brief.md

Executive brief — default

PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.

Run f6267c3f-2848-4aa5-89df-5fee8b15b3b9 · source digest sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70

This brief restates the numbers and the states that workspace.json holds. It scores nothing and recommends no decision: every decision it names is for a named architect, and the draft is a proposal.

• Migration ready: NO — decisions to take: 89 · changes executable now: 73 · waiting: 149; 3 refused (of 314 steps) — plan steps: a decision to take is a step whose work is to decide, not a record of the decision register; changes executable now include the manual steps a person can start without a decision
• Source assurance: provider aws UNPINNED (confidence at most MEDIUM; remedy: (a) commit .terraform.lock.hcl with aws 5.100.0, the verified version the constraints admit: at least 11 units are then left to a manual review (no draft of their own) because 5.x is an earlier generation than the one the knowledge base is checked against; (b) raise the constraint ~> 5.0 to ~> 6.0 and lock aws 6.67.0, the primary verified version: no generation difference) · OpenTofu validation of the source: not run (lock file) · every required input of the source is in the package
• Cost: Financial comparison: NOT AVAILABLE — source region unknown (30 AWS lines wait for source.aws.region); 9 of 14 STACKIT lines have no price; 10 billable source resources are outside the model; the subtotal of one side is not a comparison and no saving is stated. 5 of 44 lines priced (reasons: 30 region needed); of the STACKIT amount, 3 priced lines (713.67 EUR) rest on defaults of the draft that no decision confirmed (DEC-GEN-CONVERT-SIZE-FROM-SOURCE)
• Mappings: 0 of 44 land on GA STACKIT services with every critical setting accounted · maturity beta 44
• Mapping confidence: 0 of 44 HIGH — capped at MEDIUM by the source provider band: aws UNPINNED (the Source provider line below has the remedy)
• Automation eligibility: 0 of 44 units — a unit is automation-eligible when its critical settings are closed; this is not the steps that can run now; 17 more become eligible once their open items are answered; 27 cannot be automated in this build: a critical setting STACKIT does not support (13 units), a target resource the provider marks experimental (10 units), a decision whose every option is work a person does by hand (5 units), a permission document the source does not show (5 units) and a unit left to an architect (1 unit); the unpinned provider is one open item of every unit it serves: (a) commit .terraform.lock.hcl with aws 5.100.0, the verified version the constraints admit: at least 11 units are then left to a manual review (no draft of their own) because 5.x is an earlier generation than the one the knowledge base is checked against; (b) raise the constraint ~> 5.0 to ~> 6.0 and lock aws 6.67.0, the primary verified version: no generation difference
• Live verification: never applied to STACKIT — no STACKIT plan was run over this draft and no step of the plan has met a live STACKIT project; 0 of 4 STACKIT API steps verified live
• Source provider: aws UNPINNED — confidence at most MEDIUM, no automation eligibility (no lock file entry pins it) — remedy: (a) commit .terraform.lock.hcl with aws 5.100.0, the verified version the constraints admit: at least 11 units are then left to a manual review (no draft of their own) because 5.x is an earlier generation than the one the knowledge base is checked against; (b) raise the constraint ~> 5.0 to ~> 6.0 and lock aws 6.67.0, the primary verified version: no generation difference — only a lock file and a source validation show that either works
• Applications: 0 of 5 ready for validation · 3 BLOCKED, 2 NOT_READY — causes: engine downgrade OpenSearch 3.3 → 2; code migration DynamoDB → MongoDB Flex; TLS-only Key Value Store (Valkey) endpoint (client change for ElastiCache); data protocol not assessed Aurora → MariaDB; 2 data stores with no drafted target and no assessed protocol; workload identity undecided on 5 of 5. The states are the customer's own record in the decisions file; StackToIT deployed and validated no application
• DEPLOYMENT_BLOCKED: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this and the application catalog (the engine downgrade OpenSearch 3.3 → 2) until a test shows the application works against the version STACKIT offers or an architecture decision (a self-managed engine on SKE, or waiting for the version) is recorded in the decisions file
• Code change: 1 unit needs a code change in the application (DynamoDB → MongoDB Flex), counted apart from the automation figures (can run now, automation-eligible, actually runnable): a unit whose application is rewritten is not a unit whose infrastructure alone changes; 3 more drafted data stores have a protocol that is not assessed, so a code change is not ruled out (OpenSearch → OpenSearch, Aurora → MariaDB, ElastiCache → Key Value Store (Valkey))

Summary

Scope. 44 units counted in the totals of default; the draft generates a STACKIT resource for 38 of them and 11 units need none; package state: Partially executable migration package. The draft is a proposal: nothing is applied, and no decision is taken for anyone.

The largest open decisions. No answer has reshaped the draft yet, so these are open decisions, not changes.

1. module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) is a REDESIGN
2. Choose the database engine version: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this
3. Choose the database engine: module.dependencies.module.catalog_rds.aws_rds_cluster.this

Priced part. 5 of 44 lines priced (source 0 of 30, STACKIT 5 of 14); no source subtotal (none of the 30 source lines has an amount); STACKIT: partial 878.34 EUR (5 of 14 lines priced); of it 72.70 EUR target only (1 line the source side has no line to stand against: in the total, in no comparison); of it 3 priced lines (713.67 EUR) rest on defaults of the draft that no decision confirmed (DEC-GEN-CONVERT-SIZE-FROM-SOURCE). 0 of 27 billable source resources priced on both sides (113 more carry no charge of their own): the brief gives no saving and no comparison. A price is a net list price, never a bill, and a resource without a price is not free.

Open work. Critical settings that need a person to decide: 282. Apart from them, 1 is carried by the draft already (confirm only) and 0 are accepted design changes that nobody decides. Resolved: 36 of 319 critical settings. The rest of this brief lists every item with its owner and the condition that closes it; the Decisions page of the report holds the full register.

First required action. Allow STACKIT's pre-release API, which may change or be withdrawn: Secrets Manager v1 (release status not stated). 4 steps wait for this answer; allowing the calls lets the plan carry them out and makes the migration depend on that API. If you say no (record a rejection), the calls are not made: the steps of Secrets Manager stay open. Record the answer in the decisions file given with --decisions (decisions-template.yaml). (Allow the calls of STACKIT APIs that are not generally available, open input).

Proposed pilot. Run one workload of this estate end to end on a STACKIT sandbox project, with an architect closing the open settings above first; the owner of the migration accepts or rejects this proposal.

Applications

5 applications: 0 ready · 1 blocked · 2 redesign · 2 not ready; 5 PROPOSED by StackToIT (nobody has confirmed them), 0 confirmed by the customer

• carts — REDESIGN · PROPOSED: module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) is a REDESIGN (shared with other groups) - Can it move now: 17 of 26 steps can run now (4 wait for decisions; 5 no answer frees (not executable as the plan stands, or refused)). - What blocks it: 6 decisions hold its steps; the ones that free most: DEC-GEN-CONVERT-POD-SEGMENTATION frees 4 by itself. - How much work: 18 manual steps, 0 data moves. - To accept: 5 open security decisions (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885, DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF and 1 more).
• catalog — BLOCKED · PROPOSED: workload catalog is blocked (a data store protocol is not assessed, an engine version is downgraded and 2 more); module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this stays deployment blocked: an engine version the region does not offer - Can it move now: 19 of 41 steps can run now (11 wait for decisions; 11 no answer frees (not executable as the plan stands, or refused)). - What blocks it: 6 decisions hold its steps; the ones that free most: DEC-GEN-CONVERT-POD-SEGMENTATION frees 3 by itself, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE frees 2 by itself. - How much work: 31 manual steps, 1 data move. - To accept: 7 open security decisions (DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E, DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913, DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E and 3 more).
• checkout — REDESIGN · PROPOSED: module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) is a REDESIGN (shared with other groups) - Can it move now: 25 of 46 steps can run now (3 of them rest on a default nobody confirmed; 1 more after a manual step; 11 wait for decisions; 9 no answer frees (not executable as the plan stands, or refused)). - What blocks it: 6 decisions hold its steps; the ones that free most: DEC-GEN-CONVERT-DATA-MOVEMENT frees 4 by itself, DEC-GEN-CONVERT-POD-SEGMENTATION frees 4 by itself. - How much work: 36 manual steps, 1 data move. - To accept: 6 open security decisions (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673, DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F and 2 more).
• orders — NOT READY · PROPOSED: workload orders is not ready (environment values are required, the workload identity is undecided and 1 more) - Can it move now: 40 of 79 steps can run now (6 of them rest on a default nobody confirmed; 1 more after a manual step; 24 wait for decisions; 14 no answer frees (not executable as the plan stands, or refused)). - What blocks it: 6 decisions hold its steps; the ones that free most: DEC-GEN-CONVERT-DATA-MOVEMENT frees 4 by itself, DEC-GEN-CONVERT-POD-SEGMENTATION frees 4 by itself, DEC-GEN-CONVERT-API-OPT-IN frees 2 by itself. - How much work: 62 manual steps, 1 data move. - To accept: 8 open security decisions (DEC-IAM-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS, DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202, DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS and 4 more).
• ui — NOT READY · PROPOSED: workload ui is not ready (the workload identity is undecided, the functional check has not run) - Can it move now: 28 of 43 steps can run now (7 wait for decisions; 8 no answer frees (not executable as the plan stands, or refused)). - What blocks it: 6 decisions hold its steps; the ones that free most: DEC-GEN-CONVERT-POD-SEGMENTATION frees 4 by itself. - How much work: 32 manual steps, 0 data moves. - To accept: 6 open security decisions (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0, DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS, DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS and 2 more).

The state is read from the unit classes and from the application compatibility contracts; it is not a validation, and an application with a workload no contract covers is not ready.

The run

Partially executable migration package · Proposal only · Not approved.

• Plan steps: 49 generated automatically · 4 generated with decisions · 238 manual carry-over · 3 unsupported · 3 units left to the architect for redesign — manual carry-over here includes the cutover, verification and retirement steps; STACKIT API steps, and Terraform steps that no decision can free, are in none of these counts, which the Execution line below states; manual carry-over counts the longest method of each open data-movement choice
• Source unit fate: 34 Terraform-only · 4 hybrid · 0 API-only · 3 manual · 11 no resource (of 52 units the draft considered: 44 known-present, 8 decided only when OpenTofu plans) — what becomes of each unit the draft considered; the five add up to the units considered, and Terraform-only and hybrid together are the units generated
• Execution: 48 of the 57 automated steps (OpenTofu or a script) can run now (1 waits for a manual prerequisite, 8 require a design decision) · 9 of those 48 rest on a default you have not confirmed (public endpoint, size derived from the source) · stages of 57 automated steps: 57 can be generated, 48 can run now, 39 rest on no default left to confirm, 0 are approved (every decision and default confirmed in the decisions file) · 49 Terraform (1 after a manual prerequisite) · 4 API (4 wait for the opt-in) · 4 design inputs · 154 manual migration work (272 settings in 69 review steps) (counting the longest method of each open data-movement choice; 16 steps of the other methods not counted) · 84 lifecycle (cutover/verify/retire) · 3 refused (of 314 plan steps) — what each step of the plan is; the categories add up to the plan's steps
• Defaults: the default of 8 decisions nobody has answered: public endpoint (5), size derived from the source (3); confirm or change each in decisions.yaml; confirming one accepts what the draft does as it stands: the steps that rest on it then count among those that rest on no default left to confirm, and as approved once every decision they rest on is answered in the decisions file; decisions are counted one by one here, while the register's decisions to make and defaults to confirm count the records that group them — the steps that can run now may stand on them; the decision register lists each decision
• Inputs: 4 design inputs wait · 47 open requests (14 block the draft, 4 are preferences this build cannot apply — inputs-template.yaml, NOT APPLICABLE IN THIS BUILD, says where to set each) — design inputs are steps of the plan; requests are what the run asks the customer, listed one by one when the run is given an inputs file or a project
• Source units: 44 — known-present migration units; 8 more decided only when OpenTofu plans: 3 off with the defaults of their variables (a variable can switch them on), 5 decided by data OpenTofu reads when it plans, 41 switched off
• Critical open settings: 283 — 282 to decide, 1 confirm only; 36 resolved of the 319 the units state; 25 more are open on 5 units decided when OpenTofu plans, not counted here but listed in the decision register (marked: applies only if)
• Decisions to review: 16 decisions to make (9 plan decisions, 5 manual actions, 2 plan statements, 2 of them with the draft's DEFAULT to confirm or change) · 2 defaults to confirm (other records, no step waits for them) · 48 units to review (308 critical settings: 307 to decide (25 of them are conditional), 1 confirm only) — a decision to make is a record of an open plan decision, manual action or plan statement; a default to confirm is such a record whose default option the draft carries out (no step waits for it: a person confirms it or changes it); a unit to review is the review record of the critical settings of one unit that the knowledge base cannot decide (one record for each owner role, each setting an item of it); conditional settings are on units decided only when OpenTofu plans (decisions.json)
• Draft coverage: 38 of 52 units with a generated resource — 11 need no resource · 3 left for the architect · 60 variables · the 52 are the 44 source units and 8 conditional units
• Global draft invariants: 12/12 PASS — consistency checks over the draft; not target behaviour
• tofu validate: PASSED — static validation; not target behaviour
• Architect approval: NOT PROVIDED
• Safe to apply: NOT ASSERTED

Run status: COMPLETE (report published); source status: RUNTIME TOPOLOGY PARTIAL.

What changes for the applications and the engines

These come before every dependency item: an application that talks to a rewritten data store or to another engine changes, whatever else is decided.

• Redesign: module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) is a REDESIGN, not a like-for-like move: the STACKIT target is STACKIT MongoDB Flex, and what uses it is adapted
• Engine change: Choose the database engine version: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E)
• Engine change: Choose the database engine: module.dependencies.module.catalog_rds.aws_rds_cluster.this (DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
• Engine change: Choose the database engine version: module.dependencies.module.catalog_rds.aws_rds_cluster.this (DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
• Engine change: Choose the database engine version: module.dependencies.aws_mq_broker.mq (DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ)

What holds the estate back

Security. 15 source weaknesses stated (1 carried unchanged, 9 not carried, 5 not compared with the draft) (1 plaintext public listener; world-open ingress on tcp 8080; 1 transit encryption off; 2 final snapshots skipped; 5 single-node data stores; 1 access policy for every principal), 6 wait for security acceptance — the draft changes no security policy; decide before the migration. They are listed on the Security page of index.html and in assurance/safety.md.

• Confirm that every resource names the one network (finding group): 12 units — warning Owner: unassigned (a finding records no owner role). Concerns: module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 others. The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is generated automatically until then (gate blocker TOPOLOGY:vpc-unproven).
• Confirm that the project is the boundary of one network (open critical setting): 12 units — REVIEW Owner: Network Architect. Concerns: module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 others. Closes when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
• Decide which networks the security group may be attached to (a STACKIT group has no network scope) (open critical setting): 12 units — UNSUPPORTED Owner: Network Architect. Concerns: module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 others. Closes when: A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.
• Review the stateful setting (open critical setting): 12 units — REVIEW Owner: Network Architect. Concerns: module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 others. Closes when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
• Review the IAM trust service workload setting (open critical setting): 10 units — REVIEW Owner: Identity Architect. Concerns: module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role, module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role and 7 others. Closes when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
• Translate the IAM permissions into STACKIT roles (open critical setting): 10 units — REVIEW Owner: Identity Architect. Concerns: module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role, module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role and 7 others. Closes when: A person translates each permission of the attached policies into STACKIT roles on the target resources.
• Decide who may assume each IAM role (open critical setting): 10 units — REVIEW Owner: Identity Architect. Concerns: module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role, module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role and 7 others. Closes when: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.
• Confirm the ports of the rules of the security group (open critical setting): 9 units — LEDGER, REVIEW Owner: Network Architect. Concerns: module.dependencies.module.catalog_rds.aws_security_group.this, module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, module.dependencies.module.orders_rds.aws_security_group.this and 6 others. Closes when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
• Re-state the restricted outbound rules of the security group (finding group): 8 units — warning Owner: unassigned (a finding records no owner role). Concerns: module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_opensearch.aws_security_group.this and 5 others. The source restricts egress (the AWS provider removes AWS's default allow-all egress rule; only the listed egress rules apply). Every new STACKIT security group gets two default egress rules, IPv4 and IPv6, with no ip range (any address), no protocol and no port restriction (the test of 2026-10-07, 2026-10-07: API read-back of a new group, docs concepts page), that stackit_security_group (the pinned STACKIT provider) does not manage — as generated, the draft allows all egress. After apply, delete them (stackit security-group rule list / delete --security-group-id <id>), or egress is wider than in the source.
• Sg rule not rendered (finding group): 6 units — warning Owner: unassigned (a finding records no owner role). Concerns: module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 3 others. At least one rule of this group is not in the draft as the source has it. The plan withholds it, holds it as a commented-out rule until a value or a decision is filled in, writes it with a fact that decides what it allows not carried exactly, or cannot name it at all because the source has more rules than are visible statically (a dynamic block over a collection, a count or a rule list that is not known until apply, or a list with a hidden member: the plan's INCOMPLETE action says which set and why, the draft's TODO "rules beyond the known set" names it, and only the known rules are drafted). Typical causes: a protocol, port or source whose value is known only at apply time or comes from a root variable; a source group that is a choice between groups or not a group of the draft; a protocol with no STACKIT counterpart; an ICMP type with every code; an ICMP or ICMPv6 rule whose range is of the other IP family (the API answers HTTP 400, the test of 2026-10-08); a tcp or udp rule with a negative port, a port above 65535, a reversed range, or port 0 only (STACKIT stores no port range for 0 to 0, so the rule would match every port). A tcp or udp range that starts at port 0 and ends below 65535 is written from port 1 (the STACKIT API rejects a range that starts at 0; tested on a STACKIT project on 2026-10-07): port 0 itself is not carried. A stackit_security_group_rule without protocol, port_range or source allows everything (the pinned STACKIT provider), so such a rule is never widened; re-create it with the values it needs (the plan names each one).

The full lists are on the Decisions and Architecture pages of index.html.

Source assurance warnings

These are about how well the source was read, not about what blocks the migration; they are listed apart from the blockers and dismiss nothing.

• Pin the version of the source provider (finding group): 93 units — warning No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven, so the knowledge base (checked against 5.100.0) is not taken as proof of it (stated once for the whole estate, with the units it covers and the rest of the words)

How much was understood

• Units counted in the totals: 44; decided only when OpenTofu plans: 8; switched off: 41; uncertain facets: 0.
• Entries of the unit list: 93 (44 units counted in the totals, 8 decided only when OpenTofu plans, 41 switched off).
• Evidence traces, by kind of entry: active units with a block in the draft: 36 of 36 traced (23 from the lines the draft records for them, not from a typed plan); active units with no block in the draft: 5 of 8 traced (3 with nothing to trace); units decided only when OpenTofu plans: 5 of 8 traced (2 from the lines the draft records for them, not from a typed plan); switched-off units: 11 of 41 traced. An entry without a trace is not an entry with nothing open; the unit list says for each why it has none.
• Critical settings: 36 resolved of 319; 283 open.

What people must decide

Decision register: BUILT. 16 decisions to make (9 plan decisions, 5 manual actions, 2 plan statements, 2 of them with the draft's DEFAULT to confirm or change) · 2 defaults to confirm (other records, no step waits for them) · 48 units to review (308 critical settings: 307 to decide (25 of them are conditional), 1 confirm only); rejected 0, stale 0, entries of the decisions file that match no record 0. The records are in executive/decisions.md and migration/decisions.csv.

What the target would look like

Of the 44 units counted in the totals, 44 units state a STACKIT target and 0 units state none.

• STACKIT service account for the workload: 10 units
• STACKIT security group: 7 units
• STACKIT Kubernetes Engine (SKE): 6 units
• not written by this draft (stackit_security_group, stackit_security_group_rule): 5 units
• STACKIT Secrets Manager: 4 units
• STACKIT Application Load Balancer: 1 unit
• STACKIT KMS: 1 unit
• STACKIT Key Value Store (Valkey): 1 unit
• STACKIT Logs: 1 unit
• STACKIT MariaDB: 1 unit
• STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option): 1 unit
• STACKIT OpenSearch: 1 unit
• STACKIT PostgreSQL Flex: 1 unit
• STACKIT RabbitMQ: 1 unit
• STACKIT project networking / Network Area (SNA): 1 unit
• implicit (belongs to the NAT gateway): 1 unit
• implicit outbound (STACKIT network): 1 unit

What has and has not been established

What has been established about this draft, row by row, and what has not. Nothing here approves the draft, asserts that it is equivalent to the source, or says it is safe to apply.

assurance/safety.md states the same rows with their scope and the checks behind them.

Next steps

• Review the 307 open critical settings: a person decides each (index.html, Decisions page; assurance/critical-semantics.json, critical_semantic_resolution.open). 25 of them belong to units that exist only if a plan-time input holds (critical_semantic_resolution.conditional_open). 1 more is carried by the draft already: confirm only.
• Review the 9 open plan decisions and 5 manual actions of the draft (index.html, Architecture, Deployment prerequisites). Confirm the 2 defaults the draft carries out (index.html, Decisions page): no step waits for the answer, a person confirms each or changes it.
• Review the draft in terraform/: it is a proposal, and an architect has to review it before any use.
• Open index.html in a browser for the unit-by-unit view (offline, nothing is loaded).