StackToIT Migration Intelligence Workspace

Each line is a number or a list that one of the pages below states in full, and links to it. There is no score here, and nothing on this page means that the estate is safe to migrate.

Biggest blockers

323 to review (307 critical settings, 9 plan decisions, 5 manual actions, 2 plan statements) · 2 defaults to confirm · 1 confirm only (open critical settings, and open decision records of the register)

Critical findings come first; then the findings of warning severity and the critical settings a person decides, the one that concerns the most units first; then the settings the draft already carries, to confirm only, and last the accepted design changes. At most ten are listed.

1. Confirm that every resource names the one network · warning finding · 12 units: The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is generated automatically until then (gate blocker TOPOLOGY:vpc-unproven). · owner: unassigned (a finding records no owner role) · concerns module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this
2. Confirm that the project is the boundary of one network · critical setting, open on 12 units (REVIEW) · owner: Network Architect · concerns module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this · closes when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
3. Decide which networks the security group may be attached to (a STACKIT group has no network scope) · critical setting, open on 12 units (UNSUPPORTED) · owner: Network Architect · concerns module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this · closes when: A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.
4. Review the stateful setting · critical setting, open on 12 units (REVIEW) · owner: Network Architect · concerns module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this · closes when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
5. Review the IAM trust service workload setting · critical setting, open on 10 units (REVIEW) · owner: Identity Architect · concerns module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role, module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role · closes when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
6. Translate the IAM permissions into STACKIT roles · critical setting, open on 10 units (REVIEW) · owner: Identity Architect · concerns module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role, module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role · closes when: A person translates each permission of the attached policies into STACKIT roles on the target resources.
7. Decide who may assume each IAM role · critical setting, open on 10 units (REVIEW) · owner: Identity Architect · concerns module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role, module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role · closes when: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.
8. Confirm the ports of the rules of the security group · critical setting, open on 9 units (LEDGER, REVIEW) · owner: Network Architect · concerns module.dependencies.module.catalog_rds.aws_security_group.this, module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, module.dependencies.module.orders_rds.aws_security_group.this · closes when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
9. Re-state the restricted outbound rules of the security group · warning finding · 8 units: The source restricts egress (the AWS provider removes AWS's default allow-all egress rule; only the listed egress rules apply). Every new STACKIT security group gets two default egress rules, IPv4 and IPv6, with no ip range (any address), no protocol and no port restriction (the test of 2026-10-07, 2026-10-07: API read-back of a new group, docs concepts page), that stackit_security_group (the pinned STACKIT provider) does not manage — as generated, the draft allows all egress. After apply, delete them (stackit security-group rule list / delete --security-group-id <id>), or egress is wider than in the source. · owner: unassigned (a finding records no owner role) · concerns module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_opensearch.aws_security_group.this
10. Sg rule not rendered · warning finding · 6 units: At least one rule of this group is not in the draft as the source has it. The plan withholds it, holds it as a commented-out rule until a value or a decision is filled in, writes it with a fact that decides what it allows not carried exactly, or cannot name it at all because the source has more rules than are visible statically (a dynamic block over a collection, a count or a rule list that is not known until apply, or a list with a hidden member: the plan's INCOMPLETE action says which set and why, the draft's TODO "rules beyond the known set" names it, and only the known rules are drafted). Typical causes: a protocol, port or source whose value is known only at apply time or comes from a root variable; a source group that is a choice between groups or not a group of the draft; a protocol with no STACKIT counterpart; an ICMP type with every code; an ICMP or ICMPv6 rule whose range is of the other IP family (the API answers HTTP 400, the test of 2026-10-08); a tcp or udp rule with a negative port, a port above 65535, a reversed range, or port 0 only (STACKIT stores no port range for 0 to 0, so the rule would match every port). A tcp or udp range that starts at port 0 and ends below 65535 is written from port 1 (the STACKIT API rejects a range that starts at 0; tested on a STACKIT project on 2026-10-07): port 0 itself is not carried. A stackit_security_group_rule without protocol, port_range or source allows everything (the pinned STACKIT provider), so such a rule is never widened; re-create it with the values it needs (the plan names each one). · owner: unassigned (a finding records no owner role) · concerns module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this

… and 107 more groups to review, 1 confirm-only item (see Decisions).

Source assurance warnings

These warnings are about how well the source was read, not about what blocks the migration, so they are not listed among the blockers above. They are not dismissed: each is still a finding group, and the finding stays on every unit it concerns.

• Pin the version of the source provider · warning finding · 93 units: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven, so the knowledge base (checked against 5.100.0) is not taken as proof of it (stated once for the whole estate, with the units it covers and the rest of the words)

Decisions people must take

Decision register: 16 decisions to make (9 plan decisions, 5 manual actions, 2 plan statements, 2 of them with the draft's DEFAULT to confirm or change) · 2 defaults to confirm (other records, no step waits for them) · 48 units to review (308 critical settings: 307 to decide (25 of them are conditional), 1 confirm only). See Decisions.

How much was understood

44 units are counted in the totals. Beside them 8 are decided only when OpenTofu plans (3 off with the defaults of their variables (a variable can switch them on), 5 decided by data OpenTofu reads when it plans) and 41 are switched off; those are not measured. Evidence traces, by kind of entry of the unit list: active units with a block in the draft: 36 of 36 traced (23 from the lines the draft records for them, not from a typed plan); active units with no block in the draft: 5 of 8 traced (3 with nothing to trace); units decided only when OpenTofu plans: 5 of 8 traced (2 from the lines the draft records for them, not from a typed plan); switched-off units: 11 of 41 traced. An entry without a trace is not an entry with nothing open; the unit list says for each why it has none. 36 of 319 critical settings are resolved; 283 are open: a critical setting counts as resolved only when it has been decided, not when it has merely been looked at.

What the target would look like

83 entries of the unit list state a STACKIT target and 10 do not. The services, with the entries of each (Target Fit):

• STACKIT security group: 10 entries
• STACKIT service account for the workload: 10 entries
• STACKIT network: 7 entries
• STACKIT security groups (no stateless NACLs): 7 entries
• STACKIT Kubernetes Engine (SKE): 6 entries
• STACKIT Logs: 6 entries
• not written by this draft (stackit_security_group, stackit_security_group_rule): 5 entries
• STACKIT Secrets Manager: 4 entries
• STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option): 3 entries
• STACKIT Logs access tokens: 2 entries
• STACKIT Observability alert rules: 2 entries
• STACKIT project networking / Network Area (SNA): 2 entries
• implicit (STACKIT network default routing): 2 entries
• STACKIT Application Load Balancer: 1 entry
• STACKIT DNS record set: 1 entry
• STACKIT KMS: 1 entry
• STACKIT Key Value Store (Valkey): 1 entry
• STACKIT MariaDB: 1 entry
• STACKIT OpenSearch: 1 entry
• STACKIT PostgreSQL Flex: 1 entry
• STACKIT RabbitMQ: 1 entry
• STACKIT VPN: 1 entry
• STACKIT network DNS settings: 1 entry
• implicit (STACKIT network default gateway): 1 entry
• implicit (belongs to the NAT gateway): 1 entry
• implicit outbound (STACKIT network): 1 entry
• none - no account guardrail to except a VPC or subnet from: 1 entry
• none - no account guardrail; exposure is set by security groups and by who may attach public IPs: 1 entry
• none - no packet-flow log: a capture on the servers whose records a log shipper sends to a STACKIT Logs instance is a design of its own: 1 entry
• none managed — application events over RabbitMQ: 1 entry

Price coverage, counted in drafted STACKIT resources (not the source resources the cost model counts): of the 11 drafted resources a price rule covers, 6 are priced and 5 are not (stackit_opensearch_instance.dependencies_catalog_opensearch_this, stackit_mariadb_instance.dependencies_catalog_rds_this, stackit_mongodbflex_instance.dynamodb_tables, stackit_kms_key.retail_app_ecs_cmk, stackit_secretsmanager_instance.migrated_secrets; each with its reason in financial/priced-resources.csv); the other 42 drafted resources have no price rule. A resource is priced only where a tested rule joins it to one SKU of the public STACKIT price list; the lines with their quantities, amounts and totals are in financial/cost-model.json and financial/priced-resources.csv; a total is full only when every line of its scope is priced.

What happens next

1. Review the 307 open critical settings: a person decides each (index.html, Decisions page; assurance/critical-semantics.json, critical_semantic_resolution.open). 25 of them belong to units that exist only if a plan-time input holds (critical_semantic_resolution.conditional_open). 1 more is carried by the draft already: confirm only. (see it here)
2. Review the 9 open plan decisions and 5 manual actions of the draft (index.html, Architecture, Deployment prerequisites). Confirm the 2 defaults the draft carries out (index.html, Decisions page): no step waits for the answer, a person confirms each or changes it. (see it here)
3. Review the draft in terraform/: it is a proposal, and an architect has to review it before any use. (see it here)
4. Open index.html in a browser for the unit-by-unit view (offline, nothing is loaded).

The numbers of this run. The console prints the same lines at the end of the run, and engineering/architect-report.md and workspace.json (run_summary) state the same numbers: they are read from one model.

Readiness is shown per dimension. There is no overall score, and no dimension here means that the estate is safe to migrate.

Three states answer three questions. Coverage says how much of what the dimension counts is covered (Covered: all of it); it never says that anything is decided, validated or ready to deploy. Migration decisions is read from the Blockers and Open decisions columns of the same row: a Covered dimension can have blockers. Target validation says what StackToIT’s own checks established about the generated target for that dimension; no STACKIT plan is run, so nothing here means the draft plans or applies.

Semantic Accounting counts the critical settings the assessment accounted for; Critical Resolution counts those that are decided: accounted is not resolved. Terraform Draft Accounting counts the units whose critical settings are accounted for in the draft; it does not say that the draft validates or plans against STACKIT.

The six dimensions of the first screen read the rows of this matrix: Analyzed reads Source Fidelity; Drafted reads Terraform Draft Accounting (the units whose critical settings are accounted for in the draft; Drafted counts the units that have a generated resource); Validated reads the Target validation column; Deployable reads the package state of Migration Execution; Application Ready reads Target Functional Fit and the Operational Readiness row (no application compatibility contract exists in this build); Equivalent reads Semantic Accounting and Critical Resolution (accounted for is not resolved, and resolved is not equivalent). Security, Sovereignty & Exitability and Cost Confidence have pages of their own and no user-first dimension.

105 source files, 282 resources scanned, 109 dependencies between units. Every unit is listed on the Architecture page.

No unit is in the mapping class BLOCKED. That names a class of the mapping, not an absence of blockers: what holds the plan back is counted apart, under Migration readiness and Blockers above.

BLOCKED is also the state of an application (its checklist) and the state of a step of the plan that cannot run; the three are counted apart and none is the sum of the others.

Open decisions: 16 decisions to make (9 plan decisions, 5 manual actions, 2 plan statements, 2 of them with the draft's DEFAULT to confirm or change) · 2 defaults to confirm (other records, no step waits for them) · 48 units to review (308 critical settings: 307 to decide (25 of them are conditional), 1 confirm only). Cost coverage: 44 cost lines (30 of the source, 14 of the target), 5 priced. The estate (140 source resources), priced part: modelled infrastructure subtotal (10 of 140 source resources), SOURCE: none (NONE; 0 priced, 30 not priced and never filled in). The estate (140 source resources), priced part: modelled infrastructure subtotal (10 of 140 source resources), TARGET: 878.34 EUR (PARTIAL; 5 priced, 9 not priced and never filled in). This is an initial infrastructure cost estimate under explicit assumptions (the assumptions), not a bill. See Decisions and Cost.

Partially executable migration package. Steps defined: 314 in the execution plan (53 OpenTofu, 4 STACKIT API, 254 manual, 3 refused). Progress by kind of step: decisions to take: 89 · changes executable now: 73 · waiting: 149; 3 refused (of 314 steps). 48 of the 57 automated steps (OpenTofu or a script) can run now (1 waits for a manual prerequisite, 8 require a design decision) · 9 of those 48 rest on a default you have not confirmed (public endpoint, size derived from the source); a person can start 114 of the 254 manual steps now (4 wait for a manual prerequisite, 71 require a design decision, 65 are not executable as the plan stands); 3 steps are permanently unsupported (refused); 1 step has its verification incomplete: it carries critical settings of the source that no check validates, which a person confirms in the draft. See Migration Execution. The execution package starts at execution/README.md. The order of the work and what the STACKIT project has to provide first are in migration/roadmap.md and migration/landing-zone-requirements.md.