-policy-resource)
42. The OpenTofu step for stackit_opensearch_credential.dependencies_catalog_opensearch_this (TF/stackit_opensearch_credential.dependencies_catalog_opensearch_this) — OpenTofu: creates stackit_opensearch_credential.dependencies_catalog_opensearch_this (terraform/data.tf). After step 182. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE; and, as the plan states: placed in the platform services phase after the OpenTofu step for stackit_opensearch_instance.dependencies_catalog_opensearch_this, which it depends on; its own phase is data services; the migration of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is not complete with this step: 14 critical settings of it that the draft does not carry are open in 6 steps, a step standing for several of them (12 manual, 2 refused): engine-version, fine-grained-access, private-endpoint, encryption-at-rest, domain-settings, domain-credentials-and-keys, access-and-encryption-settings, cluster-layout-settings, credentials-and-keys-settings, network-settings, storage-settings, tc-opensearch-domain-domain-name, nbr-aws-opensearch-domain-policy, opensearch-domain-policy-resource)
43. The OpenTofu step for stackit_postgresflex_instance.dependencies_orders_rds_this (TF/stackit_postgresflex_instance.dependencies_orders_rds_this) — OpenTofu: creates stackit_postgresflex_instance.dependencies_orders_rds_this (terraform/data.tf). After step 176. (executable: it can run now)
44. The OpenTofu step for stackit_postgresflex_user.dependencies_orders_rds_this (TF/stackit_postgresflex_user.dependencies_orders_rds_this) — OpenTofu: creates stackit_postgresflex_user.dependencies_orders_rds_this (terraform/data.tf). After step 184. (executable: it can run now)
45. The OpenTofu step for stackit_postgresflex_database.dependencies_orders_rds_this_orders (TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders) — OpenTofu: creates stackit_postgresflex_database.dependencies_orders_rds_this_orders (terraform/data.tf). After steps 184, 185. (executable: it can run now; verification incomplete (NOT_VALIDATED): it carries 1 critical setting of the source that no check validates, confirm tc-database-name in the draft)
46. The data preflight of module.dependencies.module.orders_rds.aws_rds_cluster.this (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/preflight) — manual step: Preflight of the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this: close the checks the plan lists as UNKNOWN (versions, extensions, roles, network and TLS) with read-only queries on the source and on the target, before any data moves. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#decide-and-check. (terraform/handover/database-dependencies_orders_rds_this/data-move.md) After steps 184, 185, 186. (executable: a person can start it now)
47. The data rehearsal of module.dependencies.module.orders_rds.aws_rds_cluster.this (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/rehearsal) — manual step: Rehearse the move of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this into a scratch database of stackit_postgresflex_instance.dependencies_orders_rds_this from a copy of the source, and time each part of it. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#prepare-the-target. After step 187. (executable once its manual prerequisite is done: it waits for step 187, a manual prerequisite)
48. The initial copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/initial-copy/logical-replication) — manual step: Copy the existing data of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this by logical replication: copy the schema, publish on the source and subscribe from the target, and wait until every table is copied. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#method-b-logical-replication. After step 188. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this; it also comes after step 188, a manual prerequisite; and, as the plan states: a change and a reboot of the source; a slot nobody reads fills the storage of the source; schema changes freeze from here on; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path replicate-with-the-engine-replication of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default; placed in the platform services phase after the data rehearsal of module.dependencies.module.orders_rds.aws_rds_cluster.this, which it depends on; its own phase is data services)
49. The replication watch of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/delta-sync/logical-replication) — manual step: Keep the replication of module.dependencies.module.orders_rds.aws_rds_cluster.this running and watch its lag and the free storage of the source until the write freeze. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#method-b-logical-replication. After step 189. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this; it also comes after step 189, a manual prerequisite; and, as the plan states: a growing lag means the copy does not catch up at this write rate; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path replicate-with-the-engine-replication of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default; placed in the platform services phase after the initial copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, which it depends on; its own phase is data services)
50. The OpenTofu step for stackit_rabbitmq_instance.dependencies_mq (TF/stackit_rabbitmq_instance.dependencies_mq) — OpenTofu: creates stackit_rabbitmq_instance.dependencies_mq (terraform/messaging.tf). After step 176. (executable: it can run now)
51. The OpenTofu step for stackit_rabbitmq_credential.dependencies_mq (TF/stackit_rabbitmq_credential.dependencies_mq) — OpenTofu: creates stackit_rabbitmq_credential.dependencies_mq (terraform/messaging.tf). After step 191. (executable: it can run now)

Workloads

1. The step "Fill in the required inputs of kubernetes/carts/manifests.yaml and apply it to…" (MAN/draft/kubernetes/carts/manifests-yaml) — manual step: …the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file>. (terraform/kubernetes/carts/manifests.yaml) After steps 30, 176, 177. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this; it also comes after steps 177 and 30, manual prerequisites)
2. The step "Fill in the required inputs of kubernetes/catalog/manifests.yaml and apply it…" (MAN/draft/kubernetes/catalog/manifests-yaml) — manual step: …to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file>. (terraform/kubernetes/catalog/manifests.yaml) After steps 32, 176, 177. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this; it also comes after steps 177 and 32, manual prerequisites)
3. The step "Fill in the required inputs of kubernetes/checkout/manifests.yaml and apply it…" (MAN/draft/kubernetes/checkout/manifests-yaml) — manual step: …to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file>. (terraform/kubernetes/checkout/manifests.yaml) After steps 34, 176, 177. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this; it also comes after steps 177 and 34, manual prerequisites)
4. The step "Fill in the required inputs of kubernetes/orders/manifests.yaml and apply it to…" (MAN/draft/kubernetes/orders/manifests-yaml) — manual step: …the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file>. (terraform/kubernetes/orders/manifests.yaml) After steps 36, 176, 177. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this; it also comes after steps 177 and 36, manual prerequisites)
5. The step "Fill in the required inputs of kubernetes/ui/manifests.yaml and apply it to the…" (MAN/draft/kubernetes/ui/manifests-yaml) — manual step: …cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file>. (terraform/kubernetes/ui/manifests.yaml) After steps 38, 176, 177. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this; it also comes after steps 177 and 38, manual prerequisites)

Cutover

1. The write freeze of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine (MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/client-import) — manual step: Freeze the writers of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#write-freeze-client-import. (terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md) After steps 182, 183. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, not of the path the draft carries out by default)
2. The final copy of the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine (MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/client-import) — manual step: Inside the freeze, copy the indices of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this to stackit_opensearch_instance.dependencies_catalog_opensearch_this with the reindex operation of the service, as the OpenSearch how-to "Migrate data from Elasticsearch to OpenSearch 2" describes. Runbook section: terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#final-sync-client-import. After step 198. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE; it also comes after step 198, a manual prerequisite; and, as the plan states: the how-to of the service has an Elasticsearch instance as the source of the reindex: an OpenSearch domain as the source of the same operation is an inference, not a statement of the page; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, not of the path the draft carries out by default)
3. The data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine (MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/client-import) — manual step: Reconcile module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this and stackit_opensearch_instance.dependencies_catalog_opensearch_this with the writers stopped (the number of documents of every index on each side, a checksum or a sample of their content, and one read the application does) and record GO or NO-GO. Runbook section: terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#reconcile-client-import. After step 199. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE; it also comes after step 199, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, not of the path the draft carries out by default)
4. The write freeze of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own (MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/own-tool) — manual step: Freeze the writers of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#write-freeze-own-tool. After steps 182, 183. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, not of the path the draft carries out by default)
5. The final copy of the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own (MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/own-tool) — manual step: Copy the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this to stackit_opensearch_instance.dependencies_catalog_opensearch_this with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back. Runbook section: terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#final-sync-own-tool. After step 201. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE; it also comes after step 201, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, not of the path the draft carries out by default)
6. The data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own (MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/own-tool) — manual step: Reconcile module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this and stackit_opensearch_instance.dependencies_catalog_opensearch_this with the writers stopped (the number of documents of every index on each side, a checksum or a sample of their content, and one read the application does) and record GO or NO-GO. Runbook section: terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#reconcile-own-tool. After step 202. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE; it also comes after step 202, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, not of the path the draft carries out by default)
7. The write freeze of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore (MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/dump-restore) — manual step: List who writes (SELECT user, host, db, command, COUNT(*) FROM information_schema.processlist WHERE db IN ('\<database-1>', '\<database-2>') GROUP BY 1, 2, 3, 4;) and record the connection settings of every client where they can be restored from. Then stop the writers at the application (services, jobs, migrations, cron, replicas that write). Do not make the source read-only and do not change it. Check: SELECT COUNT(*) FROM information_schema.processlist WHERE db IN ('\<database-1>', '\<database-2>') AND command <> 'Sleep' AND id <> CONNECTION_ID(); is 0. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#write-freeze-dump-restore. After step 181. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this; it also comes after step 181, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
8. The final copy of the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore (MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/dump-restore) — manual step: Dump inside the freeze: mysqldump --host=\<source-host> --port=\<source-port> --user=\<source-user> --password --single-transaction --routines --triggers --events --set-gtid-purged=OFF --no-tablespaces --databases \<database-1> \<database-2> --result-file=\<dump-file>.sql. --set-gtid-purged=OFF leaves the GTID statements out, which MariaDB does not take, and --no-tablespaces leaves out the CREATE TABLESPACE statements, which MariaDB does not support for InnoDB. The target instance must be empty before the load (the STACKIT how-to of the restore says so): load the dump with the mysql client, as the user of the instance's service key, into the empty instance: mysql --host=\<target-host> --port=\<target-port> --user=\<target-user> --password --database=\<target-database> < \<dump-file>.sql 2> load.log, and read every line of load.log. A DEFINER account that does not exist on the target, a collation the target does not know and a database the target does not have are the errors the checks name: each is settled by a person, never by skipping the object. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#final-sync-dump-restore. After step 204. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this; it also comes after step 204, a manual prerequisite; and, as the plan states: the freeze lasts as long as the dump and the load; the connection of a session idle for 60 minutes is dropped by the service; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
9. The data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore (MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore) — manual step: Both sides, with the writers stopped: per-table counts (SELECT CONCAT('SELECT ''', table_schema, '.', table_name, ''' AS tbl, COUNT(*) FROM ', table_schema, '.', table_name, ';') FROM information_schema.tables WHERE table_type = 'BASE TABLE' AND table_schema NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys'); and run what it prints; the table_rows of information_schema are estimates, not counts), for each table that matters an aggregate of its content (SELECT COUNT(*), MIN(\<key>), MAX(\<key>), SUM(\<numeric-column>) FROM \<schema>.\<table>;; a CHECKSUM TABLE value is compared only where both servers have been shown to agree on a sample in the rehearsal), the number of routines, triggers, events and views on each side (the queries of the preflight) and their definitions (SHOW CREATE \<type> \<name>;), SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone; equal where they are meant to be, a TIMESTAMP column and a DATETIME column of one row read in the same session time zone, and one read query the application itself runs on its most important data, \<application-query>: the query and the answer are the customer's, the source does not state them. Record GO or NO-GO. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#reconcile-dump-restore. After step 205. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this; it also comes after step 205, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
10. The write freeze of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own (MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/own-tool) — manual step: List who writes (SELECT user, host, db, command, COUNT(*) FROM information_schema.processlist WHERE db IN ('\<database-1>', '\<database-2>') GROUP BY 1, 2, 3, 4;) and record the connection settings of every client where they can be restored from. Then stop the writers at the application (services, jobs, migrations, cron, replicas that write). Do not make the source read-only and do not change it. Check: SELECT COUNT(*) FROM information_schema.processlist WHERE db IN ('\<database-1>', '\<database-2>') AND command <> 'Sleep' AND id <> CONNECTION_ID(); is 0. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#write-freeze-own-tool. After step 181. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this; it also comes after step 181, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
11. The final copy of the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own (MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/own-tool) — manual step: Copy the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this to stackit_mariadb_instance.dependencies_catalog_rds_this with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#final-sync-own-tool. After step 207. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this; it also comes after step 207, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
12. The data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own (MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/own-tool) — manual step: Both sides, with the writers stopped: per-table counts (SELECT CONCAT('SELECT ''', table_schema, '.', table_name, ''' AS tbl, COUNT(*) FROM ', table_schema, '.', table_name, ';') FROM information_schema.tables WHERE table_type = 'BASE TABLE' AND table_schema NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys'); and run what it prints; the table_rows of information_schema are estimates, not counts), for each table that matters an aggregate of its content (SELECT COUNT(*), MIN(\<key>), MAX(\<key>), SUM(\<numeric-column>) FROM \<schema>.\<table>;; a CHECKSUM TABLE value is compared only where both servers have been shown to agree on a sample in the rehearsal), the number of routines, triggers, events and views on each side (the queries of the preflight) and their definitions (SHOW CREATE \<type> \<name>;), SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone; equal where they are meant to be, a TIMESTAMP column and a DATETIME column of one row read in the same session time zone, and one read query the application itself runs on its most important data, \<application-query>: the query and the answer are the customer's, the source does not state them. Record GO or NO-GO. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#reconcile-own-tool. After step 208. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this; it also comes after step 208, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
13. The switch of the applications that use module.dependencies.module.catalog_rds.aws_rds_cluster.this (MAN/cutover/connection/module.dependencies.module.catalog_rds.aws_rds_cluster.this) — manual step: Switch the connection of the applications of module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) to its STACKIT copy stackit_mariadb_instance.dependencies_catalog_rds_this: change the connection string (host, port, database name and credentials) in the configuration of every application that uses it (the source references it from module.retail_app_ecs.aws_secretsmanager_secret.catalog_db; an application outside the source is not read). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.dependencies.module.catalog_rds.aws_rds_cluster.this.endpoint (host): stackit_mariadb_credential.dependencies_catalog_rds_this.host; module.dependencies.module.catalog_rds.aws_rds_cluster.this.reader_endpoint (reader endpoint): stackit_mariadb_instance.dependencies_catalog_rds_this has no reader endpoint attribute (its connection_info holds the write endpoint only); module.dependencies.module.catalog_rds.aws_rds_cluster.this.port (port): stackit_mariadb_credential.dependencies_catalog_rds_this.port; module.dependencies.module.catalog_rds.aws_rds_cluster.this.database_name (database name): the name of a database of the instance: the draft writes no database block for this unit; module.dependencies.module.catalog_rds.aws_rds_cluster.this.master_username (user name): stackit_mariadb_credential.dependencies_catalog_rds_this.username. Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, attribute secret_string in module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db reads module.dependencies.module.catalog_rds.aws_rds_cluster.this through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read. After steps 178, 179, 180, 206, 209. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this; it also comes after steps 180, 206 and 209, manual prerequisites; and, as the plan states: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.dependencies.module.catalog_rds.aws_rds_cluster.this)
14. The write freeze of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine (MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/client-import) — manual step: Freeze the writers of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#write-freeze-client-import. After steps 138, 141. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; it also comes after step 141, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default)
15. The final copy of the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine (MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/client-import) — manual step: Inside the freeze, copy every key of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default to stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with a client that you run, not with the MIGRATE command: iterate the keys of the source with SCAN (never KEYS), read each key with DUMP and its remaining time to live with PTTL, and write it into stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with RESTORE (the TTL in milliseconds, 0 for a key that has none, and without REPLACE), after you isolated the source (no application connected to it) and took a backup of it. The source shows one shard (it states num_cache_clusters, which the provider documents as conflicting with num_node_groups): the copy iterates one node, the primary. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#final-sync-client-import. After step 211. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; it also comes after step 211, a manual prerequisite; and, as the plan states: the tutorial's main strategy is the MIGRATE command with its COPY option, piped from a KEYS '*' listing; the plan does not use it because it holds no statement that the source allows MIGRATE (for Amazon ElastiCache the page below says it does not), and the tutorial's listing with KEYS is not used either; DUMP returns a serialized value that holds an RDB version and a checksum and no expire time (valkey.io/commands/dump), RESTORE fails when the version or the checksum does not match (valkey.io/commands/restore), and PTTL answers -1 for a key without expire and -2 for a key that is gone (valkey.io/commands/pttl): the client restores a key without expire with a TTL of 0, skips a key that is gone and counts it, and reports a key that RESTORE refuses; try the first keys before the whole copy; RESTORE without REPLACE refuses a key that already exists ("Target key name is busy", valkey.io/commands/restore): that is what shows a second attempt on a target that still holds keys, so remove them first (the way back below); SCAN may return a key more than once (valkey.io/commands/scan), and the second RESTORE of such a key is not an error of the copy; the plan has not run this copy against a Key Value Store: that the service accepts RESTORE is inferred from the tutorial's MIGRATE ... COPY, which ends in a RESTORE on the target (valkey.io/commands/migrate), not from a statement of the service; the tutorial recommends a manual backup of the source before the migration, kept until the consistency of the target is confirmed; the source does not say whether this cache holds only what the application rebuilds or also data that exists nowhere else (sessions, locks, counters, queues), so the plan keeps the copy rather than assuming the cache can start empty; the tutorial's source is a STACKIT Redis instance (its TLS, backend-host and key-listing steps are those of STACKIT); an Amazon ElastiCache or MemoryDB source of the same steps is an inference, not a statement of the page; the Amazon ElastiCache page lists migrate among the commands it does not make available for caches running Redis OSS (with sync, psync, replicaof, bgsave, save and config) and does not state that restriction for Valkey caches; the plan takes MIGRATE as available for no ElastiCache engine and copies the keys with a client on every one; the same page lists DUMP, RESTORE, SCAN, PTTL, INFO and DBSIZE among the commands serverless caches support, and its lists of restricted commands name none of them; the script copy_redis.py of the tutorial (the plan has read it: it lists the keys with SCAN, reads each key by its type and writes it with SET, RPUSH, SADD, HSET or ZADD, and sets the TTL in whole seconds) does not use KEYS, but it has a branch only for strings, lists, sets, hashes and sorted sets, so it copies nothing for a key of another type (a stream, for one), it decodes every key name as UTF-8, and it opens one connection to one source host; count the keys of each type on the source before you choose it over the client above; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default)
16. The data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine (MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/client-import) — manual step: Reconcile module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with the writers stopped (DBSIZE and INFO KEYSPACE on both sides: the number of keys and the keys and expires values must be equal, where the cache returns the section; the sorted lists of the keys of both, each listed with SCAN and never KEYS: their difference must be empty; and one read the application does) and record GO or NO-GO. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#reconcile-client-import. After step 212. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; it also comes after step 212, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default)
17. The write freeze of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own (MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/own-tool) — manual step: Freeze the writers of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#write-freeze-own-tool. After steps 138, 141. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; it also comes after step 141, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default)
18. The final copy of the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own (MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/own-tool) — manual step: Copy the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default to stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#final-sync-own-tool. After step 214. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; it also comes after step 214, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default)
19. The data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own (MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/own-tool) — manual step: Reconcile module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with the writers stopped (DBSIZE and INFO KEYSPACE on both sides: the number of keys and the keys and expires values must be equal, where the cache returns the section; the sorted lists of the keys of both, each listed with SCAN and never KEYS: their difference must be empty; and one read the application does) and record GO or NO-GO. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#reconcile-own-tool. After step 215. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; it also comes after step 215, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default)
20. The switch of the applications that use module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (MAN/cutover/connection/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default) — manual step: Switch the connection of the applications of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) to its STACKIT copy stackit_valkey_instance.dependencies_checkout_elasticache_redis_default: change the endpoint (host and port) and the password or auth token in the configuration of every application that uses it (the source references it from module.retail_app_ecs.module.checkout_service.aws_ecs_service.this; an application outside the source is not read). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.primary_endpoint_address (host), module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.configuration_endpoint_address (host), module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.reader_endpoint_address (reader endpoint), module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.port (port): stackit_valkey_instance.dependencies_checkout_elasticache_redis_default has no host or port attribute (and no reader endpoint): the host and port are attributes of a stackit_valkey_credential, which the draft writes for the instance, and the provider schema gives host and load_balanced_host no description and no STACKIT page read says which of them a client connects to, so none is mapped. Where the source reads it, and what each place reads after the switch: (1) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu, attribute alarm_name reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (2) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu, attribute dimensions reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (3) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory, attribute alarm_name reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (4) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory, attribute dimensions reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (5) module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default, attribute records reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (6) module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read. After steps 138, 139, 140, 213, 216. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; it also comes after steps 140, 213 and 216, manual prerequisites; and, as the plan states: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default)
21. The write freeze of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own (MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/write-freeze/own-tool) — manual step: Freeze the writers of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#write-freeze-own-tool. (terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md) After step 137. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, not of the path the draft carries out by default)
22. The export of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own (MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/export/own-tool) — manual step: Inside the freeze, export the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) to S3 with the DynamoDB export to S3, which requires point-in-time recovery, and the source does not state point-in-time recovery for this table (the provider's default is off): a request for a table without it fails with PointInTimeRecoveryUnavailableException. Switch recovery on first (a change to the AWS table that this plan does not make) and request the export only after it is on, using aws dynamodb export-table-to-point-in-time --table-arn \<table ARN> --s3-bucket \<bucket> --s3-prefix \<prefix> --export-format DYNAMODB_JSON; keep the manifest-summary.json (its itemCount is the count the comparison uses). Without the export, read the table in full with Scan, which consumes the read capacity of the table, and count the items you write out. Runbook section: terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#export-own-tool. After step 218. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; it also comes after step 218, a manual prerequisite; and, as the plan states: no service level agreement guarantees the completion time of an export (AWS: How export to S3 works), so the plan cannot compute how long the freeze lasts: it lasts at least as long as the export, the conversion and the import together; an export is not transactionally consistent: a transaction can be torn between two exports (AWS: Requesting a table export); with the writers stopped before the export no transaction is in flight, which is why the export is inside the freeze and not before it; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, not of the path the draft carries out by default)
23. The conversion of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own (MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/transform/own-tool) — manual step: Convert the export of the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) into documents of the collection of stackit_mongodbflex_instance.dynamodb_tables with a script of your own: unwrap the type descriptors of the DynamoDB JSON (S, N, B, BOOL, NULL, M, L, SS, NS, BS) into BSON values; make the key id the _id (or a unique index on id); keep numbers in the BSON type that holds them: a DynamoDB number has up to 38 digits of precision and a decimal128 has 34, so a value of more than 34 significant digits cannot be a decimal128 without rounding (keep it as a string, as AWS advises beyond 38 digits, or report it); turn a string set, a number set and a binary set (SS, NS, BS) into an array: a set holds unique values in no order and an array does not, so the application code that relies on set operations changes; plan the secondary indexes global secondary index idx_global_customerId (customerId) as MongoDB indexes on the collection (a local index shares the key of the table, so its index leads with the table's partition key); projections are not carried (a MongoDB index finds whole documents); the item size needs no check in this direction: DynamoDB holds an item of up to 400 KB and a BSON document holds up to 16 mebibytes; the consistency the application needs is its own decision: a read of DynamoDB is eventually consistent unless the request asks for a strongly consistent read, and a global secondary index is eventually consistent only; MongoDB's read concern and read preference are chosen by the application's driver. Runbook section: terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#conversion-own-tool. After step 219. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; it also comes after step 219, a manual prerequisite; and, as the plan states: a DynamoDB number of more than 34 significant digits does not fit a decimal128: the plan cannot see the values, so the script counts such values and either keeps them as strings or reports them; a set (SS, NS, BS) becomes an array: unique values and no order are guarantees of a set that an array does not give; the conversion is the script of a person; the plan names what it must handle and runs nothing; a global secondary index of DynamoDB is eventually consistent and may be sparse; a MongoDB index is updated with the write, and an item without the index's attributes is left out of a partial or sparse index only if the person builds it so; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, not of the path the draft carries out by default)
24. The final copy of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own (MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/final-sync/own-tool) — manual step: Load the documents of the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) into the collection of stackit_mongodbflex_instance.dynamodb_tables (STACKIT MongoDB Flex) with a MongoDB client of your choice (mongoimport, or a driver script), then create its indexes. Runbook section: terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#final-sync-own-tool. After step 220. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; it also comes after step 220, a manual prerequisite; and, as the plan states: build the indexes after the load, not before it: each index is built once over loaded documents (MongoDB allows at most 64 indexes on a collection); the draft lists the clients that may connect as the variable acl and gives no user: the person creates the user of the instance and the clients (the load and the applications) come from networks that list contains; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, not of the path the draft carries out by default)
25. The data reconciliation of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own (MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/reconcile/own-tool) — manual step: Reconcile the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) and the collection of stackit_mongodbflex_instance.dynamodb_tables with the writers stopped: the number of documents in the collection must equal the itemCount of the export (manifest-summary.json), less the items the conversion reported, a sample of keys must read the same items on both sides, and the application's read of one item must return the same on both; record GO or NO-GO. Runbook section: terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#reconcile-own-tool. After step 221. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; it also comes after step 221, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, not of the path the draft carries out by default)
26. The switch of the applications that use module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (MAN/cutover/connection/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) — manual step: Switch the applications of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) to its STACKIT copy stackit_mongodbflex_instance.dynamodb_tables: this is a change of code before it is a change of configuration. Rewrite the data access layer of every application that uses it (the source references it from module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; an application outside the source is not read) from the DynamoDB API (GetItem, PutItem, UpdateItem, DeleteItem, Query, Scan, BatchWriteItem, TransactWriteItems, condition and update expressions) to a MongoDB driver, then change the connection string of the instance, the collection name and the credentials. After steps 137, 219, 222. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; it also comes after steps 219 and 222, manual prerequisites; and, as the plan states: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; the table moves as an alternative, not an equivalent: key design, capacity modes, conditional writes and transaction semantics do not carry over (the knowledge base, rule aws.dynamodb_table, REDESIGN), so the code change is built and tested against the STACKIT instance before the window in which this step runs)
27. The write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/dump-restore) — manual step: Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window. After step 188. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this; it also comes after step 188, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
28. The final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/dump-restore) — manual step: Inside the freeze, dump module.dependencies.module.orders_rds.aws_rds_cluster.this and restore the dump into stackit_postgresflex_instance.dependencies_orders_rds_this, and settle every error of the restore. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#method-a-dumprestore. After step 224. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this; it also comes after step 224, a manual prerequisite; and, as the plan states: the freeze lasts as long as the dump and the restore; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
29. The data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/dump-restore) — manual step: Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and stackit_postgresflex_instance.dependencies_orders_rds_this with the writers stopped (row counts, checksums, sequences and one query the application runs) and record GO or NO-GO. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#verify-with-the-application. After step 225. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this; it also comes after step 225, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
30. The write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/logical-replication) — manual step: Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window. After step 190. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this; it also comes after step 190, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path replicate-with-the-engine-replication of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
31. The final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/logical-replication) — manual step: Inside the freeze, wait until the replication of module.dependencies.module.orders_rds.aws_rds_cluster.this has no lag, copy the sequences to stackit_postgresflex_instance.dependencies_orders_rds_this and disable the subscription. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window. After step 227. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this; it also comes after step 227, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path replicate-with-the-engine-replication of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
32. The data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/logical-replication) — manual step: Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and stackit_postgresflex_instance.dependencies_orders_rds_this with the writers stopped (row counts, checksums, sequences and one query the application runs) and record GO or NO-GO. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#verify-with-the-application. After step 228. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this; it also comes after step 228, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path replicate-with-the-engine-replication of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
33. The write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/own-tool) — manual step: Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window. After step 188. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this; it also comes after step 188, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
34. The final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/own-tool) — manual step: Copy the data of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back. After step 230. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this; it also comes after step 230, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
35. The data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/own-tool) — manual step: Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and stackit_postgresflex_instance.dependencies_orders_rds_this with the writers stopped (row counts, checksums, sequences and one query the application runs) and record GO or NO-GO. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#verify-with-the-application. After step 231. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this; it also comes after step 231, a manual prerequisite; and, as the plan states: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default)
36. The switch of the applications that use module.dependencies.module.orders_rds.aws_rds_cluster.this (MAN/cutover/connection/module.dependencies.module.orders_rds.aws_rds_cluster.this) — manual step: Switch the connection of the applications of module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) to its STACKIT copy stackit_postgresflex_instance.dependencies_orders_rds_this, stackit_postgresflex_database.dependencies_orders_rds_this_orders: change the connection string (host, port, database name and credentials) in the configuration of every application that uses it (the source references it from module.retail_app_ecs.aws_secretsmanager_secret.orders_db; an application outside the source is not read). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.dependencies.module.orders_rds.aws_rds_cluster.this.endpoint (host): stackit_postgresflex_instance.dependencies_orders_rds_this.connection_info.write.host; module.dependencies.module.orders_rds.aws_rds_cluster.this.reader_endpoint (reader endpoint): stackit_postgresflex_instance.dependencies_orders_rds_this has no reader endpoint attribute (its connection_info holds the write endpoint only); module.dependencies.module.orders_rds.aws_rds_cluster.this.port (port): stackit_postgresflex_instance.dependencies_orders_rds_this.connection_info.write.port; module.dependencies.module.orders_rds.aws_rds_cluster.this.database_name (database name): stackit_postgresflex_database.dependencies_orders_rds_this_orders.name; module.dependencies.module.orders_rds.aws_rds_cluster.this.master_username (user name): stackit_postgresflex_user.dependencies_orders_rds_this.username (its password is a sensitive attribute of the same block: it is read from the state or the output the draft writes, never copied into a configuration by hand). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.aws_secretsmanager_secret.orders_db, attribute secret_string in module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db reads module.dependencies.module.orders_rds.aws_rds_cluster.this through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read. After steps 184, 185, 186, 187, 226, 229, 232. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this; it also comes after steps 187, 226, 229 and 232, manual prerequisites; and, as the plan states: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.dependencies.module.orders_rds.aws_rds_cluster.this)
37. The cutover readiness step (MAN/cutover/readiness) — manual step: Confirm that every workload step and every data move of the plan is done (the steps this one follows) before the first switch of the cutover: the plan does not know which workloads and data stores each entry point serves, so every switch waits for all of them. After 19 steps: 140, 180, 187 and 16 more (every predecessor is in execution-plan.json depends_on). (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this; it also comes after steps 200, 203, 180, 206, 209, 140, 213, 216, 219, 222, 187, 226, 229, 232, 193, 194, 195, 196 and 197, manual prerequisites)
38. The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db) — manual step: Switch the applications that read the secret module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.catalog_db.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read. After steps 46, 47, 74, 75, 76, 234. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this; it also comes after steps 234, 46 and 47, manual prerequisites; and, as the plan states: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.retail_app_ecs.aws_secretsmanager_secret.catalog_db; the value on STACKIT is the document the person supplied to the WriteSecret step, not a copy kept in step with module.retail_app_ecs.aws_secretsmanager_secret.catalog_db: a rotation after the switch happens on STACKIT only)
39. The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch) — manual step: Switch the applications that read the secret module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read. After steps 48, 49, 74, 75, 77, 234. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this; it also comes after steps 234, 48 and 49, manual prerequisites; and, as the plan states: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch; the value on STACKIT is the document the person supplied to the WriteSecret step, not a copy kept in step with module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch: a rotation after the switch happens on STACKIT only)
40. The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.mq (MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.mq) — manual step: Switch the applications that read the secret module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.orders_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.mq.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.orders_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.mq through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read. After steps 50, 51, 74, 75, 78, 234. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this; it also comes after steps 234, 50 and 51, manual prerequisites; and, as the plan states: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.retail_app_ecs.aws_secretsmanager_secret.mq; the value on STACKIT is the document the person supplied to the WriteSecret step, not a copy kept in step with module.retail_app_ecs.aws_secretsmanager_secret.mq: a rotation after the switch happens on STACKIT only)
41. The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.orders_db (MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.orders_db) — manual step: Switch the applications that read the secret module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.orders_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.orders_db.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.orders_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read. After steps 52, 53, 74, 75, 79, 234. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this; it also comes after steps 234, 52 and 53, manual prerequisites; and, as the plan states: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.retail_app_ecs.aws_secretsmanager_secret.orders_db; the value on STACKIT is the document the person supplied to the WriteSecret step, not a copy kept in step with module.retail_app_ecs.aws_secretsmanager_secret.orders_db: a rotation after the switch happens on STACKIT only)
42. The traffic switch of module.dependencies.aws_mq_broker.mq (MAN/cutover/module.dependencies.aws_mq_broker.mq) — manual step: Switch the producers of module.dependencies.aws_mq_broker.mq (aws_mq_broker) from its AWS address (the instances[*].endpoints of module.dependencies.aws_mq_broker.mq) to the endpoint of the STACKIT instance (the host and port of a credential of stackit_rabbitmq_instance.dependencies_mq (stackit_rabbitmq_credential; the draft writes one for the instance: read its host and port after the apply)): change the clients' configuration (no Route 53 record of the source points to module.dependencies.aws_mq_broker.mq: a DNS record outside the source, or the address the clients are configured with). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.aws_secretsmanager_secret.mq, attribute secret_string in module.retail_app_ecs.aws_secretsmanager_secret_version.mq reads module.dependencies.aws_mq_broker.mq through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read. The consumers stay on the AWS broker until its queues are drained (the drain of the broker), and only then follow. After steps 142, 143, 144, 145, 191, 192, 234. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this; it also comes after steps 234, 142, 143, 144 and 145, manual prerequisites; and, as the plan states: the plan does not read whether module.dependencies.aws_mq_broker.mq is reached from the internet or only inside the network: its clients are switched either way; the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.dependencies.aws_mq_broker.mq; the queues, exchanges and bindings of the broker (its definitions) exist on the STACKIT instance before the producers move: a message published to an exchange that routes it to no queue is dropped, or returned to a publisher that asks for it (RabbitMQ: publishers), and the plan does not move the definitions with the messages)
43. The drain of the queue of module.dependencies.aws_mq_broker.mq (MAN/cutover/messaging-drain/module.dependencies.aws_mq_broker.mq) — manual step: Drain the queues of the AWS broker module.dependencies.aws_mq_broker.mq (aws_mq_broker): its consumers go on reading them, with no producer sending to the broker any more, until every queue holds no message. Read the depth in CloudWatch: Amazon MQ for RabbitMQ publishes MessageCount (the sum of the ready and the unacknowledged messages) for the broker and, on 3.x brokers, for each queue (the dimensions Queue and VirtualHost; on 4.x brokers the figures of a queue come from the Prometheus endpoint), and Amazon MQ for ActiveMQ publishes QueueSize and InFlightCount for each queue and TotalMessageCount for the broker. An inactive durable topic subscriber (InactiveDurableTopicSubscribersCount) holds messages that only its own client can read: connect it to the AWS broker until it has read them. The plan does not read the names of the queues of the broker. After step 239. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this; it also comes after step 239, a manual prerequisite; and, as the plan states: how long the drain takes is not computable: it depends on the depth of the queues of module.dependencies.aws_mq_broker.mq and on the rate of their consumers, which the source does not state; a message that no consumer can process (a poison message) keeps its queue non-empty: the person who runs the drain decides what happens to it, and the plan reads no dead-letter queue of a broker)
44. The switch of the consumers of module.dependencies.aws_mq_broker.mq (MAN/cutover/messaging-consumers/module.dependencies.aws_mq_broker.mq) — manual step: Switch the consumers of the broker module.dependencies.aws_mq_broker.mq (aws_mq_broker) to the endpoint of the STACKIT instance (the host and port of a credential of stackit_rabbitmq_instance.dependencies_mq (stackit_rabbitmq_credential; the draft writes one for the instance: read its host and port after the apply)) once every queue of the AWS broker is empty: change the endpoint and the credentials in their configuration, start them against the STACKIT instance and stop the consumers that read the AWS broker. After step 240. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this; it also comes after step 240, a manual prerequisite; and, as the plan states: the plan does not read which applications consume from module.dependencies.aws_mq_broker.mq or where they configure it: the owner of the application lists them)
45. The traffic switch of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (MAN/cutover/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this) — manual step: Switch the clients (the applications that index and search) of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) from its AWS address (the endpoint of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this) to the endpoint of the STACKIT instance (the host and port of a credential of stackit_opensearch_instance.dependencies_catalog_opensearch_this (stackit_opensearch_credential; the draft writes one for the instance: read its host and port after the apply)): change the clients' configuration (no Route 53 record of the source points to module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: a DNS record outside the source, or the address the clients are configured with). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read. After steps 114, 115, 116, 117, 135, 136, 182, 183, 198, 199, 200, 201, 202, 203, 234. (not executable as the plan stands: the plan does not read whether module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is reached from the internet or only inside the network: its clients are switched either way; the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; it also waits for DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
46. The traffic switch of module.retail_app_ecs.module.alb.aws_lb.this (MAN/cutover/module.retail_app_ecs.module.alb.aws_lb.this) — manual step: Switch the traffic of module.retail_app_ecs.module.alb.aws_lb.this (aws_lb) from its AWS address (the dns_name of module.retail_app_ecs.module.alb.aws_lb.this) to its STACKIT address (the external_address of stackit_application_load_balancer.retail_app_ecs_alb_this): change the clients' configuration (no Route 53 record of the source points to module.retail_app_ecs.module.alb.aws_lb.this: a DNS record outside the source, or the address the clients are configured with). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.alb.aws_wafv2_web_acl_association.this, attribute resource_arn reads module.retail_app_ecs.module.alb.aws_lb.this.arn (the ARN); after the switch: no ARN exists on STACKIT (the access and wiring steps of the unit decide what replaces it). After steps 146, 147, 171, 234. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this; it also comes after steps 234, 13, 146 and 147, manual prerequisites; and, as the plan states: the plan does not read whether module.retail_app_ecs.module.alb.aws_lb.this is reached from the internet or only inside the network: its clients are switched either way; the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.retail_app_ecs.module.alb.aws_lb.this)
47. The cutover completion step (MAN/cutover/complete) — manual step: Confirm that every switch of the cutover is done (the steps this one follows) before the checks of the data stores and queues start: the plan does not know which applications use which store, so each such check waits for every switch. After steps 210, 217, 223, 233, 235, 236, 237, 238, 239, 240, 241, 242, 243. (not executable as the plan stands: it waits for step 242, which no answer makes executable as the plan stands; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)

Verification

1. The data check of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (MAN/verify/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this) — manual step: Check that the application reads the data migrated from module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) on its STACKIT target stackit_opensearch_instance.dependencies_catalog_opensearch_this and that what it writes there is read back. After steps 182, 183, 200, 203, 244. (not executable as the plan stands: it waits for step 244, which no answer makes executable as the plan stands; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
2. The data check of module.dependencies.module.catalog_rds.aws_rds_cluster.this (MAN/verify/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this) — manual step: Check that the application reads the data migrated from module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) on its STACKIT target stackit_mariadb_instance.dependencies_catalog_rds_this and that what it writes there is read back. After steps 178, 179, 180, 206, 209, 244. (not executable as the plan stands: it waits for step 244, which no answer makes executable as the plan stands; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
3. The data check of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (MAN/verify/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default) — manual step: Check that the application reads the data migrated from module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) on its STACKIT target stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and that what it writes there is read back. After steps 138, 139, 140, 213, 216, 244. (not executable as the plan stands: it waits for step 244, which no answer makes executable as the plan stands; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
4. The data check of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (MAN/verify/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) — manual step: Check that the application reads the data migrated from module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) on its STACKIT target stackit_mongodbflex_instance.dynamodb_tables and that what it writes there is read back. After steps 137, 219, 222, 244. (not executable as the plan stands: it waits for step 244, which no answer makes executable as the plan stands; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
5. The data check of module.dependencies.module.orders_rds.aws_rds_cluster.this (MAN/verify/data/module.dependencies.module.orders_rds.aws_rds_cluster.this) — manual step: Check that the application reads the data migrated from module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) on its STACKIT target stackit_postgresflex_instance.dependencies_orders_rds_this, stackit_postgresflex_database.dependencies_orders_rds_this_orders and that what it writes there is read back. After steps 184, 185, 186, 187, 226, 229, 232, 244. (not executable as the plan stands: it waits for step 244, which no answer makes executable as the plan stands; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
6. The DNS check of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (MAN/verify/dns/module.retail_app_ecs.module.carts_service.aws_ecs_service.this) — manual step: Check from inside the cluster that the 1 name(s) the application carts resolves in the source VPC (carts) resolve to what stands for them on STACKIT. After step 193. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this; it also comes after step 193, a manual prerequisite)
7. The DNS check of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (MAN/verify/dns/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this) — manual step: Check from inside the cluster that the 3 name(s) the application catalog resolves in the source VPC (the endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch), the endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora), catalog) resolve to what stands for them on STACKIT. After step 194. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this; it also comes after step 194, a manual prerequisite)
8. The DNS check of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (MAN/verify/dns/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this) — manual step: Check from inside the cluster that the 2 name(s) the application checkout resolves in the source VPC (the endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache), checkout) resolve to what stands for them on STACKIT. After step 195. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this; it also comes after step 195, a manual prerequisite)
9. The DNS check of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (MAN/verify/dns/module.retail_app_ecs.module.orders_service.aws_ecs_service.this) — manual step: Check from inside the cluster that the 3 name(s) the application orders resolves in the source VPC (the endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ), the endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora), orders) resolve to what stands for them on STACKIT. After step 196. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this; it also comes after step 196, a manual prerequisite)
10. The DNS check of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (MAN/verify/dns/module.retail_app_ecs.module.ui_service.aws_ecs_service.this) — manual step: Check from inside the cluster that the 1 name(s) the application ui resolves in the source VPC (ui) resolve to what stands for them on STACKIT. After step 197. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this; it also comes after step 197, a manual prerequisite)
11. The endpoint check of module.dependencies.aws_mq_broker.mq (MAN/verify/endpoint/module.dependencies.aws_mq_broker.mq) — manual step: Check that the host and port of a credential of stackit_rabbitmq_instance.dependencies_mq (stackit_rabbitmq_credential; the draft writes one for the instance: read its host and port after the apply) answers the requests the clients of module.dependencies.aws_mq_broker.mq send, over the STACKIT address, as the instances[*].endpoints of module.dependencies.aws_mq_broker.mq did. After steps 210, 217, 223, 233, 235, 236, 237, 238, 241. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this; it also comes after steps 210, 217, 223, 233, 235, 236, 237, 238 and 241, manual prerequisites)
12. The endpoint check of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (MAN/verify/endpoint/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this) — manual step: Check that the host and port of a credential of stackit_opensearch_instance.dependencies_catalog_opensearch_this (stackit_opensearch_credential; the draft writes one for the instance: read its host and port after the apply) answers the requests the clients of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this send, over the STACKIT address, as the endpoint of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this did. After steps 210, 217, 223, 233, 235, 236, 237, 238, 242. (not executable as the plan stands: it waits for step 242, which no answer makes executable as the plan stands; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
13. The endpoint check of module.retail_app_ecs.module.alb.aws_lb.this (MAN/verify/endpoint/module.retail_app_ecs.module.alb.aws_lb.this) — manual step: Check that the external_address of stackit_application_load_balancer.retail_app_ecs_alb_this answers the requests the clients of module.retail_app_ecs.module.alb.aws_lb.this send, over the STACKIT address, as the dns_name of module.retail_app_ecs.module.alb.aws_lb.this did. After steps 210, 217, 223, 233, 235, 236, 237, 238, 243. (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this; it also comes after steps 210, 217, 223, 233, 235, 236, 237, 238 and 243, manual prerequisites)
14. The rollback decision step (MAN/verify/rollback-decision) — manual step: Decide GO or ROLLBACK for the migration once every check of the verification is done: GO lets the source resources be retired, ROLLBACK reverts the cutover and keeps AWS serving. After 46 steps: 29, 31, 33 and 43 more (every predecessor is in execution-plan.json depends_on). (not executable as the plan stands: the decision point follows every check of the verification (each is also an action-complete precondition); the retirement steps depend on it, and through it on the checks; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)

Decommission

1. The cleanup of the data move of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore (MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/cleanup/dump-restore) — manual step: Only after the target has run in production for the period the customer decides and the way back is no longer wanted: remove the move host from parameters.sgw_acl of the instance; delete the dump file \<dump-file>.sql and load.log (the dump holds the data); keep a final snapshot of the source for the retention the customer decides before anything is deleted; delete the scratch instance of the rehearsal if it still exists; and replace the credential of the service key if it was ever on a ticket or in a file. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#clean-up-dump-restore. After steps 206, 258. (not executable as the plan stands: the source is not deleted in the same hour as the cutover; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
2. The cleanup of the data move of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine (MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/cleanup/client-import) — manual step: Only after the target has run in production for the period the customer decides and the way back is no longer wanted: remove the move host from parameters.sgw_acl of the instance; delete the files the copy wrote and the snapshot of the source that was taken as the fail-safe once the target is confirmed; delete the scratch instance of the rehearsal if it still exists; and replace the credential of the service key if it was ever on a ticket or in a file. The source cache is deleted only when its owner decides, after a final snapshot kept for the retention the customer decides. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#clean-up-client-import. After steps 213, 258. (not executable as the plan stands: the source cache is not deleted in the same hour as the cutover; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
3. The cleanup of the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/dump-restore) — manual step: Clean up what the move of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this leaves behind (the move host in the access list, the dump files, and for a replication the subscription, the publication and the slot) once the way back is no longer wanted. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#after-acceptance. After steps 226, 258. (not executable as the plan stands: the source is not deleted in the same hour as the cutover; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
4. The cleanup of the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication (MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/logical-replication) — manual step: Clean up what the move of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this leaves behind (the move host in the access list, the dump files, and for a replication the subscription, the publication and the slot) once the way back is no longer wanted. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#after-acceptance. After steps 229, 258. (not executable as the plan stands: the source is not deleted in the same hour as the cutover; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path replicate-with-the-engine-replication of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
5. The retirement of module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events (MAN/decommission/module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events) — manual step: Retire module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events (aws_cloudwatch_event_rule) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 168, 258. (not executable as the plan stands: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events reads 0 instances as the variables of the source stand: the step applies only if it exists (applies only if its count ((var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0) holds when OpenTofu plans — off with the defaults of var.container_insights_setting, var.lifecycle_events_enabled; it exists only if a variable file (-var-file), -var or TF_VAR_container_insights_setting/TF_VAR_lifecycle_events_enabled switches it on, and this scan saw no such value); it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
6. The retirement of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights (MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights) — manual step: Retire module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights (aws_cloudwatch_log_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 169, 258. (not executable as the plan stands: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights reads 0 instances as the variables of the source stand: the step applies only if it exists (applies only if its count ((var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0) holds when OpenTofu plans — off with the defaults of var.container_insights_setting, var.lifecycle_events_enabled; it exists only if a variable file (-var-file), -var or TF_VAR_container_insights_setting/TF_VAR_lifecycle_events_enabled switches it on, and this scan saw no such value); it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
7. The retirement of module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs (MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs) — manual step: Retire module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs (aws_cloudwatch_log_resource_policy) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 170, 258. (not executable as the plan stands: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs reads 0 instances as the variables of the source stand: the step applies only if it exists (applies only if its count ((var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0) holds when OpenTofu plans — off with the defaults of var.container_insights_setting, var.lifecycle_events_enabled; it exists only if a variable file (-var-file), -var or TF_VAR_container_insights_setting/TF_VAR_lifecycle_events_enabled switches it on, and this scan saw no such value); it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
8. The retirement of module.retail_app_ecs.module.alb.aws_lb.this (MAN/decommission/module.retail_app_ecs.module.alb.aws_lb.this) — manual step: Retire module.retail_app_ecs.module.alb.aws_lb.this (aws_lb) with its parts module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 29, 146, 147, 171, 243, 257, 258. (state S1)
9. The retirement of module.retail_app_ecs.module.alb.aws_security_group.this (MAN/decommission/module.retail_app_ecs.module.alb.aws_security_group.this) — manual step: Retire module.retail_app_ecs.module.alb.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 54, 71, 83, 258, 266. (state S1)
10. The retirement of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix (MAN/decommission/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix) — manual step: Retire module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix (aws_security_group) with its parts module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 14, 15, 55, 71, 80, 81, 82, 258, 266. (state S1)
11. The retirement of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this) — manual step: Retire module.retail_app_ecs.module.ui_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 10, 11, 38, 164, 165, 166, 167, 176, 177, 197, 254, 258. (state S1)
12. The retirement of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (MAN/decommission/module.retail_app_ecs.module.carts_service.aws_ecs_service.this) — manual step: Retire module.retail_app_ecs.module.carts_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 2, 3, 30, 148, 149, 150, 151, 176, 177, 193, 250, 258, 269. (state S1)
13. The retirement of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (MAN/decommission/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role) — manual step: Retire module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 56, 94, 95, 258, 270. (state S1)
14. The retirement of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (MAN/decommission/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role) — manual step: Retire module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.ecs_exec, module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_role_additional in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 57, 96, 97, 258, 270. (state S1)
15. The retirement of module.retail_app_ecs.module.carts_service.aws_security_group.this (MAN/decommission/module.retail_app_ecs.module.carts_service.aws_security_group.this) — manual step: Retire module.retail_app_ecs.module.carts_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 30, 31, 58, 71, 84, 89, 258, 270. (state S1)
16. The retirement of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this) — manual step: Retire module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 4, 5, 32, 152, 153, 154, 155, 176, 177, 194, 251, 258, 269. (state S1)
17. The retirement of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (MAN/decommission/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this) — manual step: Retire module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) with its parts module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 114, 115, 116, 117, 135, 136, 182, 183, 200, 203, 242, 245, 256, 258, 274. (state S1)
18. The retirement of module.dependencies.aws_security_group.catalog_opensearch_sg (MAN/decommission/module.dependencies.aws_security_group.catalog_opensearch_sg) — manual step: Retire module.dependencies.aws_security_group.catalog_opensearch_sg (aws_security_group) with its parts module.dependencies.aws_security_group_rule.allow_https_from_client in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 40, 71, 258, 275. (state S1)
19. The retirement of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role) — manual step: Retire module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_additional, module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 59, 98, 99, 258, 274. (state S1)
20. The retirement of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db) — manual step: Retire module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 46, 47, 74, 75, 76, 235, 258, 274, 277. (state S1)
21. The retirement of module.dependencies.module.catalog_rds.aws_rds_cluster.this (MAN/decommission/module.dependencies.module.catalog_rds.aws_rds_cluster.this) — manual step: Retire module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) with its parts module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 118, 119, 120, 121, 122, 178, 179, 180, 206, 209, 210, 246, 258, 259, 278. (not executable as the plan stands: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; the source states skip_final_snapshot = true: AWS takes no final snapshot when it is deleted, so the data is gone with it unless a backup was taken before; take the final backup this step needs yourself, before the delete; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
22. The retirement of module.dependencies.module.catalog_rds.aws_security_group.this (MAN/decommission/module.dependencies.module.catalog_rds.aws_security_group.this) — manual step: Retire module.dependencies.module.catalog_rds.aws_security_group.this (aws_security_group) with its parts module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 42, 71, 258, 279. (state S1)
23. The retirement of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch) — manual step: Retire module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 48, 49, 74, 75, 77, 236, 258, 274, 277. (state S1)
24. The retirement of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role) — manual step: Retire module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.ecs_exec in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 60, 100, 101, 258, 274. (state S1)
25. The retirement of module.retail_app_ecs.module.catalog_service.aws_security_group.this (MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_security_group.this) — manual step: Retire module.retail_app_ecs.module.catalog_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 32, 33, 61, 71, 85, 90, 258, 274, 276, 280. (state S1)
26. The retirement of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this) — manual step: Retire module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 6, 7, 34, 156, 157, 158, 159, 176, 177, 195, 252, 258, 269. (state S1)
27. The retirement of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (MAN/decommission/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default) — manual step: Retire module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 123, 124, 125, 126, 138, 139, 140, 213, 216, 217, 247, 258, 260, 284. (state S1)
28. The retirement of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd (MAN/decommission/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd) — manual step: Retire module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd (aws_security_group) with its parts module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 43, 71, 258, 285. (state S1)
29. The retirement of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role) — manual step: Retire module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 62, 102, 103, 258, 284. (state S1)
30. The retirement of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role) — manual step: Retire module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.ecs_exec, module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_role_additional in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 63, 104, 105, 258, 284. (state S1)
31. The retirement of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (MAN/decommission/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) — manual step: Retire module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 127, 128, 129, 137, 219, 222, 223, 248, 258, 270, 272, 288. (state S1)
32. The retirement of module.retail_app_ecs.module.checkout_service.aws_security_group.this (MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_security_group.this) — manual step: Retire module.retail_app_ecs.module.checkout_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 34, 35, 64, 71, 86, 91, 258, 284, 286. (state S1)
33. The retirement of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (MAN/decommission/module.retail_app_ecs.module.orders_service.aws_ecs_service.this) — manual step: Retire module.retail_app_ecs.module.orders_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 8, 9, 36, 160, 161, 162, 163, 176, 177, 196, 253, 258, 269, 284. (state S1)
34. The retirement of module.retail_app_ecs.aws_ecs_cluster.cluster (MAN/decommission/module.retail_app_ecs.aws_ecs_cluster.cluster) — manual step: Retire module.retail_app_ecs.aws_ecs_cluster.cluster (aws_ecs_cluster) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 176, 177, 258, 269, 270, 274, 284, 291. (state S1)
35. The retirement of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role) — manual step: Retire module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_additional, module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 65, 106, 107, 258, 291. (state S1)
36. The retirement of module.retail_app_ecs.aws_kms_key.cmk (MAN/decommission/module.retail_app_ecs.aws_kms_key.cmk) — manual step: Retire module.retail_app_ecs.aws_kms_key.cmk (aws_kms_key) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 45, 72, 73, 258, 277, 278, 281, 293. (state S1)
37. The retirement of module.retail_app_ecs.aws_secretsmanager_secret.mq (MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.mq) — manual step: Retire module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.mq in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 50, 51, 74, 75, 78, 237, 258, 291, 293. (state S1)
38. The retirement of module.dependencies.aws_mq_broker.mq (MAN/decommission/module.dependencies.aws_mq_broker.mq) — manual step: Retire module.dependencies.aws_mq_broker.mq (aws_mq_broker) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 142, 143, 144, 145, 191, 192, 239, 240, 241, 255, 258, 295. (state S1)
39. The retirement of module.dependencies.aws_security_group.mq (MAN/decommission/module.dependencies.aws_security_group.mq) — manual step: Retire module.dependencies.aws_security_group.mq (aws_security_group) with its parts module.dependencies.aws_security_group_rule.mq in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 41, 71, 258, 296. (state S1)
40. The retirement of module.retail_app_ecs.aws_secretsmanager_secret.orders_db (MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.orders_db) — manual step: Retire module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 52, 53, 74, 75, 79, 238, 258, 291, 293. (state S1)
41. The retirement of module.dependencies.module.orders_rds.aws_rds_cluster.this (MAN/decommission/module.dependencies.module.orders_rds.aws_rds_cluster.this) — manual step: Retire module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) with its parts module.dependencies.module.orders_rds.aws_rds_cluster_instance.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After 18 steps: 130, 131, 132 and 15 more (every predecessor is in execution-plan.json depends_on). (not executable as the plan stands: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; the source states skip_final_snapshot = true: AWS takes no final snapshot when it is deleted, so the data is gone with it unless a backup was taken before; take the final backup this step needs yourself, before the delete; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this)
42. The retirement of module.dependencies.module.orders_rds.aws_security_group.this (MAN/decommission/module.dependencies.module.orders_rds.aws_security_group.this) — manual step: Retire module.dependencies.module.orders_rds.aws_security_group.this (aws_security_group) with its parts module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 44, 71, 258, 299. (state S1)
43. The retirement of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role) — manual step: Retire module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.ecs_exec in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 66, 108, 109, 258, 291. (state S1)
44. The retirement of module.retail_app_ecs.module.orders_service.aws_security_group.this (MAN/decommission/module.retail_app_ecs.module.orders_service.aws_security_group.this) — manual step: Retire module.retail_app_ecs.module.orders_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 36, 37, 67, 71, 87, 92, 258, 291, 297, 300. (state S1)
45. The retirement of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (MAN/decommission/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role) — manual step: Retire module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 68, 110, 111, 258, 269. (state S1)
46. The retirement of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (MAN/decommission/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role) — manual step: Retire module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.ecs_exec in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 69, 112, 113, 258, 269. (state S1)
47. The retirement of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks) — manual step: Retire module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (aws_cloudwatch_log_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 172, 173, 174, 175, 258, 269, 270, 272, 274, 282, 284, 288, 291, 301, 304. (not executable as the plan stands: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this, DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS)
48. The retirement of module.retail_app_ecs.module.ui_service.aws_security_group.this (MAN/decommission/module.retail_app_ecs.module.ui_service.aws_security_group.this) — manual step: Retire module.retail_app_ecs.module.ui_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 38, 39, 70, 71, 88, 93, 258, 269. (state S1)
49. The retirement of module.vpc.module.vpc.aws_route_table.private (MAN/decommission/module.vpc.module.vpc.aws_route_table.private) — manual step: Retire module.vpc.module.vpc.aws_route_table.private (aws_route_table) with its parts module.vpc.module.vpc.aws_route.private_nat_gateway, module.vpc.module.vpc.aws_route_table_association.private in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 1, 12, 19, 258. (not executable as the plan stands: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this, DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST)
50. The retirement of module.vpc.module.vpc.aws_nat_gateway.this (MAN/decommission/module.vpc.module.vpc.aws_nat_gateway.this) — manual step: Retire module.vpc.module.vpc.aws_nat_gateway.this (aws_nat_gateway) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 18, 258, 307. (not executable as the plan stands: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this, DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST)
51. The retirement of module.vpc.module.vpc.aws_eip.nat (MAN/decommission/module.vpc.module.vpc.aws_eip.nat) — manual step: Retire module.vpc.module.vpc.aws_eip.nat (aws_eip) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 16, 258, 308. (not executable as the plan stands: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this, DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST)
52. The retirement of module.vpc.module.vpc.aws_route_table.public (MAN/decommission/module.vpc.module.vpc.aws_route_table.public) — manual step: Retire module.vpc.module.vpc.aws_route_table.public (aws_route_table) with its parts module.vpc.module.vpc.aws_route.public_internet_gateway, module.vpc.module.vpc.aws_route_table_association.public in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 13, 20, 258. (state S1)
53. The retirement of module.vpc.module.vpc.aws_internet_gateway.this (MAN/decommission/module.vpc.module.vpc.aws_internet_gateway.this) — manual step: Retire module.vpc.module.vpc.aws_internet_gateway.this (aws_internet_gateway) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 17, 258, 308, 309, 310. (not executable as the plan stands: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this, DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST)
54. The retirement of module.vpc.module.vpc.aws_subnet.private (MAN/decommission/module.vpc.module.vpc.aws_subnet.private) — manual step: Retire module.vpc.module.vpc.aws_subnet.private (aws_subnet) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 21, 22, 27, 258, 269, 270, 274, 275, 279, 284, 285, 291, 296, 299, 307. (not executable as the plan stands: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for 16 decisions: DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE and 13 more (decision group BS-5a0c205434b4 of execution-plan.json))
55. The retirement of module.vpc.module.vpc.aws_subnet.public (MAN/decommission/module.vpc.module.vpc.aws_subnet.public) — manual step: Retire module.vpc.module.vpc.aws_subnet.public (aws_subnet) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After steps 23, 24, 28, 258, 266, 308, 310. (not executable as the plan stands: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this, DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST)
56. The retirement of module.vpc.module.vpc.aws_vpc.this (MAN/decommission/module.vpc.module.vpc.aws_vpc.this) — manual step: Retire module.vpc.module.vpc.aws_vpc.this (aws_vpc) with its parts module.vpc.module.vpc.aws_default_network_acl.this, module.vpc.module.vpc.aws_default_route_table.default, module.vpc.module.vpc.aws_default_security_group.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it. After 26 steps: 25, 26, 258 and 23 more (every predecessor is in execution-plan.json depends_on). (not executable as the plan stands: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for 16 decisions: DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE and 13 more (decision group BS-5a0c205434b4 of execution-plan.json))

Terraform commands

execution/terraform/apply.md lists every OpenTofu step with its resource and file. OpenTofu applies the whole draft in one run and enforces none of the manual steps, STACKIT API calls or phases of the plan: complete the steps that execution/terraform/apply.md lists under "Complete these steps before tofu apply" first. 4 OpenTofu steps are not executable yet: a full apply creates every block of the draft as it stands, theirs included, so apply only when every OpenTofu step is executable. From the output folder:

cd terraform
tofu init
tofu validate
tofu plan -out=stackit.tfplan
tofu apply stackit.tfplan

API commands

Each call has a request file (the call as data) and a script that renders it. A script is run with bash <script> from any folder; it stops before the call when its step is not executable, when an input is not set, or when the call needs a confirmation.

• step 76: execution/api/secrets-manager-vault/001-writesecret.sh (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-API-OPT-IN; and, as the plan states: Required input: STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_CATALOG_DB names a file (keep it outside the package and out of version control) that holds the JSON object of the key/value pairs the secret at the path STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB names has on STACKIT. StackToIT never reads the value of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db from the source, so the document is yours: the same value from a secure source, or a new one. The source builds the value (its version resource, attribute secret_string) from module.dependencies.module.catalog_rds.aws_rds_cluster.this: the document holds the matching values on STACKIT, under the keys the consumers of the secret read (the key names are in the source's secret_string, which the scan does not read); The password in the document is the one of the master user the draft creates on STACKIT, not the AWS one (module.dependencies.module.catalog_rds.aws_rds_cluster.this: the sensitive output dependencies_catalog_rds_this_admin_password): read it with tofu output after that database step has run, and write it into the file yourself; the host and the port are in the connection data of the drafted instance; The path of the secret is an input: STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB names it (the source does not state the name as a literal the plan can rely on), so this step does not carry the setting name and its manual step stays; the applications read the secret by the path you choose; The step logs in as the migration user stackit_secretsmanager_user.migration (write_enabled = true), which reaches every secret of stackit_secretsmanager_instance.migrated_secrets and whose generated password is in the OpenTofu state (a sensitive attribute): delete the user (remove its block from the draft and apply) once the secrets are written. The script reads the username and password with tofu output, or from STACKIT_INPUT_USERNAME and STACKIT_INPUT_PASSWORD, and prints neither; The write makes a new version of the secret. The script reads the secret first (ReadSecret) and stops without writing (exit 4) when it already has a current version, unless STACKIT_CONFIRM_REPLACE is set to the path of the secret; it does not read the values back and prints none; STACKIT's page shows neither the answer of the login nor the status of a read of a secret that has no version: the script takes the token from auth.client_token and reads 404 as "no current version" (the Vault KV version 2 API the page calls compatible), and stops on any other answer. The API states no release status, so the call waits for the opt-in to it; The call carries the path and the value of the secret only; its customer-managed key: it has no counterpart in the call, so it stays open in the steps of the setting (a rotation is never carried); the maturity of the Secrets Manager Vault-compatible API is not established (its documentation states no release status): a call of it is not executed without an explicit opt-in (DEC-GEN-CONVERT-API-OPT-IN); the migration of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db is not complete with this step: 3 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (3 manual, 0 refused): secret-value, customer-managed-key, tc-secretsmanager-secret-name)
• step 77: execution/api/secrets-manager-vault/002-writesecret.sh (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-API-OPT-IN; and, as the plan states: Required input: STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_CATALOG_OPENSEARCH names a file (keep it outside the package and out of version control) that holds the JSON object of the key/value pairs the secret at the path STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH names has on STACKIT. StackToIT never reads the value of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch from the source, so the document is yours: the same value from a secure source, or a new one. The source builds the value (its version resource, attribute secret_string) from a value it generates itself (module.dependencies.random_string.catalog_opensearch_master): the document holds the matching values on STACKIT (for a generated value, one you generate or choose for STACKIT: the generated one is only in the source's state), under the keys the consumers of the secret read (the key names are in the source's secret_string, which the scan does not read); The path of the secret is an input: STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH names it (the source does not state the name as a literal the plan can rely on), so this step does not carry the setting name and its manual step stays; the applications read the secret by the path you choose; The step logs in as the migration user stackit_secretsmanager_user.migration (write_enabled = true), which reaches every secret of stackit_secretsmanager_instance.migrated_secrets and whose generated password is in the OpenTofu state (a sensitive attribute): delete the user (remove its block from the draft and apply) once the secrets are written. The script reads the username and password with tofu output, or from STACKIT_INPUT_USERNAME and STACKIT_INPUT_PASSWORD, and prints neither; The write makes a new version of the secret. The script reads the secret first (ReadSecret) and stops without writing (exit 4) when it already has a current version, unless STACKIT_CONFIRM_REPLACE is set to the path of the secret; it does not read the values back and prints none; STACKIT's page shows neither the answer of the login nor the status of a read of a secret that has no version: the script takes the token from auth.client_token and reads 404 as "no current version" (the Vault KV version 2 API the page calls compatible), and stops on any other answer. The API states no release status, so the call waits for the opt-in to it; The call carries the path and the value of the secret only; its customer-managed key: it has no counterpart in the call, so it stays open in the steps of the setting (a rotation is never carried); the maturity of the Secrets Manager Vault-compatible API is not established (its documentation states no release status): a call of it is not executed without an explicit opt-in (DEC-GEN-CONVERT-API-OPT-IN); the migration of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch is not complete with this step: 3 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (3 manual, 0 refused): secret-value, customer-managed-key, tc-secretsmanager-secret-name)
• step 78: execution/api/secrets-manager-vault/003-writesecret.sh (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-API-OPT-IN; and, as the plan states: Required input: STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_MQ names a file (keep it outside the package and out of version control) that holds the JSON object of the key/value pairs the secret at the path STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ names has on STACKIT. StackToIT never reads the value of module.retail_app_ecs.aws_secretsmanager_secret.mq from the source, so the document is yours: the same value from a secure source, or a new one. The source builds the value (its version resource, attribute secret_string) from module.dependencies.aws_mq_broker.mq and a value it generates itself (module.dependencies.random_password.mq_password): the document holds the matching values on STACKIT (for a generated value, one you generate or choose for STACKIT: the generated one is only in the source's state), under the keys the consumers of the secret read (the key names are in the source's secret_string, which the scan does not read); The path of the secret is an input: STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ names it (the source does not state the name as a literal the plan can rely on), so this step does not carry the setting name and its manual step stays; the applications read the secret by the path you choose; The step logs in as the migration user stackit_secretsmanager_user.migration (write_enabled = true), which reaches every secret of stackit_secretsmanager_instance.migrated_secrets and whose generated password is in the OpenTofu state (a sensitive attribute): delete the user (remove its block from the draft and apply) once the secrets are written. The script reads the username and password with tofu output, or from STACKIT_INPUT_USERNAME and STACKIT_INPUT_PASSWORD, and prints neither; The write makes a new version of the secret. The script reads the secret first (ReadSecret) and stops without writing (exit 4) when it already has a current version, unless STACKIT_CONFIRM_REPLACE is set to the path of the secret; it does not read the values back and prints none; STACKIT's page shows neither the answer of the login nor the status of a read of a secret that has no version: the script takes the token from auth.client_token and reads 404 as "no current version" (the Vault KV version 2 API the page calls compatible), and stops on any other answer. The API states no release status, so the call waits for the opt-in to it; the maturity of the Secrets Manager Vault-compatible API is not established (its documentation states no release status): a call of it is not executed without an explicit opt-in (DEC-GEN-CONVERT-API-OPT-IN); the migration of module.retail_app_ecs.aws_secretsmanager_secret.mq is not complete with this step: 2 critical settings of it that the draft does not carry are steps of their own (2 manual, 0 refused): secret-value, tc-secretsmanager-secret-name)
• step 79: execution/api/secrets-manager-vault/004-writesecret.sh (not executable — requires a design decision — blocked by DEC-GEN-CONVERT-API-OPT-IN; and, as the plan states: Required input: STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_ORDERS_DB names a file (keep it outside the package and out of version control) that holds the JSON object of the key/value pairs the secret at the path STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB names has on STACKIT. StackToIT never reads the value of module.retail_app_ecs.aws_secretsmanager_secret.orders_db from the source, so the document is yours: the same value from a secure source, or a new one. The source builds the value (its version resource, attribute secret_string) from module.dependencies.module.orders_rds.aws_rds_cluster.this: the document holds the matching values on STACKIT, under the keys the consumers of the secret read (the key names are in the source's secret_string, which the scan does not read); The password in the document is the one of the master user the draft creates on STACKIT, not the AWS one (module.dependencies.module.orders_rds.aws_rds_cluster.this: the sensitive output dependencies_orders_rds_this_admin_password): read it with tofu output after that database step has run, and write it into the file yourself; the host and the port are in the connection data of the drafted instance; The path of the secret is an input: STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB names it (the source does not state the name as a literal the plan can rely on), so this step does not carry the setting name and its manual step stays; the applications read the secret by the path you choose; The step logs in as the migration user stackit_secretsmanager_user.migration (write_enabled = true), which reaches every secret of stackit_secretsmanager_instance.migrated_secrets and whose generated password is in the OpenTofu state (a sensitive attribute): delete the user (remove its block from the draft and apply) once the secrets are written. The script reads the username and password with tofu output, or from STACKIT_INPUT_USERNAME and STACKIT_INPUT_PASSWORD, and prints neither; The write makes a new version of the secret. The script reads the secret first (ReadSecret) and stops without writing (exit 4) when it already has a current version, unless STACKIT_CONFIRM_REPLACE is set to the path of the secret; it does not read the values back and prints none; STACKIT's page shows neither the answer of the login nor the status of a read of a secret that has no version: the script takes the token from auth.client_token and reads 404 as "no current version" (the Vault KV version 2 API the page calls compatible), and stops on any other answer. The API states no release status, so the call waits for the opt-in to it; the maturity of the Secrets Manager Vault-compatible API is not established (its documentation states no release status): a call of it is not executed without an explicit opt-in (DEC-GEN-CONVERT-API-OPT-IN); the migration of module.retail_app_ecs.aws_secretsmanager_secret.orders_db is not complete with this step: 2 critical settings of it that the draft does not carry are steps of their own (2 manual, 0 refused): secret-value, tc-secretsmanager-secret-name)

The execution order names, as "Step state", how far the step of a call has come: "generated, not yet tested offline" (a converter wrote it and no test ran its script against a local stub), "generated, tested offline" (a test of StackToIT ran the script under a real shell against a local stub), "verified live" (a recorded probe against the STACKIT API shows the step does what it states) and "catalogued, not generated" (the call is known and described and no converter writes it). StackToIT runs none of these calls itself.

A script compares the answer of its call with the answer the plan expects (the HTTP status exactly, and a member when the plan names one). It stops with exit 3 when its step is not executable, 4 when the call needs the confirmation, 5 when an input, a tool or a file is missing or unsafe, 6 when its lookup cannot tell whether the object exists, 7 when the answer is not the expected one, and 8 when a postcondition it checks does not hold.

A script that calls a STACKIT API with curl trusts the certificate authorities curl trusts. For an API behind a private authority, set STACKIT_CA_BUNDLE to a PEM file of its certificates (curl's --cacert); the certificate is always verified. Each call ends after STACKIT_CALL_TIMEOUT_SECONDS seconds (120 unless it names others, at most 3600), so an API that does not answer stops the script with a non-zero exit instead of holding it; a call that timed out may still have been made, so read the target before running the script again.

A script that writes a secret into STACKIT Secrets Manager (the Vault-compatible API) logs in as the Secrets Manager user the draft creates, with the username and password that user has once the draft is applied (the script reads them from the draft's outputs with tofu output, or from its STACKIT_INPUT_USERNAME and STACKIT_INPUT_PASSWORD variables), and writes the document of key/value pairs that the file named in its STACKIT_INPUT_SECRET_DOCUMENT_<n> variable holds. The document is a file of yours: the package holds no value of any secret, and the script prints no value, puts none on a command line and keeps none outside its own temporary folder. A secret that already has a current version stops the script (exit 4) until STACKIT_CONFIRM_REPLACE is set to the path of the secret, because the write makes a new version the current one. The user is a migration user with write access to every secret of the instance and its password is in the OpenTofu state: delete the user (remove its block from the draft and apply) once the secrets are written.

Manual steps

254 steps are carried out by a person, each described in execution/manual/actions.md: what, why, who, when, what it needs and when it is done. Roles named: Data Architect, Identity Architect, Migration Owner, Network Architect, Platform Architect, Security Architect.

Verification

execution/verify/checks.md lists 283 checks to hold before the steps and 65 checks to hold after them, one checklist row each. 1 of them confirms a critical setting the draft carries (verification only): a person confirms it in the file of the draft, and no step sets it up by hand.

Rollback

Undoing a step: 68 can be undone (the step says how), 10 only in part (what was written since is lost), 231 by a person, 5 cannot be undone. From the cutover on, steps 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 235, 236, 237, 238, 239, 240, 241, 242, 243, 258, 259, 260, 261, 262, 263, 264, 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 311, 312, 313, 314 cannot be undone in full by a tool: decide how before the cutover starts. Each step's rollback is in the actions sheet and, for a manual step, in execution/manual/actions.md.

Files of this package

• execution-plan.json — the plan itself, machine-readable, at the root of the run: the one file of the plan (issue #317: the package holds no copy of it)
• execution/terraform/apply.md — the OpenTofu steps and commands
• execution/api/ — one request file and one script for each STACKIT API call
• execution/manual/actions.md — the manual steps and what is not migrated
• execution/verify/checks.md — the checks before and after each step
• migration/execution-actions.csv — one row per step, for a spreadsheet
• migration/work-packages.csv — one row per work package of the manual steps, for a spreadsheet