Migration roadmap — default
PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.
Run f6267c3f-2848-4aa5-89df-5fee8b15b3b9 · source digest sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70
Partially executable migration package · Proposal only · Not approved.
The steps of the migration in the order they can be taken: the execution plan (execution-plan.json) laid out in ten waves. A step depends on the steps in its row and on no other; a wave is a starting point for the schedule, not a schedule.
The plan holds 314 steps: 162 can start now, 5 after a manual prerequisite, 79 waiting for a decision, 65 not executable whatever is decided and 3 refused.
Steps: partially executable. Execution completeness: COMPLETE (each of the 254 manual steps states what it is, why, who carries it out and when it is done, and the input it needs where it depends on one). 48 of the 57 automated steps (OpenTofu or a script) can run now (1 waits for a manual prerequisite, 8 require a design decision) · 9 of those 48 rest on a default you have not confirmed (public endpoint, size derived from the source); a person can start 114 of the 254 manual steps now (4 wait for a manual prerequisite, 71 require a design decision, 65 are not executable as the plan stands); 3 steps are permanently unsupported (refused); 1 step has its verification incomplete: it carries critical settings of the source that no check validates, which a person confirms in the draft. Migration ready: NO — 307 critical settings of 48 source resources have manual or refused steps open (293 manual, 14 refused); 147 steps cannot be carried out now (79 wait only for a decision, 65 are not executable whatever is decided, 3 are refused).
This roadmap holds the steps of the execution plan only. A block of the Terraform draft that no plan lists is not a step here; the draft in terraform/ is the whole of what is written, and technical-sequencing.md orders every source unit by its dependencies.
Wave 0 — Decisions
Questions nobody has answered yet. A step that waits for one cannot be taken before it is answered.
9 decisions (17 questions) must be answered. A decision of several questions has a row for each question, named by the decision's id and what the question is about.
| Decision | Question | Why it matters | AWS resource | Needed | Blocks |
|---|---|---|---|---|---|
DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION | Decide which instance of stackit_network.vpc_vpc_public the networks of stackit_application_load_balancer.retail_app_ecs_alb_this means: set var.retail_app_ecs_alb_this_network_id_target to its index | the reference reaches stackit_network.vpc_vpc_public, a repeated resource (count or for_each), and nothing in the source proves which instance it means; no instance is assumed and the variable has no default | module.retail_app_ecs.module.alb.aws_lb.this | before the pilot; answer with one of its options: "Set the selector variable to the index of the instance the source means" or "Reference another resource than the candidates" | 66 steps |
DEC-GEN-CONVERT-API-OPT-IN | Allow calls of the Secrets Manager Vault-compatible API, whose maturity is not established, for this migration (the API may change or vanish)? Accept: the calls of the Secrets Manager Vault-compatible API (WriteSecret) are carried out for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db. Refuse: no call is made, a refusal selects no other path (the draft holds no other carrier of what the calls set), and what they set stays open for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db. | the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db wait for this decision; the draft's own blocks do not | — | before the pilot; answer with one of its options: "Allow the calls of the API for this migration" | 74 steps |
DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Choose how the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this moves from aws_opensearch_domain to STACKIT OpenSearch (stackit_opensearch_instance.dependencies_catalog_opensearch_this): the method, the downtime it needs and the check that the copy is complete | StackToIT moves no data and writes no runbook for aws_opensearch_domain to STACKIT OpenSearch; the data-movement register lists module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | before the pilot; answer with one of its options: "Export the data from the source and import it with the clients of the target engine" or "Replicate the data with the replication of the source engine until the cutover" or "Move the data with a migration tool or a replication of the owner's own" | 82 steps |
DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this | Choose how the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this moves from aws_rds_cluster to STACKIT MariaDB (stackit_mariadb_instance.dependencies_catalog_rds_this): a dump loaded with the mysql client inside the write freeze, or a tool of your own | the plan defines the one method the STACKIT MariaDB pages document, a dump loaded with the mysql client into the empty instance, and the customer's own tool; the replication of the binary log is refused because no STACKIT page documents it; STACKIT has no managed MySQL, so a MySQL source is an engine change whose collations, DEFINER accounts, accounts and settings the checks of the plan name, and the size of the data, the downtime the business accepts and the consistency the application needs are not in the source; the steps wait for the answer | module.dependencies.module.catalog_rds.aws_rds_cluster.this | before the pilot; answer with one of its options: "Export the data from the source and import it with the clients of the target engine" or "Replicate the data with the replication of the source engine until the cutover" or "Move the data with a migration tool or a replication of the owner's own" | 83 steps |
DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Choose how the keys of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default move from aws_elasticache_replication_group to STACKIT Key Value Store (stackit_valkey_instance.dependencies_checkout_elasticache_redis_default): the keys copied by a client inside the write freeze, or a tool of your own | the plan defines the one method the STACKIT pages and the ElastiCache pages allow together, a copy of the keys by a client (SCAN, DUMP, PTTL, RESTORE) inside the write freeze, and the customer's own tool; loading an exported snapshot is refused because no STACKIT page or API takes an RDB file, and following the source as a replica is refused because neither end offers it; the source does not say whether the cache holds only what the application rebuilds, the size of the data, the downtime the business accepts or the shards the keys are spread over, and the Key Value Store has no sharding; the steps wait for the answer | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | before the pilot; answer with one of its options: "Export the data from the source and import it with the clients of the target engine" or "Replicate the data with the replication of the source engine until the cutover" or "Move the data with a migration tool or a replication of the owner's own" | 83 steps |
DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Choose how the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this moves from aws_dynamodb_table to STACKIT MongoDB Flex (stackit_mongodbflex_instance.dynamodb_tables): the method, the downtime it needs and the check that the copy is complete | StackToIT moves no data and writes no runbook for aws_dynamodb_table to STACKIT MongoDB Flex; the data-movement register lists module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | before the pilot; answer with one of its options: "Export the data from the source and import it with the clients of the target engine" or "Replicate the data with the replication of the source engine until the cutover" or "Move the data with a migration tool or a replication of the owner's own" | 82 steps |
DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this | Choose how the data of module.dependencies.module.orders_rds.aws_rds_cluster.this moves from aws_rds_cluster to PostgreSQL Flex (stackit_postgresflex_instance.dependencies_orders_rds_this): a dump restored inside the write freeze, the engine's logical replication, or a tool of your own | the plan defines both methods of the engine (a dump restored inside the write freeze, and a logical replication that follows the changes until the freeze) and keeps them open: which one applies depends on the size of the data, the write rate and the downtime the business accepts, and the source states none of them; the steps of the methods wait for the answer | module.dependencies.module.orders_rds.aws_rds_cluster.this | before the pilot; answer with one of its options: "Export the data from the source and import it with the clients of the target engine" or "Replicate the data with the replication of the source engine until the cutover" or "Move the data with a migration tool or a replication of the owner's own" | 88 steps |
DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE | Choose how module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch 3.3) reaches STACKIT, which offers 2 in eu01: move the data into 2 by re-reading it from the source, run OpenSearch 3.3 yourself on SKE, or wait until STACKIT offers it | the source runs OpenSearch 3.3 (engine_version), newer than every version the eu01 catalogue (2026-10-18) lists for stackit_opensearch_instance (2): a snapshot of 3.3 cannot be restored into 2 (OpenSearch restores a snapshot into the same or a newer version only); reindex from the source, or write to both during the cutover (dual-write), is the path; whether the clients work against 2 is unknown | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | before the pilot; answer with one of its options: "Move the data into the version STACKIT offers, by re-reading it from the source" or "Run the source's engine version yourself on SKE (self-managed)" or "Wait until STACKIT offers the source's version" | 84 steps |
DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH | Decide how the clients of module.retail_app_ecs.module.alb.aws_lb.this reach the workloads of module.retail_app_ecs.module.ui_service.aws_ecs_service.this on SKE (aws.ingress.exposure-path): option nodeport-alb-target-pool (the drafted path: a NodePort Service of each workload and the target pool on its node port at the private IPs of the cluster's nodes, an input), ingress-controller-behind-alb (an Ingress controller on the cluster, reached by the load balancer on the controller's node port, routes to the ClusterIP Services), or stackit-alb-ingress-controller (the SKE Application Load Balancer extension provisions the load balancer from an Ingress of the IngressClass stackit-alb over NodePort Services; the drafted stackit_application_load_balancer.retail_app_ecs_alb_this is not applied) | a STACKIT target pool reaches its targets by private IP and the SKE cluster exports no node address to Terraform, so a Kubernetes workload is reachable from the load balancer only through a node port at the IPs of the nodes, which change as the node pool scales and is updated, or through an Ingress controller; the source registered the tasks of the service by their own IPs (awsvpc) | module.retail_app_ecs.module.alb.aws_lb.this | before the pilot; answer with one of its options: "Keep the draft: a NodePort Service of each workload and the target pool on its node port at the private IPs of the cluster's nodes" or "Run an Ingress controller on the cluster and put the load balancer in front of it" or "Use the STACKIT ALB as the Ingress: the SKE Application Load Balancer extension" | 66 steps |
DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this | Decide how the segmentation that the security group module.retail_app_ecs.module.carts_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.carts_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_carts_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it) | the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision) | module.retail_app_ecs.module.carts_service.aws_security_group.this | before the pilot; answer with one of its options: "Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group" or "Carry the segmentation as a STACKIT security group on the nodes (coarser than the source)" or "Accept that the pods run without the segmentation the source group gave the tasks" | 80 steps |
DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this | Decide how the segmentation that the security group module.retail_app_ecs.module.catalog_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_catalog_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it) | the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision) | module.retail_app_ecs.module.catalog_service.aws_security_group.this | before the pilot; answer with one of its options: "Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group" or "Carry the segmentation as a STACKIT security group on the nodes (coarser than the source)" or "Accept that the pods run without the segmentation the source group gave the tasks" | 80 steps |
DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this | Decide how the segmentation that the security group module.retail_app_ecs.module.checkout_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_checkout_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it) | the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision) | module.retail_app_ecs.module.checkout_service.aws_security_group.this | before the pilot; answer with one of its options: "Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group" or "Carry the segmentation as a STACKIT security group on the nodes (coarser than the source)" or "Accept that the pods run without the segmentation the source group gave the tasks" | 80 steps |
DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this | Decide how the segmentation that the security group module.retail_app_ecs.module.orders_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.orders_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_orders_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it) | the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision) | module.retail_app_ecs.module.orders_service.aws_security_group.this | before the pilot; answer with one of its options: "Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group" or "Carry the segmentation as a STACKIT security group on the nodes (coarser than the source)" or "Accept that the pods run without the segmentation the source group gave the tasks" | 80 steps |
DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this | Decide how the segmentation that the security group module.retail_app_ecs.module.ui_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.ui_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_ui_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it) | the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision) | module.retail_app_ecs.module.ui_service.aws_security_group.this | before the pilot; answer with one of its options: "Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group" or "Carry the segmentation as a STACKIT security group on the nodes (coarser than the source)" or "Accept that the pods run without the segmentation the source group gave the tasks" | 80 steps |
DEC-GEN-CONVERT-WORKLOAD-PLACEMENT | Decide where the source consumers of module.vpc.module.vpc.aws_subnet.private are placed on STACKIT: the source places module.dependencies.aws_mq_broker.mq, module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, module.dependencies.module.orders_rds.aws_rds_cluster.this, module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this and module.retail_app_ecs.module.ui_service.aws_ecs_service.this in it, and the draft places none of them in stackit_network.vpc_vpc_private (the target networks the draft generates for the subnets of the same VPC: stackit_network.vpc_vpc_private and stackit_network.vpc_vpc_public); the drafted Kubernetes cluster stackit_ske_cluster.retail_app_ecs_cluster of these consumers sets no network.id — option one-network-for-the-cluster-and-services (the cluster and the servers in one network, the managed services reached by access lists naming its range), keep-the-networks-and-place-by-tier, redesign-the-network-placement, or accept-the-consumers-outside-the-network (the network as drafted, holding none of them) | the source splits these workloads over subnets, and STACKIT places them differently: an SKE cluster is deployed into one network (network.id) and its node pools state no network, a managed database, cache or broker takes an access list and no network id; no one-to-one placement of the consumers in stackit_network.vpc_vpc_private follows from the source, so the network's step waits for the decision | module.vpc.module.vpc.aws_subnet.private | before the pilot; answer with one of its options: "Place the cluster and the servers in one STACKIT network, and admit the clients of the managed services by access lists naming its range" or "Keep the drafted networks and place each consumer in the network of its tier" or "Redesign the network placement of the workloads" or "Accept that the drafted network holds none of the source's consumers of its subnet" | 3 steps |
DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST | Decide the egress address of module.vpc.module.vpc.aws_route_table.private: keep the changing address of the STACKIT network, or give each server that an allow-list names a STACKIT public IP | a NAT gateway's fixed egress address is lost on STACKIT: the address a routed network leaves by is the network's own, shared by every routed network of the project, not fixed and not settable | module.vpc.module.vpc.aws_route_table.private | before the pilot; answer with one of its options: "Accept the address STACKIT assigns to the network for outbound traffic" or "Give each server that an allow-list names a STACKIT public IP" | 8 steps |
DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS | Decide whether the logs of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks older than 180 days are kept in an archive outside the Logs instance | the source keeps its logs for ever and a STACKIT Logs instance keeps at most 180 days, so the instance drafted for it (stackit_logs_instance.logs_retention_180d) holds only the last 180 days; logs older than that exist only if a person configures an archive beside it. Choose the archive if the workload needs them; reject it if the requirement is that more than 180 days stay inside STACKIT Logs with no external archive, which STACKIT Logs alone cannot meet | module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | before the cutover; answer with one of its options: "Keep the logs for the 180 days of the Logs instance only" or "For the period beyond 180 days, also stream the logs to long-term storage" | 2 steps |
Texts the steps share
A text that many steps share word for word is written once here, with what is the step's own in braces ({name} for the name of a resource, {address} for an IP address or network). The What and Can start cells of a step name the wording of what it does (W) and the state it is in (S), and the first of them gives, after the number, what stands for the braces.
- S1 (39 steps): Not ready: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for
DEC-GEN-CONVERT-API-OPT-IN,DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this,DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE,DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this,DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default,DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this,DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this,DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION,DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH,DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this,DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this,DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this,DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this,DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this
Wave 1 — Landing zone
The project and the preconditions a person provides before the first apply.
The manual steps of this wave in 4 work packages (execution/manual/actions.md lists every package with its steps):
| Package | What | Owner | Steps | Affected resources | State |
|---|---|---|---|---|---|
WP-01 | Answer the decisions the plan asks as steps (prepare) | Network Architect | 1 | 1 | waits for decisions |
WP-02 | Set up the identities and access (prepare) | Identity Architect | 10 | 5 | a person can start it now |
WP-03 | Carry the routing the draft does not write (prepare) | Network Architect | 2 | 2 | a person can start it now |
WP-04 | Write the security group rules the draft does not write (prepare) | Security Architect | 2 | 1 | a person can start it now |
The steps of the wave, the manual ones among them:
| Step | What | AWS resource | Mode | Depends on | Can start |
|---|---|---|---|---|---|
DEC/routing/DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST | Answer decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST: Decide the egress address of module.vpc.module.vpc.aws_route_table.private: keep the changing address of the STACKIT network, or give each server that an allow-list names a STACKIT public IP | module.vpc.module.vpc.aws_route_table.private | Manual | — | Blocked by DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST |
MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.execution_role_arn-586451 | Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach | module.retail_app_ecs.module.carts_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.task_role_arn-686488 | Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it | module.retail_app_ecs.module.carts_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.execution_role_arn-dedc98 | Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach | module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.task_role_arn-15a967 | Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it | module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.execution_role_arn-b70bc2 | Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach | module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.task_role_arn-9651e2 | Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it | module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.execution_role_arn-eacc48 | Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach | module.retail_app_ecs.module.orders_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.task_role_arn-d0b927 | Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it | module.retail_app_ecs.module.orders_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.execution_role_arn-2d22d2 | Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach | module.retail_app_ecs.module.ui_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.task_role_arn-0c66b7 | Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it | module.retail_app_ecs.module.ui_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.private | Create the target project outside a Network Area: module.vpc.module.vpc.aws_route_table.private is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area | module.vpc.module.vpc.aws_route_table.private | Manual | — | Can start now |
MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.public | Create the target project outside a Network Area: module.vpc.module.vpc.aws_route_table.public is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area | module.vpc.module.vpc.aws_route_table.public | Manual | — | Can start now |
MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules.0-217968 | Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] on the security group it belongs to and write it | module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | Manual | — | Can start now |
MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules.0-f26028 | Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] on the security group it belongs to and write it | module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | Manual | — | Can start now |
Wave 2 — Network and security
Networks, routing and security groups.
The manual steps of this wave in 8 work packages (execution/manual/actions.md lists every package with its steps):
| Package | What | Owner | Steps | Affected resources | State |
|---|---|---|---|---|---|
WP-05 | Routing architecture review (foundation) | Network Architect | 2 | 2 | a person can start it now |
WP-06 | Decide and set the critical settings (foundation) | Network Architect | 6 | 6 | a person can start it now |
WP-07 | Decide and set the critical settings (foundation) | Platform Architect | 3 | 3 | a person can start it now |
WP-08 | Write the security group rules the draft does not write (security) | Security Architect | 13 | 12 | waits for decisions (10 of 13 steps) |
WP-09 | Decide and set the critical settings (security) | Identity Architect | 11 | 11 | a person can start it now |
WP-10 | Decide and set the critical settings (security) | Network Architect | 12 | 12 | a person can start it now |
WP-11 | Decide and set the critical settings (security) | Platform Architect | 4 | 4 | a person can start it now |
WP-12 | Decide and set the critical settings (security) | Security Architect | 4 | 4 | a person can start it now |
The steps of the wave, the manual ones among them:
| Step | What | AWS resource | Mode | Depends on | Can start |
|---|---|---|---|---|---|
MAN/semantic/module.vpc.module.vpc.aws_eip.nat/public-address | Decide what the STACKIT target of module.vpc.module.vpc.aws_eip.nat (aws_eip) does for its critical setting public-address, which the draft does not carry, and set it up by hand, or record that production does not need it | module.vpc.module.vpc.aws_eip.nat | Manual | — | Can start now |
MAN/semantic/module.vpc.module.vpc.aws_internet_gateway.this/network-topology-boundary | Decide what the STACKIT target of module.vpc.module.vpc.aws_internet_gateway.this (aws_internet_gateway) does for its critical setting network-topology-boundary, which the draft does not carry, and set it up by hand, or record that production does not need it | module.vpc.module.vpc.aws_internet_gateway.this | Manual | — | Can start now |
MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings | Review the 3 open critical settings of module.vpc.module.vpc.aws_nat_gateway.this (aws_nat_gateway) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, fixed-egress-ip, nat-placement) | module.vpc.module.vpc.aws_nat_gateway.this | Manual | — | Can start now |
MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings | Review the 8 open critical settings of module.vpc.module.vpc.aws_route_table.private (aws_route_table) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (routes, route-destinations, route-targets, nat-fixed-egress-address, egress-restriction, subnet-association-target, tcr-route-table-vpc-id, network-topology-boundary) | module.vpc.module.vpc.aws_route_table.private | Manual | — | Can start now |
MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings | Review the 5 open critical settings of module.vpc.module.vpc.aws_route_table.public (aws_route_table) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (routes, route-destinations, route-targets, tcr-route-table-vpc-id, network-topology-boundary) | module.vpc.module.vpc.aws_route_table.public | Manual | — | Can start now |
MAN/semantic/module.vpc.module.vpc.aws_subnet.private/availability-zone | Decide what the STACKIT target of module.vpc.module.vpc.aws_subnet.private (aws_subnet) does for its critical setting availability-zone, which the draft does not carry, and set it up by hand, or record that production does not need it | module.vpc.module.vpc.aws_subnet.private | Manual | — | Can start now |
MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect | Review the 4 open critical settings of module.vpc.module.vpc.aws_subnet.private (aws_subnet) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (subnet-vpc-membership, network-topology-boundary, private-egress-ipv4, prefix) | module.vpc.module.vpc.aws_subnet.private | Manual | — | Can start now |
MAN/semantic/module.vpc.module.vpc.aws_subnet.public/availability-zone | Decide what the STACKIT target of module.vpc.module.vpc.aws_subnet.public (aws_subnet) does for its critical setting availability-zone, which the draft does not carry, and set it up by hand, or record that production does not need it | module.vpc.module.vpc.aws_subnet.public | Manual | — | Can start now |
MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect | Review the 5 open critical settings of module.vpc.module.vpc.aws_subnet.public (aws_subnet) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (subnet-vpc-membership, network-topology-boundary, effective-route-table, private-egress-ipv4, prefix) | module.vpc.module.vpc.aws_subnet.public | Manual | — | Can start now |
MAN/semantic/module.vpc.module.vpc.aws_vpc.this/dns-settings | Decide what the STACKIT target of module.vpc.module.vpc.aws_vpc.this (aws_vpc) does for its critical setting dns-settings, which the draft does not carry, and set it up by hand, or record that production does not need it | module.vpc.module.vpc.aws_vpc.this | Manual | — | Can start now |
MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect | Review the 5 open critical settings of module.vpc.module.vpc.aws_vpc.this (aws_vpc) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, default-nacl-rules, default-route-table, default-security-group-omitted-direction, main-table-set) | module.vpc.module.vpc.aws_vpc.this | Manual | — | Can start now |
TF/stackit_network.vpc_vpc_private | Apply stackit_network.vpc_vpc_private (terraform/network.tf) | module.vpc.module.vpc.aws_subnet.private | Terraform | MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.private | Blocked by DEC-GEN-CONVERT-WORKLOAD-PLACEMENT |
TF/stackit_network.vpc_vpc_public | Apply stackit_network.vpc_vpc_public (terraform/network.tf) | module.vpc.module.vpc.aws_subnet.public | Terraform | MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.public | Can start after the routing precondition of module.vpc.module.vpc.aws_route_table.public is done |
MAN/security/accept/module.retail_app_ecs.module.alb.aws_lb.this:plaintext-public-listener | Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.alb.aws_lb.this (PLAINTEXT_PUBLIC_LISTENER): The source load balancer module.retail_app_ecs.module.alb.aws_lb.this is internet-facing and every listener it states is HTTP (port 80 forwards to its targets, no listener is HTTPS or TLS): clients reach the application without transport encryption. | module.retail_app_ecs.module.alb.aws_lb.this | Manual | — | Can start now |
MAN/security/attachment-design:module.retail_app_ecs.module.carts_service.aws_security_group.this | Design the security attachment of module.retail_app_ecs.module.carts_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.carts_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started | module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.carts_service.aws_security_group.this | Manual | — | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this |
MAN/security/accept/module.retail_app_ecs.module.carts_service.aws_security_group.this:open-ingress-application-port | Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.carts_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.carts_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. | module.retail_app_ecs.module.carts_service.aws_security_group.this | Manual | MAN/security/attachment-design:module.retail_app_ecs.module.carts_service.aws_security_group.this | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this |
MAN/security/attachment-design:module.retail_app_ecs.module.catalog_service.aws_security_group.this | Design the security attachment of module.retail_app_ecs.module.catalog_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started | module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_security_group.this | Manual | — | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this |
MAN/security/accept/module.retail_app_ecs.module.catalog_service.aws_security_group.this:open-ingress-application-port | Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.catalog_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.catalog_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. | module.retail_app_ecs.module.catalog_service.aws_security_group.this | Manual | MAN/security/attachment-design:module.retail_app_ecs.module.catalog_service.aws_security_group.this | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this |
MAN/security/attachment-design:module.retail_app_ecs.module.checkout_service.aws_security_group.this | Design the security attachment of module.retail_app_ecs.module.checkout_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started | module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_security_group.this | Manual | — | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this |
MAN/security/accept/module.retail_app_ecs.module.checkout_service.aws_security_group.this:open-ingress-application-port | Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.checkout_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.checkout_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. | module.retail_app_ecs.module.checkout_service.aws_security_group.this | Manual | MAN/security/attachment-design:module.retail_app_ecs.module.checkout_service.aws_security_group.this | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this |
MAN/security/attachment-design:module.retail_app_ecs.module.orders_service.aws_security_group.this | Design the security attachment of module.retail_app_ecs.module.orders_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.orders_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started | module.retail_app_ecs.module.orders_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_security_group.this | Manual | — | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this |
MAN/security/accept/module.retail_app_ecs.module.orders_service.aws_security_group.this:open-ingress-application-port | Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.orders_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.orders_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. | module.retail_app_ecs.module.orders_service.aws_security_group.this | Manual | MAN/security/attachment-design:module.retail_app_ecs.module.orders_service.aws_security_group.this | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this |
MAN/security/attachment-design:module.retail_app_ecs.module.ui_service.aws_security_group.this | Design the security attachment of module.retail_app_ecs.module.ui_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.ui_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started | module.retail_app_ecs.module.ui_service.aws_ecs_service.this, module.retail_app_ecs.module.ui_service.aws_security_group.this | Manual | — | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/security/accept/module.retail_app_ecs.module.ui_service.aws_security_group.this:open-ingress-application-port | Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.ui_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.ui_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. | module.retail_app_ecs.module.ui_service.aws_security_group.this | Manual | MAN/security/attachment-design:module.retail_app_ecs.module.ui_service.aws_security_group.this | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings | Review the 5 open critical settings of module.dependencies.aws_security_group.catalog_opensearch_sg (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, egress-restriction, standalone-rule-not-generated, standalone-rule-remote-not-resolved) | module.dependencies.aws_security_group.catalog_opensearch_sg | Manual | — | Can start now |
MAN/semantic/module.dependencies.aws_security_group.mq/open-settings | Review the 4 open critical settings of module.dependencies.aws_security_group.mq (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, egress-restriction, standalone-rule-not-generated) | module.dependencies.aws_security_group.mq | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.catalog_rds.aws_security_group.this/open-settings | Review the 5 open critical settings of module.dependencies.module.catalog_rds.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, egress-restriction, rule-ports, standalone-rule-values) | module.dependencies.module.catalog_rds.aws_security_group.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings | Review the 6 open critical settings of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, rule-ports, standalone-rule-values, standalone-rule-other-sources, standalone-rule-empty-sources) | module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.orders_rds.aws_security_group.this/open-settings | Review the 5 open critical settings of module.dependencies.module.orders_rds.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, egress-restriction, rule-ports, standalone-rule-values) | module.dependencies.module.orders_rds.aws_security_group.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.aws_kms_key.cmk/deletion-window | Decide what the STACKIT target of module.retail_app_ecs.aws_kms_key.cmk (aws_kms_key) does for its critical setting deletion-window, which the draft does not carry, and set it up by hand, or record that production does not need it | module.retail_app_ecs.aws_kms_key.cmk | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/open-settings-security-architect | Review the 2 open critical settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (secret-value, customer-managed-key) | module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/tc-secretsmanager-secret-name | Choose the Vault path the secret module.retail_app_ecs.aws_secretsmanager_secret.catalog_db is written under in the Secrets Manager instance of the draft, set it in STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB (the input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db), and point the applications that look the secret up by name at that path | module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/open-settings-security-architect | Review the 2 open critical settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (secret-value, customer-managed-key) | module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/tc-secretsmanager-secret-name | Choose the Vault path the secret module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch is written under in the Secrets Manager instance of the draft, set it in STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH (the input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch), and point the applications that look the secret up by name at that path | module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.mq/secret-value | Supply the value of the secret module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret) through the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq: put the JSON object of its key/value pairs in a file outside the package and keep it out of version control, name the file in STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_MQ, the sensitive input of that step, and run the step; the value is not set up by hand and the script of the step is what sends it | module.retail_app_ecs.aws_secretsmanager_secret.mq | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.mq/tc-secretsmanager-secret-name | Choose the Vault path the secret module.retail_app_ecs.aws_secretsmanager_secret.mq is written under in the Secrets Manager instance of the draft, set it in STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ (the input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq), and point the applications that look the secret up by name at that path | module.retail_app_ecs.aws_secretsmanager_secret.mq | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.orders_db/secret-value | Supply the value of the secret module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret) through the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db: put the JSON object of its key/value pairs in a file outside the package and keep it out of version control, name the file in STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_ORDERS_DB, the sensitive input of that step, and run the step; the value is not set up by hand and the script of the step is what sends it | module.retail_app_ecs.aws_secretsmanager_secret.orders_db | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.orders_db/tc-secretsmanager-secret-name | Choose the Vault path the secret module.retail_app_ecs.aws_secretsmanager_secret.orders_db is written under in the Secrets Manager instance of the draft, set it in STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB (the input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db), and point the applications that look the secret up by name at that path | module.retail_app_ecs.aws_secretsmanager_secret.orders_db | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings | Review the 3 open critical settings of module.retail_app_ecs.module.alb.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, egress-restriction) | module.retail_app_ecs.module.alb.aws_security_group.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings | Review the 6 open critical settings of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, rule-ports, standalone-rule-values, standalone-rule-other-sources, standalone-rule-empty-sources) | module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings | Review the 4 open critical settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-ecs) | module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings | Review the 4 open critical settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-customer-policy) | module.retail_app_ecs.module.carts_service.aws_iam_role.task_role | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.carts_service.aws_security_group.this/open-settings | Review the 6 open critical settings of module.retail_app_ecs.module.carts_service.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, rule-ports, egress-rule-protocol, ingress-sources, egress-sources) | module.retail_app_ecs.module.carts_service.aws_security_group.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings | Review the 4 open critical settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-ecs) | module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings | Review the 4 open critical settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-customer-policy) | module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_security_group.this/open-settings | Review the 6 open critical settings of module.retail_app_ecs.module.catalog_service.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, rule-ports, egress-rule-protocol, ingress-sources, egress-sources) | module.retail_app_ecs.module.catalog_service.aws_security_group.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings | Review the 4 open critical settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-ecs) | module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings | Review the 4 open critical settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-customer-policy) | module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_security_group.this/open-settings | Review the 6 open critical settings of module.retail_app_ecs.module.checkout_service.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, rule-ports, egress-rule-protocol, ingress-sources, egress-sources) | module.retail_app_ecs.module.checkout_service.aws_security_group.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings | Review the 4 open critical settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-ecs) | module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings | Review the 4 open critical settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-customer-policy) | module.retail_app_ecs.module.orders_service.aws_iam_role.task_role | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.orders_service.aws_security_group.this/open-settings | Review the 6 open critical settings of module.retail_app_ecs.module.orders_service.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, rule-ports, egress-rule-protocol, ingress-sources, egress-sources) | module.retail_app_ecs.module.orders_service.aws_security_group.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings | Review the 4 open critical settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-ecs) | module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings | Review the 4 open critical settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (trust, permissions, iam-trust-service-workload, iam-managed-customer-policy) | module.retail_app_ecs.module.ui_service.aws_iam_role.task_role | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.ui_service.aws_security_group.this/open-settings | Review the 6 open critical settings of module.retail_app_ecs.module.ui_service.aws_security_group.this (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-topology-boundary, stateful, rule-ports, egress-rule-protocol, ingress-sources, egress-sources) | module.retail_app_ecs.module.ui_service.aws_security_group.this | Manual | — | Can start now |
REF/root/security-group-membership-parity | Not migrated: the VPC membership (the critical setting security-group-vpc-membership) of 12 AWS security groups: module.retail_app_ecs.module.alb.aws_security_group.this, module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, module.retail_app_ecs.module.carts_service.aws_security_group.this, module.retail_app_ecs.module.catalog_service.aws_security_group.this, module.retail_app_ecs.module.checkout_service.aws_security_group.this, module.retail_app_ecs.module.orders_service.aws_security_group.this, module.retail_app_ecs.module.ui_service.aws_security_group.this, module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this, module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, module.dependencies.module.orders_rds.aws_security_group.this; 7 of the drafted STACKIT security groups are orphaned (no block of the draft attaches the group, so its rules restrict nothing on STACKIT as drafted): stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix, stackit_security_group.retail_app_ecs_alb_this, stackit_security_group.retail_app_ecs_carts_service_this, stackit_security_group.retail_app_ecs_catalog_service_this, stackit_security_group.retail_app_ecs_checkout_service_this, stackit_security_group.retail_app_ecs_orders_service_this, stackit_security_group.retail_app_ecs_ui_service_this | module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this, module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, module.dependencies.module.orders_rds.aws_security_group.this, module.retail_app_ecs.module.alb.aws_security_group.this, module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, module.retail_app_ecs.module.carts_service.aws_security_group.this, module.retail_app_ecs.module.catalog_service.aws_security_group.this, module.retail_app_ecs.module.checkout_service.aws_security_group.this, module.retail_app_ecs.module.orders_service.aws_security_group.this, module.retail_app_ecs.module.ui_service.aws_security_group.this | Refused | — | Refused: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.; This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. (the target's scope model differs from the source's, so the source's boundary has no one-to-one counterpart) |
TF/stackit_kms_keyring.migrated | Apply stackit_kms_keyring.migrated (terraform/security.tf) | module.retail_app_ecs.aws_kms_key.cmk | Terraform | — | Can start now |
TF/stackit_kms_key.retail_app_ecs_cmk | Apply stackit_kms_key.retail_app_ecs_cmk (terraform/security.tf) | module.retail_app_ecs.aws_kms_key.cmk | Terraform | TF/stackit_kms_keyring.migrated | Can start now |
TF/stackit_secretsmanager_instance.migrated_secrets | Apply stackit_secretsmanager_instance.migrated_secrets (terraform/security.tf) | module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db | Terraform | — | Can start now |
TF/stackit_secretsmanager_user.migration | Apply stackit_secretsmanager_user.migration (terraform/security.tf) | module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db | Terraform | TF/stackit_secretsmanager_instance.migrated_secrets | Can start now |
API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | Call the secrets-manager-vault API: WriteSecret | module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | STACKIT API | TF/stackit_secretsmanager_instance.migrated_secrets, TF/stackit_secretsmanager_user.migration | Blocked by DEC-GEN-CONVERT-API-OPT-IN |
API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | Call the secrets-manager-vault API: WriteSecret | module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | STACKIT API | TF/stackit_secretsmanager_instance.migrated_secrets, TF/stackit_secretsmanager_user.migration | Blocked by DEC-GEN-CONVERT-API-OPT-IN |
API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq | Call the secrets-manager-vault API: WriteSecret | module.retail_app_ecs.aws_secretsmanager_secret.mq | STACKIT API | TF/stackit_secretsmanager_instance.migrated_secrets, TF/stackit_secretsmanager_user.migration | Blocked by DEC-GEN-CONVERT-API-OPT-IN |
API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db | Call the secrets-manager-vault API: WriteSecret | module.retail_app_ecs.aws_secretsmanager_secret.orders_db | STACKIT API | TF/stackit_secretsmanager_instance.migrated_secrets, TF/stackit_secretsmanager_user.migration | Blocked by DEC-GEN-CONVERT-API-OPT-IN |
TF/stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix | Apply stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix (terraform/security.tf) | module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | Terraform | — | Can start now |
MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules-b506f3 | Re-create the rules beyond the known set of group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules) | module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | Manual | TF/stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix | Can start now |
MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules-a538f6 | Re-create the rules beyond the known set of group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules) | module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | Manual | TF/stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix | Can start now |
TF/stackit_security_group.retail_app_ecs_alb_this | Apply stackit_security_group.retail_app_ecs_alb_this (terraform/security.tf) | module.retail_app_ecs.module.alb.aws_security_group.this | Terraform | — | Can start now |
TF/stackit_security_group.retail_app_ecs_carts_service_this | Apply stackit_security_group.retail_app_ecs_carts_service_this (terraform/security.tf) | module.retail_app_ecs.module.carts_service.aws_security_group.this | Terraform | — | Can start now |
TF/stackit_security_group.retail_app_ecs_catalog_service_this | Apply stackit_security_group.retail_app_ecs_catalog_service_this (terraform/security.tf) | module.retail_app_ecs.module.catalog_service.aws_security_group.this | Terraform | — | Can start now |
TF/stackit_security_group.retail_app_ecs_checkout_service_this | Apply stackit_security_group.retail_app_ecs_checkout_service_this (terraform/security.tf) | module.retail_app_ecs.module.checkout_service.aws_security_group.this | Terraform | — | Can start now |
TF/stackit_security_group.retail_app_ecs_orders_service_this | Apply stackit_security_group.retail_app_ecs_orders_service_this (terraform/security.tf) | module.retail_app_ecs.module.orders_service.aws_security_group.this | Terraform | — | Can start now |
TF/stackit_security_group.retail_app_ecs_ui_service_this | Apply stackit_security_group.retail_app_ecs_ui_service_this (terraform/security.tf) | module.retail_app_ecs.module.ui_service.aws_security_group.this | Terraform | — | Can start now |
TF/stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1 | Apply stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1 (terraform/security.tf) | module.retail_app_ecs.module.carts_service.aws_security_group.this | Terraform | TF/stackit_security_group.retail_app_ecs_carts_service_this | Can start now |
TF/stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1 | Apply stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1 (terraform/security.tf) | module.retail_app_ecs.module.catalog_service.aws_security_group.this | Terraform | TF/stackit_security_group.retail_app_ecs_catalog_service_this | Can start now |
TF/stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1 | Apply stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1 (terraform/security.tf) | module.retail_app_ecs.module.checkout_service.aws_security_group.this | Terraform | TF/stackit_security_group.retail_app_ecs_checkout_service_this | Can start now |
TF/stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1 | Apply stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1 (terraform/security.tf) | module.retail_app_ecs.module.orders_service.aws_security_group.this | Terraform | TF/stackit_security_group.retail_app_ecs_orders_service_this | Can start now |
TF/stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1 | Apply stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1 (terraform/security.tf) | module.retail_app_ecs.module.ui_service.aws_security_group.this | Terraform | TF/stackit_security_group.retail_app_ecs_ui_service_this | Can start now |
TF/stackit_service_account.retail_app_ecs_carts_service_task_execution_role | Apply stackit_service_account.retail_app_ecs_carts_service_task_execution_role (terraform/identity.tf) | module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role | Terraform | — | Can start now |
TF/stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role | Apply stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role (terraform/identity.tf) | module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role | Terraform | TF/stackit_service_account.retail_app_ecs_carts_service_task_execution_role | Can start now |
TF/stackit_service_account.retail_app_ecs_carts_service_task_role | Apply stackit_service_account.retail_app_ecs_carts_service_task_role (terraform/identity.tf) | module.retail_app_ecs.module.carts_service.aws_iam_role.task_role | Terraform | — | Can start now |
TF/stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role | Apply stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role (terraform/identity.tf) | module.retail_app_ecs.module.carts_service.aws_iam_role.task_role | Terraform | TF/stackit_service_account.retail_app_ecs_carts_service_task_role | Can start now |
TF/stackit_service_account.retail_app_ecs_catalog_service_task_execution_role | Apply stackit_service_account.retail_app_ecs_catalog_service_task_execution_role (terraform/identity.tf) | module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role | Terraform | — | Can start now |
TF/stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role | Apply stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role (terraform/identity.tf) | module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role | Terraform | TF/stackit_service_account.retail_app_ecs_catalog_service_task_execution_role | Can start now |
TF/stackit_service_account.retail_app_ecs_catalog_service_task_role | Apply stackit_service_account.retail_app_ecs_catalog_service_task_role (terraform/identity.tf) | module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role | Terraform | — | Can start now |
TF/stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role | Apply stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role (terraform/identity.tf) | module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role | Terraform | TF/stackit_service_account.retail_app_ecs_catalog_service_task_role | Can start now |
TF/stackit_service_account.retail_app_ecs_checkout_service_task_execution_role | Apply stackit_service_account.retail_app_ecs_checkout_service_task_execution_role (terraform/identity.tf) | module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role | Terraform | — | Can start now |
TF/stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role | Apply stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role (terraform/identity.tf) | module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role | Terraform | TF/stackit_service_account.retail_app_ecs_checkout_service_task_execution_role | Can start now |
TF/stackit_service_account.retail_app_ecs_checkout_service_task_role | Apply stackit_service_account.retail_app_ecs_checkout_service_task_role (terraform/identity.tf) | module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role | Terraform | — | Can start now |
TF/stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role | Apply stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role (terraform/identity.tf) | module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role | Terraform | TF/stackit_service_account.retail_app_ecs_checkout_service_task_role | Can start now |
TF/stackit_service_account.retail_app_ecs_orders_service_task_execution_role | Apply stackit_service_account.retail_app_ecs_orders_service_task_execution_role (terraform/identity.tf) | module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role | Terraform | — | Can start now |
TF/stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role | Apply stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role (terraform/identity.tf) | module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role | Terraform | TF/stackit_service_account.retail_app_ecs_orders_service_task_execution_role | Can start now |
TF/stackit_service_account.retail_app_ecs_orders_service_task_role | Apply stackit_service_account.retail_app_ecs_orders_service_task_role (terraform/identity.tf) | module.retail_app_ecs.module.orders_service.aws_iam_role.task_role | Terraform | — | Can start now |
TF/stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role | Apply stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role (terraform/identity.tf) | module.retail_app_ecs.module.orders_service.aws_iam_role.task_role | Terraform | TF/stackit_service_account.retail_app_ecs_orders_service_task_role | Can start now |
TF/stackit_service_account.retail_app_ecs_ui_service_task_execution_role | Apply stackit_service_account.retail_app_ecs_ui_service_task_execution_role (terraform/identity.tf) | module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role | Terraform | — | Can start now |
TF/stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role | Apply stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role (terraform/identity.tf) | module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role | Terraform | TF/stackit_service_account.retail_app_ecs_ui_service_task_execution_role | Can start now |
TF/stackit_service_account.retail_app_ecs_ui_service_task_role | Apply stackit_service_account.retail_app_ecs_ui_service_task_role (terraform/identity.tf) | module.retail_app_ecs.module.ui_service.aws_iam_role.task_role | Terraform | — | Can start now |
TF/stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role | Apply stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role (terraform/identity.tf) | module.retail_app_ecs.module.ui_service.aws_iam_role.task_role | Terraform | TF/stackit_service_account.retail_app_ecs_ui_service_task_role | Can start now |
Wave 3 — Data services
Databases, object storage and volumes.
The manual steps of this wave in 5 work packages (execution/manual/actions.md lists every package with its steps):
| Package | What | Owner | Steps | Affected resources | State |
|---|---|---|---|---|---|
WP-13 | Decide and set the critical settings (data services) | Data Architect | 4 | 4 | a person can start it now |
WP-14 | Decide and set the critical settings (data services) | Identity Architect | 3 | 3 | a person can start it now |
WP-15 | Decide and set the critical settings (data services) | Network Architect | 4 | 4 | a person can start it now |
WP-16 | Decide and set the critical settings (data services) | Platform Architect | 5 | 5 | a person can start it now |
WP-17 | Decide and set the critical settings (data services) | Security Architect | 5 | 5 | a person can start it now |
The steps of the wave, the manual ones among them:
| Step | What | AWS resource | Mode | Depends on | Can start |
|---|---|---|---|---|---|
MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/encryption-at-rest | Decide what the STACKIT target of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) does for its critical setting encryption-at-rest, which the draft does not carry, and set it up by hand, or record that production does not need it | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect | Review the 5 open critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (fine-grained-access, domain-settings, access-and-encryption-settings, nbr-aws-opensearch-domain-policy, opensearch-domain-policy-resource) | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect | Review the 2 open critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (private-endpoint, network-settings) | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect | Review the 4 open critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (engine-version, cluster-layout-settings, storage-settings, tc-opensearch-domain-domain-name) | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/admin-username-not-carried | Decide what the STACKIT target of module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) does for its critical setting admin-username-not-carried, which the draft does not carry, and set it up by hand, or record that production does not need it | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect | Review the 2 open critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (backup-retention, final-snapshot) | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-network-architect | Review the 3 open critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (db-network-placement, security-groups, member-settings) | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect | Review the 5 open critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (engine, engine-version, member-engine, tc-database-name, tcf-rds-cluster-instance--identifier) | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect | Review the 3 open critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (storage-encryption, admin-password, parameter-and-option-groups) | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/network-placement | Decide what the STACKIT target of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) does for its critical setting network-placement, which the draft does not carry, and set it up by hand, or record that production does not need it | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect | Review the 2 open critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (snapshots-off, seed-snapshot) | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect | Review the 4 open critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (parameter-group, parameter-group-default, failover-off, tc-elasticache-replication-group-replication-group-id) | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect | Review the 2 open critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (at-rest-encryption-off, tcp-elasticache-replication-group-transit-encryption-enabled) | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/encryption-at-rest | Decide what the STACKIT target of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) does for its critical setting encryption-at-rest, which the draft does not carry, and set it up by hand, or record that production does not need it | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect | Review the 3 open critical settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (key-schema, point-in-time-recovery, ttl) | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect | Review the 2 open critical settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (index-projection-and-name, tc-dynamodb-table-name) | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/admin-username-not-carried | Decide what the STACKIT target of module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) does for its critical setting admin-username-not-carried, which the draft does not carry, and set it up by hand, or record that production does not need it | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-snapshot | Decide what the STACKIT target of module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) does for its critical setting final-snapshot, which the draft does not carry, and set it up by hand, or record that production does not need it | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-network-architect | Review the 3 open critical settings of module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (db-network-placement, security-groups, member-settings) | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect | Review the 3 open critical settings of module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (storage-encryption, admin-password, parameter-and-option-groups) | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | — | Can start now |
MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/tcf-rds-cluster-instance--identifier | Decide what the STACKIT target of module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) does for its critical setting tcf-rds-cluster-instance--identifier, which the draft does not carry, and set it up by hand, or record that production does not need it | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | — | Can start now |
REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/credentials-and-keys-settings | Not migrated: the critical setting credentials-and-keys-settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Refused | — | Refused: The mapping rule for this kind of unit found a setting the target has no counterpart for. The IAM master user, the master user name and password, the customer KMS key and the custom endpoint certificate, read where they are set whatever their value. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) - UNSUPPORTED; a password is never carried. (the target has no counterpart that carries this setting of the source) |
REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/domain-credentials-and-keys | Not migrated: the critical setting domain-credentials-and-keys of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Refused | — | Refused: The mapping rule for this kind of unit found a setting the target has no counterpart for. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) — UNSUPPORTED. (the target has no counterpart that carries this setting of the source) |
TF/stackit_mongodbflex_instance.dynamodb_tables | Apply stackit_mongodbflex_instance.dynamodb_tables (terraform/data.tf) | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Terraform | — | Can start now |
TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default | Apply stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (terraform/data.tf) | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Terraform | — | Can start now |
TF/stackit_valkey_credential.dependencies_checkout_elasticache_redis_default | Apply stackit_valkey_credential.dependencies_checkout_elasticache_redis_default (terraform/data.tf) | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Terraform | TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default | Can start now |
Wave 4 — Platform
Kubernetes, load balancers, logging and the other shared services.
The manual steps of this wave in 7 work packages (execution/manual/actions.md lists every package with its steps):
| Package | What | Owner | Steps | Affected resources | State |
|---|---|---|---|---|---|
WP-19 | Set up the log delivery and its labels (platform services) | Platform Architect | 3 | 1 | waits for decisions (1 of 3 steps) |
WP-20 | Decide and set the critical settings (platform services) | Identity Architect | 6 | 6 | a person can start it now |
WP-21 | Decide and set the critical settings (platform services) | Network Architect | 7 | 7 | a person can start it now |
WP-22 | Decide and set the critical settings (platform services) | Platform Architect | 7 | 7 | a person can start it now |
WP-23 | Decide and set the critical settings (platform services) | Security Architect | 6 | 6 | a person can start it now |
WP-24 | Set up by hand the resources the draft writes nothing for (platform services) | Platform Architect | 3 | 3 | a person can start it now |
WP-25 | Cluster access (platform services) | Platform Architect | 1 | 6 | a person can start it now |
The steps of the wave, the manual ones among them:
| Step | What | AWS resource | Mode | Depends on | Can start |
|---|---|---|---|---|---|
MAN/semantic/module.dependencies.aws_mq_broker.mq/broker-network | Decide what the STACKIT target of module.dependencies.aws_mq_broker.mq (aws_mq_broker) does for its critical setting broker-network, which the draft does not carry, and set it up by hand, or record that production does not need it | module.dependencies.aws_mq_broker.mq | Manual | — | Can start now |
MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect | Review the 2 open critical settings of module.dependencies.aws_mq_broker.mq (aws_mq_broker) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (broker-users, tc-user--username) | module.dependencies.aws_mq_broker.mq | Manual | — | Can start now |
MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect | Review the 3 open critical settings of module.dependencies.aws_mq_broker.mq (aws_mq_broker) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (engine-version, tcp-deployment-mode, tc-mq-broker-broker-name) | module.dependencies.aws_mq_broker.mq | Manual | — | Can start now |
MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect | Review the 2 open critical settings of module.dependencies.aws_mq_broker.mq (aws_mq_broker) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-exposure, tc-user--password) | module.dependencies.aws_mq_broker.mq | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect | Review the 5 open critical settings of module.retail_app_ecs.module.alb.aws_lb.this (aws_lb) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (network-exposure, client-restriction, request-handling, lb-routing-and-addressing, lb-subnets) | module.retail_app_ecs.module.alb.aws_lb.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect | Review the 3 open critical settings of module.retail_app_ecs.module.alb.aws_lb.this (aws_lb) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (lb-connection-timeouts, request-header-options, tc-lb-name) | module.retail_app_ecs.module.alb.aws_lb.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-identity-architect | Review the 4 open critical settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-task-definition, service-execute-command, td-execution-role-arn, td-task-role-arn) | module.retail_app_ecs.module.carts_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-network-architect | Review the 5 open critical settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-discovery, service-network-placement, service-public-ip-setting, service-connect-values, td-network-mode) | module.retail_app_ecs.module.carts_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-platform-architect | Review the 2 open critical settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (task-definition, service-desired-count) | module.retail_app_ecs.module.carts_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect | Review the 4 open critical settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (td-container-definitions, td-container-secret-references, td-container-plaintext-secret-env, td-container-image-registry) | module.retail_app_ecs.module.carts_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-identity-architect | Review the 4 open critical settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-task-definition, service-execute-command, td-execution-role-arn, td-task-role-arn) | module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-network-architect | Review the 5 open critical settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-discovery, service-network-placement, service-public-ip-setting, service-connect-values, td-network-mode) | module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-platform-architect | Review the 2 open critical settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (task-definition, service-desired-count) | module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect | Review the 4 open critical settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (td-container-definitions, td-container-secret-references, td-container-plaintext-secret-env, td-container-image-registry) | module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-identity-architect | Review the 4 open critical settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-task-definition, service-execute-command, td-execution-role-arn, td-task-role-arn) | module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-network-architect | Review the 5 open critical settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-discovery, service-network-placement, service-public-ip-setting, service-connect-values, td-network-mode) | module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-platform-architect | Review the 2 open critical settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (task-definition, service-desired-count) | module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-security-architect | Review the 4 open critical settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (td-container-definitions, td-container-secret-references, td-container-plaintext-secret-env, td-container-image-registry) | module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-identity-architect | Review the 4 open critical settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-task-definition, service-execute-command, td-execution-role-arn, td-task-role-arn) | module.retail_app_ecs.module.orders_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-network-architect | Review the 5 open critical settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-discovery, service-network-placement, service-public-ip-setting, service-connect-values, td-network-mode) | module.retail_app_ecs.module.orders_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-platform-architect | Review the 2 open critical settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (task-definition, service-desired-count) | module.retail_app_ecs.module.orders_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect | Review the 4 open critical settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (td-container-definitions, td-container-secret-references, td-container-plaintext-secret-env, td-container-image-registry) | module.retail_app_ecs.module.orders_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-identity-architect | Review the 4 open critical settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-task-definition, service-execute-command, td-execution-role-arn, td-task-role-arn) | module.retail_app_ecs.module.ui_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect | Review the 6 open critical settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (service-discovery, service-load-balancer-target, service-network-placement, service-public-ip-setting, service-connect-values, td-network-mode) | module.retail_app_ecs.module.ui_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-platform-architect | Review the 2 open critical settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (task-definition, service-desired-count) | module.retail_app_ecs.module.ui_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-security-architect | Review the 4 open critical settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (td-container-definitions, td-container-secret-references, td-container-plaintext-secret-env, td-container-image-registry) | module.retail_app_ecs.module.ui_service.aws_ecs_service.this | Manual | — | Can start now |
MAN/unit/module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events | Decide how module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events (aws_cloudwatch_event_rule) moves to STACKIT and set its target up by hand, or record that it needs none: the draft writes no resource for it | module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events | Manual | — | Can start now |
MAN/unit/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights | Decide how module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights (aws_cloudwatch_log_group) moves to STACKIT and set its target up by hand, or record that it needs none: the draft writes no resource for it | module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights | Manual | — | Can start now |
MAN/unit/module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs | Decide how module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs (aws_cloudwatch_log_resource_policy) moves to STACKIT and set its target up by hand, or record that it needs none: the draft writes no resource for it | module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs | Manual | — | Can start now |
TF/stackit_application_load_balancer.retail_app_ecs_alb_this | Apply stackit_application_load_balancer.retail_app_ecs_alb_this (terraform/loadbalancing.tf) | module.retail_app_ecs.module.alb.aws_lb.this | Terraform | TF/stackit_network.vpc_vpc_public | Blocked by DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH |
TF/stackit_logs_instance.logs_retention_180d | Apply stackit_logs_instance.logs_retention_180d (terraform/observability.tf) | module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | Terraform | — | Can start now |
MAN/logs/archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | Configure a cold-storage log flow for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: send a copy of its logs, in parallel to the Logs instance stackit_logs_instance.logs_retention_180d, to a long-term store (for example a separate Object Storage bucket) that keeps them for the retention beyond 180 days | module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | Manual | TF/stackit_logs_instance.logs_retention_180d | Blocked by DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS |
MAN/logs/token:stackit_logs_instance.logs_retention_180d | Before any log source writes to stackit_logs_instance.logs_retention_180d: create a write access token for the instance (stackit_logs_access_token with the permission write), set the access control list of the instance, and point the shipper at the instance's ingest_url (Loki API) or ingest_otlp_url (OpenTelemetry) | module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | Manual | TF/stackit_logs_instance.logs_retention_180d | Can start now |
MAN/logs/label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | Choose a static label and send the name of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (and of its streams) from its log producers as the value of that label | module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | Manual | MAN/logs/token:stackit_logs_instance.logs_retention_180d, TF/stackit_logs_instance.logs_retention_180d | Can start after the step "Before any log source writes to stackit_logs_instance.logs_retention_180d" is done |
TF/stackit_ske_cluster.retail_app_ecs_cluster | Apply stackit_ske_cluster.retail_app_ecs_cluster (terraform/kubernetes.tf) | module.retail_app_ecs.aws_ecs_cluster.cluster, module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this, module.retail_app_ecs.module.ui_service.aws_ecs_service.this | Terraform | — | Can start now |
MAN/draft/handover/cluster-access/kubeconfig-md | Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health | module.retail_app_ecs.aws_ecs_cluster.cluster, module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this, module.retail_app_ecs.module.ui_service.aws_ecs_service.this | Manual | TF/stackit_ske_cluster.retail_app_ecs_cluster | Can start now |
TF/stackit_mariadb_instance.dependencies_catalog_rds_this | Apply stackit_mariadb_instance.dependencies_catalog_rds_this (terraform/data.tf) | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Terraform | TF/stackit_ske_cluster.retail_app_ecs_cluster | Can start now |
TF/stackit_mariadb_credential.dependencies_catalog_rds_this | Apply stackit_mariadb_credential.dependencies_catalog_rds_this (terraform/data.tf) | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Terraform | TF/stackit_mariadb_instance.dependencies_catalog_rds_this | Can start now |
TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this | Apply stackit_opensearch_instance.dependencies_catalog_opensearch_this (terraform/data.tf) | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Terraform | TF/stackit_ske_cluster.retail_app_ecs_cluster | Blocked by DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE |
TF/stackit_opensearch_credential.dependencies_catalog_opensearch_this | Apply stackit_opensearch_credential.dependencies_catalog_opensearch_this (terraform/data.tf) | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Terraform | TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this | Blocked by DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE |
TF/stackit_postgresflex_instance.dependencies_orders_rds_this | Apply stackit_postgresflex_instance.dependencies_orders_rds_this (terraform/data.tf) | module.dependencies.module.orders_rds.aws_rds_cluster.this | Terraform | TF/stackit_ske_cluster.retail_app_ecs_cluster | Can start now |
TF/stackit_postgresflex_user.dependencies_orders_rds_this | Apply stackit_postgresflex_user.dependencies_orders_rds_this (terraform/data.tf) | module.dependencies.module.orders_rds.aws_rds_cluster.this | Terraform | TF/stackit_postgresflex_instance.dependencies_orders_rds_this | Can start now |
TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders | Apply stackit_postgresflex_database.dependencies_orders_rds_this_orders (terraform/data.tf) | module.dependencies.module.orders_rds.aws_rds_cluster.this | Terraform | TF/stackit_postgresflex_instance.dependencies_orders_rds_this, TF/stackit_postgresflex_user.dependencies_orders_rds_this | Can start now |
TF/stackit_rabbitmq_instance.dependencies_mq | Apply stackit_rabbitmq_instance.dependencies_mq (terraform/messaging.tf) | module.dependencies.aws_mq_broker.mq | Terraform | TF/stackit_ske_cluster.retail_app_ecs_cluster | Can start now |
TF/stackit_rabbitmq_credential.dependencies_mq | Apply stackit_rabbitmq_credential.dependencies_mq (terraform/messaging.tf) | module.dependencies.aws_mq_broker.mq | Terraform | TF/stackit_rabbitmq_instance.dependencies_mq | Can start now |
Wave 5 — Workloads
Servers and what attaches to them.
The manual steps of this wave in 1 work package (execution/manual/actions.md lists every package with its steps):
| Package | What | Owner | Steps | Affected resources | State |
|---|---|---|---|---|---|
WP-27 | Kubernetes apply (workloads) | Platform Architect | 5 | 5 | waits for decisions |
The steps of the wave, the manual ones among them:
| Step | What | AWS resource | Mode | Depends on | Can start |
|---|---|---|---|---|---|
MAN/draft/kubernetes/carts/manifests-yaml | Fill in the required inputs of kubernetes/carts/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file> | module.retail_app_ecs.module.carts_service.aws_ecs_service.this | Manual | MAN/draft/handover/cluster-access/kubeconfig-md, MAN/security/attachment-design:module.retail_app_ecs.module.carts_service.aws_security_group.this, TF/stackit_ske_cluster.retail_app_ecs_cluster | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this |
MAN/draft/kubernetes/catalog/manifests-yaml | Fill in the required inputs of kubernetes/catalog/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file> | module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | Manual | MAN/draft/handover/cluster-access/kubeconfig-md, MAN/security/attachment-design:module.retail_app_ecs.module.catalog_service.aws_security_group.this, TF/stackit_ske_cluster.retail_app_ecs_cluster | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this |
MAN/draft/kubernetes/checkout/manifests-yaml | Fill in the required inputs of kubernetes/checkout/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file> | module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | Manual | MAN/draft/handover/cluster-access/kubeconfig-md, MAN/security/attachment-design:module.retail_app_ecs.module.checkout_service.aws_security_group.this, TF/stackit_ske_cluster.retail_app_ecs_cluster | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this |
MAN/draft/kubernetes/orders/manifests-yaml | Fill in the required inputs of kubernetes/orders/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file> | module.retail_app_ecs.module.orders_service.aws_ecs_service.this | Manual | MAN/draft/handover/cluster-access/kubeconfig-md, MAN/security/attachment-design:module.retail_app_ecs.module.orders_service.aws_security_group.this, TF/stackit_ske_cluster.retail_app_ecs_cluster | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this |
MAN/draft/kubernetes/ui/manifests-yaml | Fill in the required inputs of kubernetes/ui/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file> | module.retail_app_ecs.module.ui_service.aws_ecs_service.this | Manual | MAN/draft/handover/cluster-access/kubeconfig-md, MAN/security/attachment-design:module.retail_app_ecs.module.ui_service.aws_security_group.this, TF/stackit_ske_cluster.retail_app_ecs_cluster | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
Wave 6 — Data migration
Copying the data from the source to the new services.
The manual steps of this wave in 4 work packages (execution/manual/actions.md lists every package with its steps):
| Package | What | Owner | Steps | Affected resources | State |
|---|---|---|---|---|---|
WP-18 | Move the data and the objects to the target | Data Architect | 2 | 1 | a person can start it now |
WP-26 | Move the data and the objects to the target | Data Architect | 6 | 2 | waits for decisions (2 of 6 steps) |
WP-28 | Move the data and the objects to the target | Data Architect | 22 | 5 | waits for decisions |
WP-29 | Move the data and the objects to the target | Migration Owner | 10 | 5 | waits for decisions |
The steps of the wave, the manual ones among them:
| Step | What | AWS resource | Mode | Depends on | Can start |
|---|---|---|---|---|---|
MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/preflight | Close what the plan lists as UNKNOWN, from the move host, with read-only commands; no password goes on a command line or into the history of the shell. Source (valkey-cli -h <source-host> -p <source-port> --tls, without --tls where the source has none): INFO server (the engine and its version), INFO keyspace and DBSIZE (the keys and the keys with an expiry; on every primary when cluster mode is on, listed with CLUSTER NODES), INFO memory (used_memory and maxmemory), SCAN 0 COUNT 100 with TYPE, DUMP and PTTL of a few keys of each family (the commands of the copy; the types the copy has no branch for show here), and the credential the copy signs in with. Target (after the draft is applied and the instance and a service key exist; valkey-cli -u rediss://<target-user>@<target-host>:<target-port> --tls --sni <target-host>): INFO server (Valkey 8), DBSIZE (0) and INFO memory; do not expect CONFIG, ACL or MODULE, which a probe found denied to the service key. Check that the move host is in parameters.sgw_acl of the instance (remove it afterwards), reaches both ends, and that the clients of the cache are listed with the TLS and the credential each uses. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#preflight. | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | TF/stackit_valkey_credential.dependencies_checkout_elasticache_redis_default, TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default | Can start now |
MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/rehearsal | Rehearse the copy on a sample into a scratch Key Value Store instance of the same plan and version as the draft's instance (a second instance, deleted afterwards: the real instance must stay empty for the final copy): copy the keys of a prefix or a few thousand keys of every family with the client of the copy (SCAN with MATCH, DUMP, PTTL, RESTORE with the remaining time to live), note the keys a second, the bytes a second and the keys RESTORE refuses, point one copy of the application at the scratch instance with TLS and run its own test suite, and compute the freeze window from the throughput: keys / (keys a second) is the lower bound of the copy. Delete the scratch instance afterwards. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#rehearsal. | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/preflight | Can start after the data preflight of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is done |
MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/preflight | Close what the plan lists as UNKNOWN, from the move host, with read-only statements; no password goes on a command line (the client prompts for it). Source (mysql --host=<source-host> --port=<source-port> --user=<source-user> --password): SELECT VERSION();, SELECT table_schema, table_collation, COUNT(*) FROM information_schema.tables GROUP BY 1, 2; and the same over information_schema.columns for the collations the columns use, SELECT routine_schema, routine_type, COUNT(*) FROM information_schema.routines GROUP BY 1, 2; and the triggers, events and views the same way, the DEFINER accounts (SELECT DISTINCT definer FROM information_schema.routines, and for the views and events), SELECT user, host, plugin FROM mysql.user ORDER BY 1, 2; and SHOW GRANTS FOR '<user>'@'<host>'; for each (names and plugins, never the authentication string), SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone, @@GLOBAL.gtid_mode;, SHOW DATABASES; and the engines and the tables without a primary key (the queries of the check table-engines-and-keys). Target (after the draft is applied and the instance and its service key exist; mysql --host=<target-host> --port=<target-port> --user=<target-user> --password --database=<target-database>): SELECT VERSION();, SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone;, SHOW VARIABLES LIKE 'character_set%';, SHOW VARIABLES LIKE 'collation%';, SHOW COLLATION WHERE Collation LIKE 'utf8mb4%0900%'; and SHOW GRANTS;. Check that the move host is in parameters.sgw_acl of the instance (remove it afterwards), reaches both ends and uses the custom port of the instance's service key. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#preflight. | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | TF/stackit_mariadb_credential.dependencies_catalog_rds_this, TF/stackit_mariadb_instance.dependencies_catalog_rds_this | Can start now |
MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/rehearsal | Rehearse the dump and the load into a scratch instance of the same plan and version as the draft's instance (a second STACKIT MariaDB instance, deleted afterwards: the real instance must stay empty for the final load) from a copy of the source (a restore of a snapshot into a scratch RDS or Aurora database, so that production is not loaded): mysqldump --host=<source-host> --port=<source-port> --user=<source-user> --password --single-transaction --routines --triggers --events --set-gtid-purged=OFF --no-tablespaces --databases <database-1> <database-2> --result-file=<dump-file>.sql, then mysql --host=<target-host> --port=<target-port> --user=<target-user> --password --database=<target-database> < <dump-file>.sql 2> load.log into the scratch instance. Note the elapsed time of the dump, of the load and of the verification, read every line of load.log, run the application's own test suite against the scratch instance, and compare the routines, triggers, events and views that were created with the source's. Delete the scratch instance and the dump afterwards. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#rehearsal. | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/preflight | Can start after the data preflight of module.dependencies.module.catalog_rds.aws_rds_cluster.this is done |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/preflight | Preflight of the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this: close the checks the plan lists as UNKNOWN (versions, extensions, roles, network and TLS) with read-only queries on the source and on the target, before any data moves. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#decide-and-check. | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders, TF/stackit_postgresflex_instance.dependencies_orders_rds_this, TF/stackit_postgresflex_user.dependencies_orders_rds_this | Can start now |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/rehearsal | Rehearse the move of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this into a scratch database of stackit_postgresflex_instance.dependencies_orders_rds_this from a copy of the source, and time each part of it. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#prepare-the-target. | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/preflight | Can start after the data preflight of module.dependencies.module.orders_rds.aws_rds_cluster.this is done |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/initial-copy/logical-replication | Copy the existing data of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this by logical replication: copy the schema, publish on the source and subscribe from the target, and wait until every table is copied. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#method-b-logical-replication. | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/rehearsal | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/delta-sync/logical-replication | Keep the replication of module.dependencies.module.orders_rds.aws_rds_cluster.this running and watch its lag and the free storage of the source until the write freeze. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#method-b-logical-replication. | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/initial-copy/logical-replication | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/client-import | Freeze the writers of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#write-freeze-client-import. | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Manual | TF/stackit_opensearch_credential.dependencies_catalog_opensearch_this, TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE |
MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/client-import | Inside the freeze, copy the indices of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this to stackit_opensearch_instance.dependencies_catalog_opensearch_this with the reindex operation of the service, as the OpenSearch how-to "Migrate data from Elasticsearch to OpenSearch 2" describes. Runbook section: terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#final-sync-client-import. | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Manual | MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/client-import | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE |
MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/client-import | Reconcile module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this and stackit_opensearch_instance.dependencies_catalog_opensearch_this with the writers stopped (the number of documents of every index on each side, a checksum or a sample of their content, and one read the application does) and record GO or NO-GO. Runbook section: terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#reconcile-client-import. | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Manual | MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/client-import | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE |
MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/own-tool | Freeze the writers of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#write-freeze-own-tool. | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Manual | TF/stackit_opensearch_credential.dependencies_catalog_opensearch_this, TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE |
MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/own-tool | Copy the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this to stackit_opensearch_instance.dependencies_catalog_opensearch_this with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back. Runbook section: terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#final-sync-own-tool. | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Manual | MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/own-tool | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE |
MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/own-tool | Reconcile module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this and stackit_opensearch_instance.dependencies_catalog_opensearch_this with the writers stopped (the number of documents of every index on each side, a checksum or a sample of their content, and one read the application does) and record GO or NO-GO. Runbook section: terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#reconcile-own-tool. | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Manual | MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/own-tool | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE |
MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/dump-restore | List who writes (SELECT user, host, db, command, COUNT(*) FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') GROUP BY 1, 2, 3, 4;) and record the connection settings of every client where they can be restored from. Then stop the writers at the application (services, jobs, migrations, cron, replicas that write). Do not make the source read-only and do not change it. Check: SELECT COUNT(*) FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') AND command <> 'Sleep' AND id <> CONNECTION_ID(); is 0. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#write-freeze-dump-restore. | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/rehearsal | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/dump-restore | Dump inside the freeze: mysqldump --host=<source-host> --port=<source-port> --user=<source-user> --password --single-transaction --routines --triggers --events --set-gtid-purged=OFF --no-tablespaces --databases <database-1> <database-2> --result-file=<dump-file>.sql. --set-gtid-purged=OFF leaves the GTID statements out, which MariaDB does not take, and --no-tablespaces leaves out the CREATE TABLESPACE statements, which MariaDB does not support for InnoDB. The target instance must be empty before the load (the STACKIT how-to of the restore says so): load the dump with the mysql client, as the user of the instance's service key, into the empty instance: mysql --host=<target-host> --port=<target-port> --user=<target-user> --password --database=<target-database> < <dump-file>.sql 2> load.log, and read every line of load.log. A DEFINER account that does not exist on the target, a collation the target does not know and a database the target does not have are the errors the checks name: each is settled by a person, never by skipping the object. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#final-sync-dump-restore. | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/dump-restore | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore | Both sides, with the writers stopped: per-table counts (SELECT CONCAT('SELECT ''', table_schema, '.', table_name, ''' AS tbl, COUNT(*) FROM ', table_schema, '.', table_name, ';') FROM information_schema.tables WHERE table_type = 'BASE TABLE' AND table_schema NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys'); and run what it prints; the table_rows of information_schema are estimates, not counts), for each table that matters an aggregate of its content (SELECT COUNT(*), MIN(<key>), MAX(<key>), SUM(<numeric-column>) FROM <schema>.<table>;; a CHECKSUM TABLE value is compared only where both servers have been shown to agree on a sample in the rehearsal), the number of routines, triggers, events and views on each side (the queries of the preflight) and their definitions (SHOW CREATE <type> <name>;), SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone; equal where they are meant to be, a TIMESTAMP column and a DATETIME column of one row read in the same session time zone, and one read query the application itself runs on its most important data, <application-query>: the query and the answer are the customer's, the source does not state them. Record GO or NO-GO. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#reconcile-dump-restore. | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/dump-restore | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/own-tool | List who writes (SELECT user, host, db, command, COUNT(*) FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') GROUP BY 1, 2, 3, 4;) and record the connection settings of every client where they can be restored from. Then stop the writers at the application (services, jobs, migrations, cron, replicas that write). Do not make the source read-only and do not change it. Check: SELECT COUNT(*) FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') AND command <> 'Sleep' AND id <> CONNECTION_ID(); is 0. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#write-freeze-own-tool. | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/rehearsal | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/own-tool | Copy the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this to stackit_mariadb_instance.dependencies_catalog_rds_this with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#final-sync-own-tool. | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/own-tool | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/own-tool | Both sides, with the writers stopped: per-table counts (SELECT CONCAT('SELECT ''', table_schema, '.', table_name, ''' AS tbl, COUNT(*) FROM ', table_schema, '.', table_name, ';') FROM information_schema.tables WHERE table_type = 'BASE TABLE' AND table_schema NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys'); and run what it prints; the table_rows of information_schema are estimates, not counts), for each table that matters an aggregate of its content (SELECT COUNT(*), MIN(<key>), MAX(<key>), SUM(<numeric-column>) FROM <schema>.<table>;; a CHECKSUM TABLE value is compared only where both servers have been shown to agree on a sample in the rehearsal), the number of routines, triggers, events and views on each side (the queries of the preflight) and their definitions (SHOW CREATE <type> <name>;), SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone; equal where they are meant to be, a TIMESTAMP column and a DATETIME column of one row read in the same session time zone, and one read query the application itself runs on its most important data, <application-query>: the query and the answer are the customer's, the source does not state them. Record GO or NO-GO. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#reconcile-own-tool. | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/own-tool | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/client-import | Freeze the writers of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#write-freeze-client-import. | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/rehearsal, TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default |
MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/client-import | Inside the freeze, copy every key of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default to stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with a client that you run, not with the MIGRATE command: iterate the keys of the source with SCAN (never KEYS), read each key with DUMP and its remaining time to live with PTTL, and write it into stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with RESTORE (the TTL in milliseconds, 0 for a key that has none, and without REPLACE), after you isolated the source (no application connected to it) and took a backup of it. The source shows one shard (it states num_cache_clusters, which the provider documents as conflicting with num_node_groups): the copy iterates one node, the primary. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#final-sync-client-import. | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/client-import | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default |
MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/client-import | Reconcile module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with the writers stopped (DBSIZE and INFO KEYSPACE on both sides: the number of keys and the keys and expires values must be equal, where the cache returns the section; the sorted lists of the keys of both, each listed with SCAN and never KEYS: their difference must be empty; and one read the application does) and record GO or NO-GO. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#reconcile-client-import. | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/client-import | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default |
MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/own-tool | Freeze the writers of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#write-freeze-own-tool. | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/rehearsal, TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default |
MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/own-tool | Copy the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default to stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#final-sync-own-tool. | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/own-tool | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default |
MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/own-tool | Reconcile module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with the writers stopped (DBSIZE and INFO KEYSPACE on both sides: the number of keys and the keys and expires values must be equal, where the cache returns the section; the sorted lists of the keys of both, each listed with SCAN and never KEYS: their difference must be empty; and one read the application does) and record GO or NO-GO. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#reconcile-own-tool. | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/own-tool | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default |
MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/write-freeze/own-tool | Freeze the writers of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#write-freeze-own-tool. | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Manual | TF/stackit_mongodbflex_instance.dynamodb_tables | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this |
MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/export/own-tool | Inside the freeze, export the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) to S3 with the DynamoDB export to S3, which requires point-in-time recovery, and the source does not state point-in-time recovery for this table (the provider's default is off): a request for a table without it fails with PointInTimeRecoveryUnavailableException. Switch recovery on first (a change to the AWS table that this plan does not make) and request the export only after it is on, using aws dynamodb export-table-to-point-in-time --table-arn <table ARN> --s3-bucket <bucket> --s3-prefix <prefix> --export-format DYNAMODB_JSON; keep the manifest-summary.json (its itemCount is the count the comparison uses). Without the export, read the table in full with Scan, which consumes the read capacity of the table, and count the items you write out. Runbook section: terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#export-own-tool. | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Manual | MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/write-freeze/own-tool | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this |
MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/transform/own-tool | Convert the export of the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) into documents of the collection of stackit_mongodbflex_instance.dynamodb_tables with a script of your own: unwrap the type descriptors of the DynamoDB JSON (S, N, B, BOOL, NULL, M, L, SS, NS, BS) into BSON values; make the key id the _id (or a unique index on id); keep numbers in the BSON type that holds them: a DynamoDB number has up to 38 digits of precision and a decimal128 has 34, so a value of more than 34 significant digits cannot be a decimal128 without rounding (keep it as a string, as AWS advises beyond 38 digits, or report it); turn a string set, a number set and a binary set (SS, NS, BS) into an array: a set holds unique values in no order and an array does not, so the application code that relies on set operations changes; plan the secondary indexes global secondary index idx_global_customerId (customerId) as MongoDB indexes on the collection (a local index shares the key of the table, so its index leads with the table's partition key); projections are not carried (a MongoDB index finds whole documents); the item size needs no check in this direction: DynamoDB holds an item of up to 400 KB and a BSON document holds up to 16 mebibytes; the consistency the application needs is its own decision: a read of DynamoDB is eventually consistent unless the request asks for a strongly consistent read, and a global secondary index is eventually consistent only; MongoDB's read concern and read preference are chosen by the application's driver. Runbook section: terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#conversion-own-tool. | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Manual | MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/export/own-tool | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this |
MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/final-sync/own-tool | Load the documents of the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) into the collection of stackit_mongodbflex_instance.dynamodb_tables (STACKIT MongoDB Flex) with a MongoDB client of your choice (mongoimport, or a driver script), then create its indexes. Runbook section: terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#final-sync-own-tool. | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Manual | MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/transform/own-tool | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this |
MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/reconcile/own-tool | Reconcile the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) and the collection of stackit_mongodbflex_instance.dynamodb_tables with the writers stopped: the number of documents in the collection must equal the itemCount of the export (manifest-summary.json), less the items the conversion reported, a sample of keys must read the same items on both sides, and the application's read of one item must return the same on both; record GO or NO-GO. Runbook section: terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#reconcile-own-tool. | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Manual | MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/final-sync/own-tool | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/dump-restore | Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window. | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/rehearsal | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/dump-restore | Inside the freeze, dump module.dependencies.module.orders_rds.aws_rds_cluster.this and restore the dump into stackit_postgresflex_instance.dependencies_orders_rds_this, and settle every error of the restore. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#method-a-dumprestore. | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/dump-restore | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/dump-restore | Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and stackit_postgresflex_instance.dependencies_orders_rds_this with the writers stopped (row counts, checksums, sequences and one query the application runs) and record GO or NO-GO. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#verify-with-the-application. | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/dump-restore | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/logical-replication | Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window. | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/delta-sync/logical-replication | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/logical-replication | Inside the freeze, wait until the replication of module.dependencies.module.orders_rds.aws_rds_cluster.this has no lag, copy the sequences to stackit_postgresflex_instance.dependencies_orders_rds_this and disable the subscription. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window. | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/logical-replication | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/logical-replication | Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and stackit_postgresflex_instance.dependencies_orders_rds_this with the writers stopped (row counts, checksums, sequences and one query the application runs) and record GO or NO-GO. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#verify-with-the-application. | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/logical-replication | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/own-tool | Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window. | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/rehearsal | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/own-tool | Copy the data of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/own-tool | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/own-tool | Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and stackit_postgresflex_instance.dependencies_orders_rds_this with the writers stopped (row counts, checksums, sequences and one query the application runs) and record GO or NO-GO. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#verify-with-the-application. | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/own-tool | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this |
Wave 7 — Cutover
Moving traffic to the target and the steps that must be taken before production.
The manual steps of this wave in 5 work packages (execution/manual/actions.md lists every package with its steps):
| Package | What | Owner | Steps | Affected resources | State |
|---|---|---|---|---|---|
WP-30 | Switch the data consumers to the target | Data Architect | 4 | 4 | waits for decisions |
WP-31 | Switch the data consumers to the target | Identity Architect | 4 | 4 | waits for decisions |
WP-32 | Confirm that the cutover can start and that it is complete | Migration Owner | 2 | 0 | not executable as the plan stands (1 of 2 steps) |
WP-33 | Switch the clients to the target | Network Architect | 3 | 3 | not executable as the plan stands (1 of 3 steps) |
WP-34 | Switch the message producers and consumers to the target | Platform Architect | 2 | 1 | waits for decisions |
The steps of the wave, the manual ones among them:
| Step | What | AWS resource | Mode | Depends on | Can start |
|---|---|---|---|---|---|
MAN/cutover/connection/module.dependencies.module.catalog_rds.aws_rds_cluster.this | Switch the connection of the applications of module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) to its STACKIT copy stackit_mariadb_instance.dependencies_catalog_rds_this: change the connection string (host, port, database name and credentials) in the configuration of every application that uses it (the source references it from module.retail_app_ecs.aws_secretsmanager_secret.catalog_db; an application outside the source is not read). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.dependencies.module.catalog_rds.aws_rds_cluster.this.endpoint (host): stackit_mariadb_credential.dependencies_catalog_rds_this.host; module.dependencies.module.catalog_rds.aws_rds_cluster.this.reader_endpoint (reader endpoint): stackit_mariadb_instance.dependencies_catalog_rds_this has no reader endpoint attribute (its connection_info holds the write endpoint only); module.dependencies.module.catalog_rds.aws_rds_cluster.this.port (port): stackit_mariadb_credential.dependencies_catalog_rds_this.port; module.dependencies.module.catalog_rds.aws_rds_cluster.this.database_name (database name): the name of a database of the instance: the draft writes no database block for this unit; module.dependencies.module.catalog_rds.aws_rds_cluster.this.master_username (user name): stackit_mariadb_credential.dependencies_catalog_rds_this.username. Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, attribute secret_string in module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db reads module.dependencies.module.catalog_rds.aws_rds_cluster.this through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/preflight, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/own-tool, TF/stackit_mariadb_credential.dependencies_catalog_rds_this, TF/stackit_mariadb_instance.dependencies_catalog_rds_this | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this |
MAN/cutover/connection/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Switch the connection of the applications of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) to its STACKIT copy stackit_valkey_instance.dependencies_checkout_elasticache_redis_default: change the endpoint (host and port) and the password or auth token in the configuration of every application that uses it (the source references it from module.retail_app_ecs.module.checkout_service.aws_ecs_service.this; an application outside the source is not read). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.primary_endpoint_address (host), module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.configuration_endpoint_address (host), module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.reader_endpoint_address (reader endpoint), module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.port (port): stackit_valkey_instance.dependencies_checkout_elasticache_redis_default has no host or port attribute (and no reader endpoint): the host and port are attributes of a stackit_valkey_credential, which the draft writes for the instance, and the provider schema gives host and load_balanced_host no description and no STACKIT page read says which of them a client connects to, so none is mapped. Where the source reads it, and what each place reads after the switch: (1) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu, attribute alarm_name reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (2) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu, attribute dimensions reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (3) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory, attribute alarm_name reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (4) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory, attribute dimensions reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (5) module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default, attribute records reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (6) module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/preflight, MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/client-import, MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/own-tool, TF/stackit_valkey_credential.dependencies_checkout_elasticache_redis_default, TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default |
MAN/cutover/connection/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Switch the applications of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) to its STACKIT copy stackit_mongodbflex_instance.dynamodb_tables: this is a change of code before it is a change of configuration. Rewrite the data access layer of every application that uses it (the source references it from module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; an application outside the source is not read) from the DynamoDB API (GetItem, PutItem, UpdateItem, DeleteItem, Query, Scan, BatchWriteItem, TransactWriteItems, condition and update expressions) to a MongoDB driver, then change the connection string of the instance, the collection name and the credentials | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Manual | MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/export/own-tool, MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/reconcile/own-tool, TF/stackit_mongodbflex_instance.dynamodb_tables | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this |
MAN/cutover/connection/module.dependencies.module.orders_rds.aws_rds_cluster.this | Switch the connection of the applications of module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) to its STACKIT copy stackit_postgresflex_instance.dependencies_orders_rds_this, stackit_postgresflex_database.dependencies_orders_rds_this_orders: change the connection string (host, port, database name and credentials) in the configuration of every application that uses it (the source references it from module.retail_app_ecs.aws_secretsmanager_secret.orders_db; an application outside the source is not read). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.dependencies.module.orders_rds.aws_rds_cluster.this.endpoint (host): stackit_postgresflex_instance.dependencies_orders_rds_this.connection_info.write.host; module.dependencies.module.orders_rds.aws_rds_cluster.this.reader_endpoint (reader endpoint): stackit_postgresflex_instance.dependencies_orders_rds_this has no reader endpoint attribute (its connection_info holds the write endpoint only); module.dependencies.module.orders_rds.aws_rds_cluster.this.port (port): stackit_postgresflex_instance.dependencies_orders_rds_this.connection_info.write.port; module.dependencies.module.orders_rds.aws_rds_cluster.this.database_name (database name): stackit_postgresflex_database.dependencies_orders_rds_this_orders.name; module.dependencies.module.orders_rds.aws_rds_cluster.this.master_username (user name): stackit_postgresflex_user.dependencies_orders_rds_this.username (its password is a sensitive attribute of the same block: it is read from the state or the output the draft writes, never copied into a configuration by hand). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.aws_secretsmanager_secret.orders_db, attribute secret_string in module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db reads module.dependencies.module.orders_rds.aws_rds_cluster.this through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/preflight, MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/dump-restore, MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/logical-replication, MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/own-tool, TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders, TF/stackit_postgresflex_instance.dependencies_orders_rds_this, TF/stackit_postgresflex_user.dependencies_orders_rds_this | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this |
MAN/cutover/readiness | Confirm that every workload step and every data move of the plan is done (the steps this one follows) before the first switch of the cutover: the plan does not know which workloads and data stores each entry point serves, so every switch waits for all of them | — | Manual | 19 steps: MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/own-tool, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/preflight and 16 more (every predecessor is in execution-plan.json depends_on) | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | Switch the applications that read the secret module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.catalog_db.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read | module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | Manual | API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, MAN/cutover/readiness, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/open-settings-security-architect, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/tc-secretsmanager-secret-name, TF/stackit_secretsmanager_instance.migrated_secrets, TF/stackit_secretsmanager_user.migration | Blocked by DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | Switch the applications that read the secret module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read | module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | Manual | API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, MAN/cutover/readiness, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/open-settings-security-architect, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/tc-secretsmanager-secret-name, TF/stackit_secretsmanager_instance.migrated_secrets, TF/stackit_secretsmanager_user.migration | Blocked by DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.mq | Switch the applications that read the secret module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.orders_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.mq.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.orders_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.mq through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read | module.retail_app_ecs.aws_secretsmanager_secret.mq | Manual | API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq, MAN/cutover/readiness, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.mq/secret-value, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.mq/tc-secretsmanager-secret-name, TF/stackit_secretsmanager_instance.migrated_secrets, TF/stackit_secretsmanager_user.migration | Blocked by DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.orders_db | Switch the applications that read the secret module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.orders_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.orders_db.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.orders_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read | module.retail_app_ecs.aws_secretsmanager_secret.orders_db | Manual | API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db, MAN/cutover/readiness, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.orders_db/secret-value, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.orders_db/tc-secretsmanager-secret-name, TF/stackit_secretsmanager_instance.migrated_secrets, TF/stackit_secretsmanager_user.migration | Blocked by DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/cutover/module.dependencies.aws_mq_broker.mq | Switch the producers of module.dependencies.aws_mq_broker.mq (aws_mq_broker) from its AWS address (the instances[*].endpoints of module.dependencies.aws_mq_broker.mq) to the endpoint of the STACKIT instance (the host and port of a credential of stackit_rabbitmq_instance.dependencies_mq (stackit_rabbitmq_credential; the draft writes one for the instance: read its host and port after the apply)): change the clients' configuration (no Route 53 record of the source points to module.dependencies.aws_mq_broker.mq: a DNS record outside the source, or the address the clients are configured with). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.aws_secretsmanager_secret.mq, attribute secret_string in module.retail_app_ecs.aws_secretsmanager_secret_version.mq reads module.dependencies.aws_mq_broker.mq through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read. The consumers stay on the AWS broker until its queues are drained (the drain of the broker), and only then follow | module.dependencies.aws_mq_broker.mq | Manual | MAN/cutover/readiness, MAN/semantic/module.dependencies.aws_mq_broker.mq/broker-network, MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect, MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect, MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect, TF/stackit_rabbitmq_credential.dependencies_mq, TF/stackit_rabbitmq_instance.dependencies_mq | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/cutover/messaging-drain/module.dependencies.aws_mq_broker.mq | Drain the queues of the AWS broker module.dependencies.aws_mq_broker.mq (aws_mq_broker): its consumers go on reading them, with no producer sending to the broker any more, until every queue holds no message. Read the depth in CloudWatch: Amazon MQ for RabbitMQ publishes MessageCount (the sum of the ready and the unacknowledged messages) for the broker and, on 3.x brokers, for each queue (the dimensions Queue and VirtualHost; on 4.x brokers the figures of a queue come from the Prometheus endpoint), and Amazon MQ for ActiveMQ publishes QueueSize and InFlightCount for each queue and TotalMessageCount for the broker. An inactive durable topic subscriber (InactiveDurableTopicSubscribersCount) holds messages that only its own client can read: connect it to the AWS broker until it has read them. The plan does not read the names of the queues of the broker | module.dependencies.aws_mq_broker.mq | Manual | MAN/cutover/module.dependencies.aws_mq_broker.mq | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/cutover/messaging-consumers/module.dependencies.aws_mq_broker.mq | Switch the consumers of the broker module.dependencies.aws_mq_broker.mq (aws_mq_broker) to the endpoint of the STACKIT instance (the host and port of a credential of stackit_rabbitmq_instance.dependencies_mq (stackit_rabbitmq_credential; the draft writes one for the instance: read its host and port after the apply)) once every queue of the AWS broker is empty: change the endpoint and the credentials in their configuration, start them against the STACKIT instance and stop the consumers that read the AWS broker | module.dependencies.aws_mq_broker.mq | Manual | MAN/cutover/messaging-drain/module.dependencies.aws_mq_broker.mq | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/cutover/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Switch the clients (the applications that index and search) of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) from its AWS address (the endpoint of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this) to the endpoint of the STACKIT instance (the host and port of a credential of stackit_opensearch_instance.dependencies_catalog_opensearch_this (stackit_opensearch_credential; the draft writes one for the instance: read its host and port after the apply)): change the clients' configuration (no Route 53 record of the source points to module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: a DNS record outside the source, or the address the clients are configured with). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Manual | MAN/cutover/readiness, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/own-tool, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/own-tool, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/own-tool, MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/encryption-at-rest, MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect, MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect, MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect, REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/credentials-and-keys-settings, REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/domain-credentials-and-keys, TF/stackit_opensearch_credential.dependencies_catalog_opensearch_this, TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this | Not ready: the plan does not read whether module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is reached from the internet or only inside the network: its clients are switched either way; the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; it also waits for DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/cutover/module.retail_app_ecs.module.alb.aws_lb.this | Switch the traffic of module.retail_app_ecs.module.alb.aws_lb.this (aws_lb) from its AWS address (the dns_name of module.retail_app_ecs.module.alb.aws_lb.this) to its STACKIT address (the external_address of stackit_application_load_balancer.retail_app_ecs_alb_this): change the clients' configuration (no Route 53 record of the source points to module.retail_app_ecs.module.alb.aws_lb.this: a DNS record outside the source, or the address the clients are configured with). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.alb.aws_wafv2_web_acl_association.this, attribute resource_arn reads module.retail_app_ecs.module.alb.aws_lb.this.arn (the ARN); after the switch: no ARN exists on STACKIT (the access and wiring steps of the unit decide what replaces it) | module.retail_app_ecs.module.alb.aws_lb.this | Manual | MAN/cutover/readiness, MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect, MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect, TF/stackit_application_load_balancer.retail_app_ecs_alb_this | Blocked by DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/cutover/complete | Confirm that every switch of the cutover is done (the steps this one follows) before the checks of the data stores and queues start: the plan does not know which applications use which store, so each such check waits for every switch | — | Manual | MAN/cutover/connection/module.dependencies.module.catalog_rds.aws_rds_cluster.this, MAN/cutover/connection/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, MAN/cutover/connection/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, MAN/cutover/connection/module.dependencies.module.orders_rds.aws_rds_cluster.this, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.mq, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.orders_db, MAN/cutover/messaging-consumers/module.dependencies.aws_mq_broker.mq, MAN/cutover/messaging-drain/module.dependencies.aws_mq_broker.mq, MAN/cutover/module.dependencies.aws_mq_broker.mq, MAN/cutover/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, MAN/cutover/module.retail_app_ecs.module.alb.aws_lb.this | Not ready: it waits for the traffic switch of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, which no answer makes executable; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
Wave 8 — Verification
Checking the migrated estate and the work after the cutover.
The manual steps of this wave in 3 work packages (execution/manual/actions.md lists every package with its steps):
| Package | What | Owner | Steps | Affected resources | State |
|---|---|---|---|---|---|
WP-35 | Check the migrated estate and decide go or rollback | Data Architect | 5 | 5 | not executable as the plan stands |
WP-36 | Check the migrated estate and decide go or rollback | Migration Owner | 1 | 0 | not executable as the plan stands |
WP-37 | Check the migrated estate and decide go or rollback | Network Architect | 8 | 8 | not executable as the plan stands (1 of 8 steps) |
The steps of the wave, the manual ones among them:
| Step | What | AWS resource | Mode | Depends on | Can start |
|---|---|---|---|---|---|
MAN/verify/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Check that the application reads the data migrated from module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) on its STACKIT target stackit_opensearch_instance.dependencies_catalog_opensearch_this and that what it writes there is read back | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Manual | MAN/cutover/complete, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/own-tool, TF/stackit_opensearch_credential.dependencies_catalog_opensearch_this, TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this | Not ready: it waits for the cutover completion step, which no answer makes executable; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/verify/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this | Check that the application reads the data migrated from module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) on its STACKIT target stackit_mariadb_instance.dependencies_catalog_rds_this and that what it writes there is read back | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | MAN/cutover/complete, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/preflight, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/own-tool, TF/stackit_mariadb_credential.dependencies_catalog_rds_this, TF/stackit_mariadb_instance.dependencies_catalog_rds_this | Not ready: it waits for the cutover completion step, which no answer makes executable; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/verify/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Check that the application reads the data migrated from module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) on its STACKIT target stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and that what it writes there is read back | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | MAN/cutover/complete, MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/preflight, MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/client-import, MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/own-tool, TF/stackit_valkey_credential.dependencies_checkout_elasticache_redis_default, TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default | Not ready: it waits for the cutover completion step, which no answer makes executable; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/verify/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Check that the application reads the data migrated from module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) on its STACKIT target stackit_mongodbflex_instance.dynamodb_tables and that what it writes there is read back | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Manual | MAN/cutover/complete, MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/export/own-tool, MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/reconcile/own-tool, TF/stackit_mongodbflex_instance.dynamodb_tables | Not ready: it waits for the cutover completion step, which no answer makes executable; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/verify/data/module.dependencies.module.orders_rds.aws_rds_cluster.this | Check that the application reads the data migrated from module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) on its STACKIT target stackit_postgresflex_instance.dependencies_orders_rds_this, stackit_postgresflex_database.dependencies_orders_rds_this_orders and that what it writes there is read back | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/cutover/complete, MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/preflight, MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/dump-restore, MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/logical-replication, MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/own-tool, TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders, TF/stackit_postgresflex_instance.dependencies_orders_rds_this, TF/stackit_postgresflex_user.dependencies_orders_rds_this | Not ready: it waits for the cutover completion step, which no answer makes executable; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/verify/dns/module.retail_app_ecs.module.carts_service.aws_ecs_service.this | Check from inside the cluster that the 1 name(s) the application carts resolves in the source VPC (carts) resolve to what stands for them on STACKIT | module.retail_app_ecs.module.carts_service.aws_ecs_service.this | Manual | MAN/draft/kubernetes/carts/manifests-yaml | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this |
MAN/verify/dns/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | Check from inside the cluster that the 3 name(s) the application catalog resolves in the source VPC (the endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch), the endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora), catalog) resolve to what stands for them on STACKIT | module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | Manual | MAN/draft/kubernetes/catalog/manifests-yaml | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this |
MAN/verify/dns/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | Check from inside the cluster that the 2 name(s) the application checkout resolves in the source VPC (the endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache), checkout) resolve to what stands for them on STACKIT | module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | Manual | MAN/draft/kubernetes/checkout/manifests-yaml | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this |
MAN/verify/dns/module.retail_app_ecs.module.orders_service.aws_ecs_service.this | Check from inside the cluster that the 3 name(s) the application orders resolves in the source VPC (the endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ), the endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora), orders) resolve to what stands for them on STACKIT | module.retail_app_ecs.module.orders_service.aws_ecs_service.this | Manual | MAN/draft/kubernetes/orders/manifests-yaml | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this |
MAN/verify/dns/module.retail_app_ecs.module.ui_service.aws_ecs_service.this | Check from inside the cluster that the 1 name(s) the application ui resolves in the source VPC (ui) resolve to what stands for them on STACKIT | module.retail_app_ecs.module.ui_service.aws_ecs_service.this | Manual | MAN/draft/kubernetes/ui/manifests-yaml | Blocked by DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/verify/endpoint/module.dependencies.aws_mq_broker.mq | Check that the host and port of a credential of stackit_rabbitmq_instance.dependencies_mq (stackit_rabbitmq_credential; the draft writes one for the instance: read its host and port after the apply) answers the requests the clients of module.dependencies.aws_mq_broker.mq send, over the STACKIT address, as the instances[*].endpoints of module.dependencies.aws_mq_broker.mq did | module.dependencies.aws_mq_broker.mq | Manual | MAN/cutover/connection/module.dependencies.module.catalog_rds.aws_rds_cluster.this, MAN/cutover/connection/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, MAN/cutover/connection/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, MAN/cutover/connection/module.dependencies.module.orders_rds.aws_rds_cluster.this, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.mq, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.orders_db, MAN/cutover/messaging-consumers/module.dependencies.aws_mq_broker.mq | Blocked by DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/verify/endpoint/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Check that the host and port of a credential of stackit_opensearch_instance.dependencies_catalog_opensearch_this (stackit_opensearch_credential; the draft writes one for the instance: read its host and port after the apply) answers the requests the clients of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this send, over the STACKIT address, as the endpoint of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this did | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Manual | MAN/cutover/connection/module.dependencies.module.catalog_rds.aws_rds_cluster.this, MAN/cutover/connection/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, MAN/cutover/connection/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, MAN/cutover/connection/module.dependencies.module.orders_rds.aws_rds_cluster.this, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.mq, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.orders_db, MAN/cutover/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Not ready: it waits for the traffic switch of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, which no answer makes executable; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/verify/endpoint/module.retail_app_ecs.module.alb.aws_lb.this | Check that the external_address of stackit_application_load_balancer.retail_app_ecs_alb_this answers the requests the clients of module.retail_app_ecs.module.alb.aws_lb.this send, over the STACKIT address, as the dns_name of module.retail_app_ecs.module.alb.aws_lb.this did | module.retail_app_ecs.module.alb.aws_lb.this | Manual | MAN/cutover/connection/module.dependencies.module.catalog_rds.aws_rds_cluster.this, MAN/cutover/connection/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, MAN/cutover/connection/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, MAN/cutover/connection/module.dependencies.module.orders_rds.aws_rds_cluster.this, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.mq, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.orders_db, MAN/cutover/module.retail_app_ecs.module.alb.aws_lb.this | Blocked by DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/verify/rollback-decision | Decide GO or ROLLBACK for the migration once every check of the verification is done: GO lets the source resources be retired, ROLLBACK reverts the cutover and keeps AWS serving | — | Manual | 46 steps: MAN/cutover/connection/module.dependencies.module.catalog_rds.aws_rds_cluster.this, MAN/cutover/connection/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, MAN/cutover/connection/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this and 43 more (every predecessor is in execution-plan.json depends_on) | Not ready: the decision point follows every check of the verification (each is also an action-complete precondition); the retirement steps depend on it, and through it on the checks; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
Wave 9 — Decommission
Retiring the source.
The manual steps of this wave in 4 work packages (execution/manual/actions.md lists every package with its steps):
| Package | What | Owner | Steps | Affected resources | State |
|---|---|---|---|---|---|
WP-38 | Retire the source resources | Data Architect | 9 | 5 | not executable as the plan stands |
WP-39 | Retire the source resources | Identity Architect | 15 | 15 | not executable as the plan stands |
WP-40 | Retire the source resources | Network Architect | 21 | 21 | not executable as the plan stands |
WP-41 | Retire the source resources | Platform Architect | 11 | 11 | not executable as the plan stands |
The steps of the wave, the manual ones among them:
| Step | What | AWS resource | Mode | Depends on | Can start |
|---|---|---|---|---|---|
MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/cleanup/dump-restore | Only after the target has run in production for the period the customer decides and the way back is no longer wanted: remove the move host from parameters.sgw_acl of the instance; delete the dump file <dump-file>.sql and load.log (the dump holds the data); keep a final snapshot of the source for the retention the customer decides before anything is deleted; delete the scratch instance of the rehearsal if it still exists; and replace the credential of the service key if it was ever on a ticket or in a file. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#clean-up-dump-restore. | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore, MAN/verify/rollback-decision | Not ready: the source is not deleted in the same hour as the cutover; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/cleanup/client-import | Only after the target has run in production for the period the customer decides and the way back is no longer wanted: remove the move host from parameters.sgw_acl of the instance; delete the files the copy wrote and the snapshot of the source that was taken as the fail-safe once the target is confirmed; delete the scratch instance of the rehearsal if it still exists; and replace the credential of the service key if it was ever on a ticket or in a file. The source cache is deleted only when its owner decides, after a final snapshot kept for the retention the customer decides. Runbook section: terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#clean-up-client-import. | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/client-import, MAN/verify/rollback-decision | Not ready: the source cache is not deleted in the same hour as the cutover; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/dump-restore | Clean up what the move of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this leaves behind (the move host in the access list, the dump files, and for a replication the subscription, the publication and the slot) once the way back is no longer wanted. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#after-acceptance. | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/dump-restore, MAN/verify/rollback-decision | Not ready: the source is not deleted in the same hour as the cutover; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/logical-replication | Clean up what the move of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this leaves behind (the move host in the access list, the dump files, and for a replication the subscription, the publication and the slot) once the way back is no longer wanted. Runbook section: terraform/handover/database-dependencies_orders_rds_this/data-move.md#after-acceptance. | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/logical-replication, MAN/verify/rollback-decision | Not ready: the source is not deleted in the same hour as the cutover; this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path replicate-with-the-engine-replication of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/decommission/module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events | Retire module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events (aws_cloudwatch_event_rule) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events | Manual | MAN/unit/module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events, MAN/verify/rollback-decision | Not ready: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events reads 0 instances as the variables of the source stand: the step applies only if it exists (applies only if its count ((var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0) holds when OpenTofu plans — off with the defaults of var.container_insights_setting, var.lifecycle_events_enabled; it exists only if a variable file (-var-file), -var or TF_VAR_container_insights_setting/TF_VAR_lifecycle_events_enabled switches it on, and this scan saw no such value); it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights | Retire module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights (aws_cloudwatch_log_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights | Manual | MAN/unit/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights, MAN/verify/rollback-decision | Not ready: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights reads 0 instances as the variables of the source stand: the step applies only if it exists (applies only if its count ((var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0) holds when OpenTofu plans — off with the defaults of var.container_insights_setting, var.lifecycle_events_enabled; it exists only if a variable file (-var-file), -var or TF_VAR_container_insights_setting/TF_VAR_lifecycle_events_enabled switches it on, and this scan saw no such value); it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs | Retire module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs (aws_cloudwatch_log_resource_policy) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs | Manual | MAN/unit/module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs, MAN/verify/rollback-decision | Not ready: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs reads 0 instances as the variables of the source stand: the step applies only if it exists (applies only if its count ((var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0) holds when OpenTofu plans — off with the defaults of var.container_insights_setting, var.lifecycle_events_enabled; it exists only if a variable file (-var-file), -var or TF_VAR_container_insights_setting/TF_VAR_lifecycle_events_enabled switches it on, and this scan saw no such value); it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/decommission/module.retail_app_ecs.module.alb.aws_lb.this | Retire module.retail_app_ecs.module.alb.aws_lb.this (aws_lb) with its parts module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.alb.aws_lb.this | Manual | MAN/cutover/module.retail_app_ecs.module.alb.aws_lb.this, MAN/security/accept/module.retail_app_ecs.module.alb.aws_lb.this:plaintext-public-listener, MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect, MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect, MAN/verify/endpoint/module.retail_app_ecs.module.alb.aws_lb.this, MAN/verify/rollback-decision, TF/stackit_application_load_balancer.retail_app_ecs_alb_this | S1 |
MAN/decommission/module.retail_app_ecs.module.alb.aws_security_group.this | Retire module.retail_app_ecs.module.alb.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.alb.aws_security_group.this | Manual | MAN/decommission/module.retail_app_ecs.module.alb.aws_lb.this, MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings, MAN/verify/rollback-decision, REF/root/security-group-membership-parity, TF/stackit_security_group.retail_app_ecs_alb_this | S1 |
MAN/decommission/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | Retire module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix (aws_security_group) with its parts module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | Manual | MAN/decommission/module.retail_app_ecs.module.alb.aws_lb.this, MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules-b506f3, MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules-a538f6, MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules.0-217968, MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules.0-f26028, MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings, MAN/verify/rollback-decision, REF/root/security-group-membership-parity, TF/stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix | S1 |
MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this | Retire module.retail_app_ecs.module.ui_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.ui_service.aws_ecs_service.this | Manual | MAN/draft/handover/cluster-access/kubeconfig-md, MAN/draft/kubernetes/ui/manifests-yaml, MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.execution_role_arn-2d22d2, MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.task_role_arn-0c66b7, MAN/security/attachment-design:module.retail_app_ecs.module.ui_service.aws_security_group.this, MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-identity-architect, MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect, MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-platform-architect, MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-security-architect, MAN/verify/dns/module.retail_app_ecs.module.ui_service.aws_ecs_service.this, MAN/verify/rollback-decision, TF/stackit_ske_cluster.retail_app_ecs_cluster | S1 |
MAN/decommission/module.retail_app_ecs.module.carts_service.aws_ecs_service.this | Retire module.retail_app_ecs.module.carts_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.carts_service.aws_ecs_service.this | Manual | MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this, MAN/draft/handover/cluster-access/kubeconfig-md, MAN/draft/kubernetes/carts/manifests-yaml, MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.execution_role_arn-586451, MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.task_role_arn-686488, MAN/security/attachment-design:module.retail_app_ecs.module.carts_service.aws_security_group.this, MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-identity-architect, MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-network-architect, MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-platform-architect, MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect, MAN/verify/dns/module.retail_app_ecs.module.carts_service.aws_ecs_service.this, MAN/verify/rollback-decision, TF/stackit_ske_cluster.retail_app_ecs_cluster | S1 |
MAN/decommission/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role | Retire module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role | Manual | MAN/decommission/module.retail_app_ecs.module.carts_service.aws_ecs_service.this, MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings, MAN/verify/rollback-decision, TF/stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role, TF/stackit_service_account.retail_app_ecs_carts_service_task_execution_role | S1 |
MAN/decommission/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role | Retire module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.ecs_exec, module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_role_additional in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.carts_service.aws_iam_role.task_role | Manual | MAN/decommission/module.retail_app_ecs.module.carts_service.aws_ecs_service.this, MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings, MAN/verify/rollback-decision, TF/stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role, TF/stackit_service_account.retail_app_ecs_carts_service_task_role | S1 |
MAN/decommission/module.retail_app_ecs.module.carts_service.aws_security_group.this | Retire module.retail_app_ecs.module.carts_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.carts_service.aws_security_group.this | Manual | MAN/decommission/module.retail_app_ecs.module.carts_service.aws_ecs_service.this, MAN/security/accept/module.retail_app_ecs.module.carts_service.aws_security_group.this:open-ingress-application-port, MAN/security/attachment-design:module.retail_app_ecs.module.carts_service.aws_security_group.this, MAN/semantic/module.retail_app_ecs.module.carts_service.aws_security_group.this/open-settings, MAN/verify/rollback-decision, REF/root/security-group-membership-parity, TF/stackit_security_group.retail_app_ecs_carts_service_this, TF/stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1 | S1 |
MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | Retire module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | Manual | MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this, MAN/draft/handover/cluster-access/kubeconfig-md, MAN/draft/kubernetes/catalog/manifests-yaml, MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.execution_role_arn-dedc98, MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.task_role_arn-15a967, MAN/security/attachment-design:module.retail_app_ecs.module.catalog_service.aws_security_group.this, MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-identity-architect, MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-network-architect, MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-platform-architect, MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect, MAN/verify/dns/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, MAN/verify/rollback-decision, TF/stackit_ske_cluster.retail_app_ecs_cluster | S1 |
MAN/decommission/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Retire module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) with its parts module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | Manual | MAN/cutover/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/own-tool, MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/encryption-at-rest, MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect, MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect, MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect, MAN/verify/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, MAN/verify/endpoint/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, MAN/verify/rollback-decision, REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/credentials-and-keys-settings, REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/domain-credentials-and-keys, TF/stackit_opensearch_credential.dependencies_catalog_opensearch_this, TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this | S1 |
MAN/decommission/module.dependencies.aws_security_group.catalog_opensearch_sg | Retire module.dependencies.aws_security_group.catalog_opensearch_sg (aws_security_group) with its parts module.dependencies.aws_security_group_rule.allow_https_from_client in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.dependencies.aws_security_group.catalog_opensearch_sg | Manual | MAN/decommission/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings, MAN/verify/rollback-decision, REF/root/security-group-membership-parity | S1 |
MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role | Retire module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_additional, module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role | Manual | MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings, MAN/verify/rollback-decision, TF/stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role, TF/stackit_service_account.retail_app_ecs_catalog_service_task_execution_role | S1 |
MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | Retire module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | Manual | API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/open-settings-security-architect, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/tc-secretsmanager-secret-name, MAN/verify/rollback-decision, TF/stackit_secretsmanager_instance.migrated_secrets, TF/stackit_secretsmanager_user.migration | S1 |
MAN/decommission/module.dependencies.module.catalog_rds.aws_rds_cluster.this | Retire module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) with its parts module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.dependencies.module.catalog_rds.aws_rds_cluster.this | Manual | MAN/cutover/connection/module.dependencies.module.catalog_rds.aws_rds_cluster.this, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/cleanup/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/preflight, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/own-tool, MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/admin-username-not-carried, MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect, MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-network-architect, MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect, MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect, MAN/verify/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this, MAN/verify/rollback-decision, TF/stackit_mariadb_credential.dependencies_catalog_rds_this, TF/stackit_mariadb_instance.dependencies_catalog_rds_this | Not ready: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; the source states skip_final_snapshot = true: AWS takes no final snapshot when it is deleted, so the data is gone with it unless a backup was taken before; take the final backup this step needs yourself, before the delete; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/decommission/module.dependencies.module.catalog_rds.aws_security_group.this | Retire module.dependencies.module.catalog_rds.aws_security_group.this (aws_security_group) with its parts module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.dependencies.module.catalog_rds.aws_security_group.this | Manual | MAN/decommission/module.dependencies.module.catalog_rds.aws_rds_cluster.this, MAN/semantic/module.dependencies.module.catalog_rds.aws_security_group.this/open-settings, MAN/verify/rollback-decision, REF/root/security-group-membership-parity | S1 |
MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | Retire module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | Manual | API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/open-settings-security-architect, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/tc-secretsmanager-secret-name, MAN/verify/rollback-decision, TF/stackit_secretsmanager_instance.migrated_secrets, TF/stackit_secretsmanager_user.migration | S1 |
MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role | Retire module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.ecs_exec in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role | Manual | MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings, MAN/verify/rollback-decision, TF/stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role, TF/stackit_service_account.retail_app_ecs_catalog_service_task_role | S1 |
MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_security_group.this | Retire module.retail_app_ecs.module.catalog_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.catalog_service.aws_security_group.this | Manual | MAN/decommission/module.dependencies.aws_security_group.catalog_opensearch_sg, MAN/decommission/module.dependencies.module.catalog_rds.aws_security_group.this, MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, MAN/security/accept/module.retail_app_ecs.module.catalog_service.aws_security_group.this:open-ingress-application-port, MAN/security/attachment-design:module.retail_app_ecs.module.catalog_service.aws_security_group.this, MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_security_group.this/open-settings, MAN/verify/rollback-decision, REF/root/security-group-membership-parity, TF/stackit_security_group.retail_app_ecs_catalog_service_this, TF/stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1 | S1 |
MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | Retire module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | Manual | MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this, MAN/draft/handover/cluster-access/kubeconfig-md, MAN/draft/kubernetes/checkout/manifests-yaml, MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.execution_role_arn-b70bc2, MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.task_role_arn-9651e2, MAN/security/attachment-design:module.retail_app_ecs.module.checkout_service.aws_security_group.this, MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-identity-architect, MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-network-architect, MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-platform-architect, MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-security-architect, MAN/verify/dns/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, MAN/verify/rollback-decision, TF/stackit_ske_cluster.retail_app_ecs_cluster | S1 |
MAN/decommission/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Retire module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | Manual | MAN/cutover/connection/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/cleanup/client-import, MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/preflight, MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/client-import, MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/own-tool, MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/network-placement, MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect, MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect, MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect, MAN/verify/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, MAN/verify/rollback-decision, TF/stackit_valkey_credential.dependencies_checkout_elasticache_redis_default, TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default | S1 |
MAN/decommission/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd | Retire module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd (aws_security_group) with its parts module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd | Manual | MAN/decommission/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings, MAN/verify/rollback-decision, REF/root/security-group-membership-parity | S1 |
MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role | Retire module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role | Manual | MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings, MAN/verify/rollback-decision, TF/stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role, TF/stackit_service_account.retail_app_ecs_checkout_service_task_execution_role | S1 |
MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role | Retire module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.ecs_exec, module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_role_additional in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role | Manual | MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings, MAN/verify/rollback-decision, TF/stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role, TF/stackit_service_account.retail_app_ecs_checkout_service_task_role | S1 |
MAN/decommission/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Retire module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | Manual | MAN/cutover/connection/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/export/own-tool, MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/reconcile/own-tool, MAN/decommission/module.retail_app_ecs.module.carts_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role, MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/encryption-at-rest, MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect, MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect, MAN/verify/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, MAN/verify/rollback-decision, TF/stackit_mongodbflex_instance.dynamodb_tables | S1 |
MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_security_group.this | Retire module.retail_app_ecs.module.checkout_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.checkout_service.aws_security_group.this | Manual | MAN/decommission/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, MAN/security/accept/module.retail_app_ecs.module.checkout_service.aws_security_group.this:open-ingress-application-port, MAN/security/attachment-design:module.retail_app_ecs.module.checkout_service.aws_security_group.this, MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_security_group.this/open-settings, MAN/verify/rollback-decision, REF/root/security-group-membership-parity, TF/stackit_security_group.retail_app_ecs_checkout_service_this, TF/stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1 | S1 |
MAN/decommission/module.retail_app_ecs.module.orders_service.aws_ecs_service.this | Retire module.retail_app_ecs.module.orders_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.orders_service.aws_ecs_service.this | Manual | MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this, MAN/draft/handover/cluster-access/kubeconfig-md, MAN/draft/kubernetes/orders/manifests-yaml, MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.execution_role_arn-eacc48, MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.task_role_arn-d0b927, MAN/security/attachment-design:module.retail_app_ecs.module.orders_service.aws_security_group.this, MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-identity-architect, MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-network-architect, MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-platform-architect, MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect, MAN/verify/dns/module.retail_app_ecs.module.orders_service.aws_ecs_service.this, MAN/verify/rollback-decision, TF/stackit_ske_cluster.retail_app_ecs_cluster | S1 |
MAN/decommission/module.retail_app_ecs.aws_ecs_cluster.cluster | Retire module.retail_app_ecs.aws_ecs_cluster.cluster (aws_ecs_cluster) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.aws_ecs_cluster.cluster | Manual | MAN/decommission/module.retail_app_ecs.module.carts_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.orders_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this, MAN/draft/handover/cluster-access/kubeconfig-md, MAN/verify/rollback-decision, TF/stackit_ske_cluster.retail_app_ecs_cluster | S1 |
MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role | Retire module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_additional, module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role | Manual | MAN/decommission/module.retail_app_ecs.module.orders_service.aws_ecs_service.this, MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings, MAN/verify/rollback-decision, TF/stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role, TF/stackit_service_account.retail_app_ecs_orders_service_task_execution_role | S1 |
MAN/decommission/module.retail_app_ecs.aws_kms_key.cmk | Retire module.retail_app_ecs.aws_kms_key.cmk (aws_kms_key) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.aws_kms_key.cmk | Manual | MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role, MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role, MAN/semantic/module.retail_app_ecs.aws_kms_key.cmk/deletion-window, MAN/verify/rollback-decision, TF/stackit_kms_key.retail_app_ecs_cmk, TF/stackit_kms_keyring.migrated | S1 |
MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.mq | Retire module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.mq in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.aws_secretsmanager_secret.mq | Manual | API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.mq, MAN/decommission/module.retail_app_ecs.module.orders_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.mq/secret-value, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.mq/tc-secretsmanager-secret-name, MAN/verify/rollback-decision, TF/stackit_secretsmanager_instance.migrated_secrets, TF/stackit_secretsmanager_user.migration | S1 |
MAN/decommission/module.dependencies.aws_mq_broker.mq | Retire module.dependencies.aws_mq_broker.mq (aws_mq_broker) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.dependencies.aws_mq_broker.mq | Manual | MAN/cutover/messaging-consumers/module.dependencies.aws_mq_broker.mq, MAN/cutover/messaging-drain/module.dependencies.aws_mq_broker.mq, MAN/cutover/module.dependencies.aws_mq_broker.mq, MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.mq, MAN/semantic/module.dependencies.aws_mq_broker.mq/broker-network, MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect, MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect, MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect, MAN/verify/endpoint/module.dependencies.aws_mq_broker.mq, MAN/verify/rollback-decision, TF/stackit_rabbitmq_credential.dependencies_mq, TF/stackit_rabbitmq_instance.dependencies_mq | S1 |
MAN/decommission/module.dependencies.aws_security_group.mq | Retire module.dependencies.aws_security_group.mq (aws_security_group) with its parts module.dependencies.aws_security_group_rule.mq in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.dependencies.aws_security_group.mq | Manual | MAN/decommission/module.dependencies.aws_mq_broker.mq, MAN/semantic/module.dependencies.aws_security_group.mq/open-settings, MAN/verify/rollback-decision, REF/root/security-group-membership-parity | S1 |
MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.orders_db | Retire module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.aws_secretsmanager_secret.orders_db | Manual | API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db, MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.orders_db, MAN/decommission/module.retail_app_ecs.module.orders_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.orders_db/secret-value, MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.orders_db/tc-secretsmanager-secret-name, MAN/verify/rollback-decision, TF/stackit_secretsmanager_instance.migrated_secrets, TF/stackit_secretsmanager_user.migration | S1 |
MAN/decommission/module.dependencies.module.orders_rds.aws_rds_cluster.this | Retire module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) with its parts module.dependencies.module.orders_rds.aws_rds_cluster_instance.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.dependencies.module.orders_rds.aws_rds_cluster.this | Manual | 18 steps: MAN/cutover/connection/module.dependencies.module.orders_rds.aws_rds_cluster.this, MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/dump-restore, MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/logical-replication and 15 more (every predecessor is in execution-plan.json depends_on) | Not ready: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; the source states skip_final_snapshot = true: AWS takes no final snapshot when it is deleted, so the data is gone with it unless a backup was taken before; take the final backup this step needs yourself, before the delete; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this |
MAN/decommission/module.dependencies.module.orders_rds.aws_security_group.this | Retire module.dependencies.module.orders_rds.aws_security_group.this (aws_security_group) with its parts module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.dependencies.module.orders_rds.aws_security_group.this | Manual | MAN/decommission/module.dependencies.module.orders_rds.aws_rds_cluster.this, MAN/semantic/module.dependencies.module.orders_rds.aws_security_group.this/open-settings, MAN/verify/rollback-decision, REF/root/security-group-membership-parity | S1 |
MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role | Retire module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.ecs_exec in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.orders_service.aws_iam_role.task_role | Manual | MAN/decommission/module.retail_app_ecs.module.orders_service.aws_ecs_service.this, MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings, MAN/verify/rollback-decision, TF/stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role, TF/stackit_service_account.retail_app_ecs_orders_service_task_role | S1 |
MAN/decommission/module.retail_app_ecs.module.orders_service.aws_security_group.this | Retire module.retail_app_ecs.module.orders_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.orders_service.aws_security_group.this | Manual | MAN/decommission/module.dependencies.aws_security_group.mq, MAN/decommission/module.dependencies.module.orders_rds.aws_security_group.this, MAN/decommission/module.retail_app_ecs.module.orders_service.aws_ecs_service.this, MAN/security/accept/module.retail_app_ecs.module.orders_service.aws_security_group.this:open-ingress-application-port, MAN/security/attachment-design:module.retail_app_ecs.module.orders_service.aws_security_group.this, MAN/semantic/module.retail_app_ecs.module.orders_service.aws_security_group.this/open-settings, MAN/verify/rollback-decision, REF/root/security-group-membership-parity, TF/stackit_security_group.retail_app_ecs_orders_service_this, TF/stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1 | S1 |
MAN/decommission/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role | Retire module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role | Manual | MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this, MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings, MAN/verify/rollback-decision, TF/stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role, TF/stackit_service_account.retail_app_ecs_ui_service_task_execution_role | S1 |
MAN/decommission/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role | Retire module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.ecs_exec in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.ui_service.aws_iam_role.task_role | Manual | MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this, MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings, MAN/verify/rollback-decision, TF/stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role, TF/stackit_service_account.retail_app_ecs_ui_service_task_role | S1 |
MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | Retire module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (aws_cloudwatch_log_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | Manual | MAN/decommission/module.retail_app_ecs.module.carts_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role, MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role, MAN/decommission/module.retail_app_ecs.module.orders_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role, MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role, MAN/logs/archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks, MAN/logs/label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks, MAN/logs/token:stackit_logs_instance.logs_retention_180d, MAN/verify/rollback-decision, TF/stackit_logs_instance.logs_retention_180d | Not ready: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this, DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS |
MAN/decommission/module.retail_app_ecs.module.ui_service.aws_security_group.this | Retire module.retail_app_ecs.module.ui_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.retail_app_ecs.module.ui_service.aws_security_group.this | Manual | MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this, MAN/security/accept/module.retail_app_ecs.module.ui_service.aws_security_group.this:open-ingress-application-port, MAN/security/attachment-design:module.retail_app_ecs.module.ui_service.aws_security_group.this, MAN/semantic/module.retail_app_ecs.module.ui_service.aws_security_group.this/open-settings, MAN/verify/rollback-decision, REF/root/security-group-membership-parity, TF/stackit_security_group.retail_app_ecs_ui_service_this, TF/stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1 | S1 |
MAN/decommission/module.vpc.module.vpc.aws_route_table.private | Retire module.vpc.module.vpc.aws_route_table.private (aws_route_table) with its parts module.vpc.module.vpc.aws_route.private_nat_gateway, module.vpc.module.vpc.aws_route_table_association.private in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.vpc.module.vpc.aws_route_table.private | Manual | DEC/routing/DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST, MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.private, MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings, MAN/verify/rollback-decision | Not ready: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this, DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST |
MAN/decommission/module.vpc.module.vpc.aws_nat_gateway.this | Retire module.vpc.module.vpc.aws_nat_gateway.this (aws_nat_gateway) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.vpc.module.vpc.aws_nat_gateway.this | Manual | MAN/decommission/module.vpc.module.vpc.aws_route_table.private, MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings, MAN/verify/rollback-decision | Not ready: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this, DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST |
MAN/decommission/module.vpc.module.vpc.aws_eip.nat | Retire module.vpc.module.vpc.aws_eip.nat (aws_eip) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.vpc.module.vpc.aws_eip.nat | Manual | MAN/decommission/module.vpc.module.vpc.aws_nat_gateway.this, MAN/semantic/module.vpc.module.vpc.aws_eip.nat/public-address, MAN/verify/rollback-decision | Not ready: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this, DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST |
MAN/decommission/module.vpc.module.vpc.aws_route_table.public | Retire module.vpc.module.vpc.aws_route_table.public (aws_route_table) with its parts module.vpc.module.vpc.aws_route.public_internet_gateway, module.vpc.module.vpc.aws_route_table_association.public in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.vpc.module.vpc.aws_route_table.public | Manual | MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.public, MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings, MAN/verify/rollback-decision | S1 |
MAN/decommission/module.vpc.module.vpc.aws_internet_gateway.this | Retire module.vpc.module.vpc.aws_internet_gateway.this (aws_internet_gateway) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.vpc.module.vpc.aws_internet_gateway.this | Manual | MAN/decommission/module.vpc.module.vpc.aws_eip.nat, MAN/decommission/module.vpc.module.vpc.aws_nat_gateway.this, MAN/decommission/module.vpc.module.vpc.aws_route_table.public, MAN/semantic/module.vpc.module.vpc.aws_internet_gateway.this/network-topology-boundary, MAN/verify/rollback-decision | Not ready: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this, DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST |
MAN/decommission/module.vpc.module.vpc.aws_subnet.private | Retire module.vpc.module.vpc.aws_subnet.private (aws_subnet) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.vpc.module.vpc.aws_subnet.private | Manual | MAN/decommission/module.dependencies.aws_mq_broker.mq, MAN/decommission/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, MAN/decommission/module.dependencies.module.catalog_rds.aws_rds_cluster.this, MAN/decommission/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, MAN/decommission/module.dependencies.module.orders_rds.aws_rds_cluster.this, MAN/decommission/module.retail_app_ecs.module.carts_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.orders_service.aws_ecs_service.this, MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this, MAN/decommission/module.vpc.module.vpc.aws_route_table.private, MAN/semantic/module.vpc.module.vpc.aws_subnet.private/availability-zone, MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect, MAN/verify/rollback-decision, TF/stackit_network.vpc_vpc_private | Not ready: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for 16 decisions: DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE and 13 more (decision group BS-5a0c205434b4 of execution-plan.json) |
MAN/decommission/module.vpc.module.vpc.aws_subnet.public | Retire module.vpc.module.vpc.aws_subnet.public (aws_subnet) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.vpc.module.vpc.aws_subnet.public | Manual | MAN/decommission/module.retail_app_ecs.module.alb.aws_lb.this, MAN/decommission/module.vpc.module.vpc.aws_nat_gateway.this, MAN/decommission/module.vpc.module.vpc.aws_route_table.public, MAN/semantic/module.vpc.module.vpc.aws_subnet.public/availability-zone, MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect, MAN/verify/rollback-decision, TF/stackit_network.vpc_vpc_public | Not ready: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this, DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION, DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this, DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this, DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST |
MAN/decommission/module.vpc.module.vpc.aws_vpc.this | Retire module.vpc.module.vpc.aws_vpc.this (aws_vpc) with its parts module.vpc.module.vpc.aws_default_network_acl.this, module.vpc.module.vpc.aws_default_route_table.default, module.vpc.module.vpc.aws_default_security_group.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it | module.vpc.module.vpc.aws_vpc.this | Manual | 26 steps: MAN/decommission/module.dependencies.aws_security_group.catalog_opensearch_sg, MAN/decommission/module.dependencies.aws_security_group.mq, MAN/decommission/module.dependencies.module.catalog_rds.aws_security_group.this and 23 more (every predecessor is in execution-plan.json depends_on) | Not ready: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement; it also waits for 16 decisions: DEC-GEN-CONVERT-API-OPT-IN, DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE and 13 more (decision group BS-5a0c205434b4 of execution-plan.json) |