{"schema_version":"0.24.0","producer":{"tool":"stacktoit","version":"0.6.0-11562-g1966ddf116","commit":"1966ddf116","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","stackit_provider":"0.121.0"},"run":{"run_id":"f6267c3f-2848-4aa5-89df-5fee8b15b3b9","source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70"},"generated_at":"2026-11-02T12:08:24Z","source":"default","summary":{"files":105,"resources":282,"units":44,"instances":44,"unknown_count":8,"disabled":41,"presence":{"known_present":44,"conditional":8,"absent":41,"uncertain_facets":0,"instances_known":44,"instances_open":8,"units_with_conditional_facets":5,"conditional_by_state":{"present_on_defaults":0,"disabled_on_defaults_but_overridable":3,"runtime_data_unknown":5,"variable_unknown":0,"undecided_other_cause":0}},"conditional_units":[{"id":"module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events","source_type":"aws_cloudwatch_event_rule","module_call":"module.retail_app_ecs","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"(var.container_insights_setting == \"enhanced\" \u0026\u0026 var.lifecycle_events_enabled) ? 1 : 0","variables":["var.container_insights_setting","var.lifecycle_events_enabled"]},"would_be_class":"REDESIGN","would_be_confidence":"MEDIUM","target":"none managed — application events over RabbitMQ","state":"DISABLED_ON_DEFAULTS_BUT_OVERRIDABLE","state_inputs":["var.container_insights_setting","var.lifecycle_events_enabled"],"overridden_by":["-var-file","-var","TF_VAR_container_insights_setting","TF_VAR_lifecycle_events_enabled"]},{"id":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights","source_type":"aws_cloudwatch_log_group","module_call":"module.retail_app_ecs","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"(var.container_insights_setting == \"enhanced\" \u0026\u0026 var.lifecycle_events_enabled) ? 1 : 0","variables":["var.container_insights_setting","var.lifecycle_events_enabled"]},"would_be_class":"RECONFIGURE","would_be_confidence":"MEDIUM","target":"STACKIT Logs","state":"DISABLED_ON_DEFAULTS_BUT_OVERRIDABLE","state_inputs":["var.container_insights_setting","var.lifecycle_events_enabled"],"overridden_by":["-var-file","-var","TF_VAR_container_insights_setting","TF_VAR_lifecycle_events_enabled"]},{"id":"module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs","source_type":"aws_cloudwatch_log_resource_policy","module_call":"module.retail_app_ecs","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"(var.container_insights_setting == \"enhanced\" \u0026\u0026 var.lifecycle_events_enabled) ? 1 : 0","variables":["var.container_insights_setting","var.lifecycle_events_enabled"]},"would_be_class":"RECONFIGURE","would_be_confidence":"LOW","target":"STACKIT Logs access tokens","state":"DISABLED_ON_DEFAULTS_BUT_OVERRIDABLE","state_inputs":["var.container_insights_setting","var.lifecycle_events_enabled"],"overridden_by":["-var-file","-var","TF_VAR_container_insights_setting","TF_VAR_lifecycle_events_enabled"]},{"id":"module.vpc.module.vpc.aws_internet_gateway.this","source_type":"aws_internet_gateway","module_call":"module.vpc.module.vpc","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_public_subnets \u0026\u0026 var.create_igw ? 1 : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":1},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"would_be_class":"RECONFIGURE","would_be_confidence":"MEDIUM","target":"implicit (STACKIT network default gateway)","depended_on_by":["module.vpc.module.vpc.aws_eip.nat","module.vpc.module.vpc.aws_nat_gateway.this","module.vpc.module.vpc.aws_route_table.public"],"state":"RUNTIME_DATA_UNKNOWN","state_inputs":["module.vpc.data.aws_availability_zones.available"]},{"id":"module.vpc.module.vpc.aws_route_table.private","source_type":"aws_route_table","module_call":"module.vpc.module.vpc","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_private_subnets \u0026\u0026 local.max_subnet_length \u003e 0 ? local.nat_gateway_count : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":1},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"would_be_class":"RECONFIGURE","would_be_confidence":"LOW","target":"implicit (STACKIT network default routing)","state":"RUNTIME_DATA_UNKNOWN","state_inputs":["module.vpc.data.aws_availability_zones.available"]},{"id":"module.vpc.module.vpc.aws_route_table.public","source_type":"aws_route_table","module_call":"module.vpc.module.vpc","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_public_subnets ? local.num_public_route_tables : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":1},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"would_be_class":"RECONFIGURE","would_be_confidence":"MEDIUM","target":"implicit (STACKIT network default routing)","state":"RUNTIME_DATA_UNKNOWN","state_inputs":["module.vpc.data.aws_availability_zones.available"]},{"id":"module.vpc.module.vpc.aws_subnet.private","source_type":"aws_subnet","module_call":"module.vpc.module.vpc","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_private_subnets ? local.len_private_subnets : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":3},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"would_be_class":"RECONFIGURE","would_be_confidence":"MEDIUM","target":"STACKIT network","depended_on_by":["module.dependencies.aws_mq_broker.mq","module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","module.dependencies.module.catalog_rds.aws_rds_cluster.this","module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","module.dependencies.module.orders_rds.aws_rds_cluster.this","module.retail_app_ecs.module.carts_service.aws_ecs_service.this","module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","module.retail_app_ecs.module.orders_service.aws_ecs_service.this","module.retail_app_ecs.module.ui_service.aws_ecs_service.this","module.vpc.module.vpc.aws_route_table.private"],"state":"RUNTIME_DATA_UNKNOWN","state_inputs":["module.vpc.data.aws_availability_zones.available"]},{"id":"module.vpc.module.vpc.aws_subnet.public","source_type":"aws_subnet","module_call":"module.vpc.module.vpc","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_public_subnets \u0026\u0026 (!var.one_nat_gateway_per_az || local.len_public_subnets \u003e= length(var.azs)) ? local.len_public_subnets : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":3},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"would_be_class":"RECONFIGURE","would_be_confidence":"MEDIUM","target":"STACKIT network","depended_on_by":["module.retail_app_ecs.module.alb.aws_lb.this","module.vpc.module.vpc.aws_nat_gateway.this","module.vpc.module.vpc.aws_route_table.public"],"state":"RUNTIME_DATA_UNKNOWN","state_inputs":["module.vpc.data.aws_availability_zones.available"]}],"switched_off_by_default":[{"id":"module.retail_app_ecs.aws_cloudwatch_event_target.ecs_events_target","source_type":"aws_cloudwatch_event_target","module_call":"module.retail_app_ecs","carried_by":"module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"(var.container_insights_setting == \"enhanced\" \u0026\u0026 var.lifecycle_events_enabled) ? 1 : 0","variables":["var.container_insights_setting","var.lifecycle_events_enabled"]}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_agent","source_type":"aws_iam_policy","module_call":"module.retail_app_ecs.module.carts_service","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_agent","source_type":"aws_iam_role_policy_attachment","module_call":"module.retail_app_ecs.module.carts_service","carried_by":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_agent","source_type":"aws_iam_policy","module_call":"module.retail_app_ecs.module.catalog_service","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_agent","source_type":"aws_iam_role_policy_attachment","module_call":"module.retail_app_ecs.module.catalog_service","carried_by":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_agent","source_type":"aws_iam_policy","module_call":"module.retail_app_ecs.module.checkout_service","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_agent","source_type":"aws_iam_role_policy_attachment","module_call":"module.retail_app_ecs.module.checkout_service","carried_by":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_agent","source_type":"aws_iam_policy","module_call":"module.retail_app_ecs.module.orders_service","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_agent","source_type":"aws_iam_role_policy_attachment","module_call":"module.retail_app_ecs.module.orders_service","carried_by":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_agent","source_type":"aws_iam_policy","module_call":"module.retail_app_ecs.module.ui_service","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_agent","source_type":"aws_iam_role_policy_attachment","module_call":"module.retail_app_ecs.module.ui_service","carried_by":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]}}],"module_rollups":[{"address":"module.dependencies","source":"../../lib/dependencies","source_kind":"local","dir":"../../lib/dependencies","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":77,"support":17,"by_presence":{"known_present":11,"conditional":0,"absent":13,"uncertain_facets":0},"units":11,"by_class":{"RECONFIGURE":7,"REDESIGN":1,"REPLATFORM":3},"by_confidence":{"LOW":2,"MEDIUM":9},"worst_class":"REDESIGN","worst_confidence":"LOW","targets":["STACKIT Key Value Store (Valkey)","STACKIT MariaDB","STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","STACKIT OpenSearch","STACKIT PostgreSQL Flex","STACKIT RabbitMQ","STACKIT security group"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["COMPLIANCE","FEATURE","NETWORK","UNKNOWN"],"waves":[1,3,4],"nested_calls":["module.dependencies.module.catalog_opensearch","module.dependencies.module.catalog_rds","module.dependencies.module.checkout_elasticache_redis","module.dependencies.module.dynamodb_carts","module.dependencies.module.orders_rds"],"depends_on_calls":["module.retail_app_ecs","module.retail_app_ecs.module.catalog_service","module.retail_app_ecs.module.checkout_service","module.retail_app_ecs.module.orders_service","module.vpc","module.vpc.module.vpc"],"depended_on_by_calls":["module.retail_app_ecs","module.retail_app_ecs.module.carts_service","module.retail_app_ecs.module.catalog_service","module.retail_app_ecs.module.checkout_service"],"internals":["module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","module.dependencies.aws_security_group.catalog_opensearch_sg","module.dependencies.aws_security_group.mq","module.dependencies.module.catalog_rds.aws_security_group.this","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","module.dependencies.module.orders_rds.aws_security_group.this","module.dependencies.aws_mq_broker.mq","module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","module.dependencies.module.catalog_rds.aws_rds_cluster.this","module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","module.dependencies.module.orders_rds.aws_rds_cluster.this","module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this","module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_resource_policy.this","module.dependencies.module.catalog_opensearch.aws_security_group.this","module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this","module.dependencies.module.catalog_rds.aws_iam_role.rds_enhanced_monitoring","module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu","module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default","module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default","module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this","module.dependencies.module.orders_rds.aws_iam_role.rds_enhanced_monitoring"]},{"address":"module.dependencies.module.catalog_opensearch","parent":"module.dependencies","source":"terraform-aws-modules/opensearch/aws","source_kind":"registry","version_constraint":"1.5.0","version_resolved":"1.5.0","dir":".terraform/modules/dependencies.catalog_opensearch","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":11,"support":0,"by_presence":{"known_present":1,"conditional":0,"absent":3,"uncertain_facets":0},"units":1,"by_class":{"REPLATFORM":1},"by_confidence":{"LOW":1},"worst_class":"REPLATFORM","worst_confidence":"LOW","targets":["STACKIT OpenSearch"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["FEATURE","UNKNOWN"],"waves":[4],"depends_on_calls":["module.vpc","module.vpc.module.vpc"],"depended_on_by_calls":["module.retail_app_ecs","module.retail_app_ecs.module.catalog_service"],"internals":["module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this","module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_resource_policy.this","module.dependencies.module.catalog_opensearch.aws_security_group.this"]},{"address":"module.dependencies.module.catalog_rds","parent":"module.dependencies","source":"terraform-aws-modules/rds-aurora/aws","source_kind":"registry","version_constraint":"7.7.1","version_resolved":"7.7.1","dir":".terraform/modules/dependencies.catalog_rds","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":18,"support":5,"by_presence":{"known_present":2,"conditional":0,"absent":2,"uncertain_facets":0},"units":2,"by_class":{"RECONFIGURE":1,"REPLATFORM":1},"by_confidence":{"LOW":1,"MEDIUM":1},"worst_class":"REPLATFORM","worst_confidence":"LOW","targets":["STACKIT MariaDB","STACKIT security group"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["COMPLIANCE","FEATURE","NETWORK","UNKNOWN"],"waves":[3,4],"depends_on_calls":["module.retail_app_ecs","module.retail_app_ecs.module.catalog_service","module.vpc","module.vpc.module.vpc"],"depended_on_by_calls":["module.retail_app_ecs"],"internals":["module.dependencies.module.catalog_rds.aws_security_group.this","module.dependencies.module.catalog_rds.aws_rds_cluster.this","module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this","module.dependencies.module.catalog_rds.aws_iam_role.rds_enhanced_monitoring"]},{"address":"module.dependencies.module.checkout_elasticache_redis","parent":"module.dependencies","source":"cloudposse/elasticache-redis/aws","source_kind":"registry","version_constraint":"0.53.0","version_resolved":"0.53.0","dir":".terraform/modules/dependencies.checkout_elasticache_redis","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":9,"support":2,"by_presence":{"known_present":2,"conditional":0,"absent":4,"uncertain_facets":0},"units":2,"by_class":{"RECONFIGURE":2},"by_confidence":{"MEDIUM":2},"worst_class":"RECONFIGURE","worst_confidence":"MEDIUM","targets":["STACKIT Key Value Store (Valkey)","STACKIT security group"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["FEATURE","NETWORK","UNKNOWN"],"waves":[3,4],"nested_calls":["module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","module.dependencies.module.checkout_elasticache_redis.module.dns","module.dependencies.module.checkout_elasticache_redis.module.this"],"depends_on_calls":["module.retail_app_ecs","module.retail_app_ecs.module.checkout_service","module.vpc","module.vpc.module.vpc"],"depended_on_by_calls":["module.retail_app_ecs","module.retail_app_ecs.module.checkout_service"],"internals":["module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu","module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default","module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default"]},{"address":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","parent":"module.dependencies.module.checkout_elasticache_redis","source":"cloudposse/security-group/aws","source_kind":"registry","version_constraint":"1.0.1","version_resolved":"1.0.1","dir":".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":3,"support":0,"by_presence":{"known_present":1,"conditional":0,"absent":1,"uncertain_facets":0},"units":1,"by_class":{"RECONFIGURE":1},"by_confidence":{"MEDIUM":1},"worst_class":"RECONFIGURE","worst_confidence":"MEDIUM","targets":["STACKIT security group"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["NETWORK","UNKNOWN"],"waves":[3],"nested_calls":["module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.module.this"],"depends_on_calls":["module.retail_app_ecs","module.retail_app_ecs.module.checkout_service","module.vpc","module.vpc.module.vpc"],"internals":["module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default"]},{"address":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.module.this","parent":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","source":"cloudposse/label/null","source_kind":"registry","version_constraint":"0.25.0","version_resolved":"0.25.0","dir":".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group.this","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":0,"support":0,"by_presence":{"known_present":0,"conditional":0,"absent":0,"uncertain_facets":0},"units":0,"by_class":{},"by_confidence":{},"production_eligible":0,"automation_eligible":0},{"address":"module.dependencies.module.checkout_elasticache_redis.module.dns","parent":"module.dependencies.module.checkout_elasticache_redis","source":"cloudposse/route53-cluster-hostname/aws","source_kind":"registry","version_constraint":"0.12.2","version_resolved":"0.12.2","dir":".terraform/modules/dependencies.checkout_elasticache_redis.dns","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":1,"support":0,"by_presence":{"known_present":0,"conditional":0,"absent":1,"uncertain_facets":0},"units":0,"by_class":{},"by_confidence":{},"production_eligible":0,"automation_eligible":0,"nested_calls":["module.dependencies.module.checkout_elasticache_redis.module.dns.module.this"],"internals":["module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default"]},{"address":"module.dependencies.module.checkout_elasticache_redis.module.dns.module.this","parent":"module.dependencies.module.checkout_elasticache_redis.module.dns","source":"cloudposse/label/null","source_kind":"registry","version_constraint":"0.25.0","version_resolved":"0.25.0","dir":".terraform/modules/dependencies.checkout_elasticache_redis.dns.this","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":0,"support":0,"by_presence":{"known_present":0,"conditional":0,"absent":0,"uncertain_facets":0},"units":0,"by_class":{},"by_confidence":{},"production_eligible":0,"automation_eligible":0},{"address":"module.dependencies.module.checkout_elasticache_redis.module.this","parent":"module.dependencies.module.checkout_elasticache_redis","source":"cloudposse/label/null","source_kind":"registry","version_constraint":"0.25.0","version_resolved":"0.25.0","dir":".terraform/modules/dependencies.checkout_elasticache_redis.this","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":0,"support":0,"by_presence":{"known_present":0,"conditional":0,"absent":0,"uncertain_facets":0},"units":0,"by_class":{},"by_confidence":{},"production_eligible":0,"automation_eligible":0},{"address":"module.dependencies.module.dynamodb_carts","parent":"module.dependencies","source":"terraform-aws-modules/dynamodb-table/aws","source_kind":"registry","version_constraint":"3.3.0","version_resolved":"3.3.0","dir":".terraform/modules/dependencies.dynamodb_carts","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":11,"support":0,"by_presence":{"known_present":1,"conditional":0,"absent":2,"uncertain_facets":0},"units":1,"by_class":{"REDESIGN":1},"by_confidence":{"MEDIUM":1},"worst_class":"REDESIGN","worst_confidence":"MEDIUM","targets":["STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["FEATURE","UNKNOWN"],"waves":[1],"depended_on_by_calls":["module.retail_app_ecs","module.retail_app_ecs.module.carts_service"],"internals":["module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore"]},{"address":"module.dependencies.module.orders_rds","parent":"module.dependencies","source":"terraform-aws-modules/rds-aurora/aws","source_kind":"registry","version_constraint":"7.7.1","version_resolved":"7.7.1","dir":".terraform/modules/dependencies.orders_rds","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":18,"support":5,"by_presence":{"known_present":2,"conditional":0,"absent":2,"uncertain_facets":0},"units":2,"by_class":{"RECONFIGURE":1,"REPLATFORM":1},"by_confidence":{"MEDIUM":2},"worst_class":"REPLATFORM","worst_confidence":"MEDIUM","targets":["STACKIT PostgreSQL Flex","STACKIT security group"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["COMPLIANCE","FEATURE","NETWORK","UNKNOWN"],"waves":[3,4],"depends_on_calls":["module.retail_app_ecs","module.retail_app_ecs.module.orders_service","module.vpc","module.vpc.module.vpc"],"depended_on_by_calls":["module.retail_app_ecs"],"internals":["module.dependencies.module.orders_rds.aws_security_group.this","module.dependencies.module.orders_rds.aws_rds_cluster.this","module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this","module.dependencies.module.orders_rds.aws_iam_role.rds_enhanced_monitoring"]},{"address":"module.retail_app_ecs","source":"../../lib/ecs","source_kind":"local","dir":"../../lib/ecs","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":126,"support":24,"by_presence":{"known_present":30,"conditional":3,"absent":3,"uncertain_facets":0},"units":30,"by_class":{"RECONFIGURE":24,"REPLATFORM":6},"by_confidence":{"LOW":7,"MEDIUM":23},"worst_class":"REPLATFORM","worst_confidence":"LOW","targets":["STACKIT Application Load Balancer","STACKIT KMS","STACKIT Kubernetes Engine (SKE)","STACKIT Logs","STACKIT Secrets Manager","STACKIT security group","STACKIT service account for the workload"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["COMPLIANCE","FEATURE","IDENTITY","NETWORK","UNKNOWN"],"waves":[1,2,3,5,6,7,8,9],"nested_calls":["module.retail_app_ecs.module.alb","module.retail_app_ecs.module.alb_sg","module.retail_app_ecs.module.carts_service","module.retail_app_ecs.module.catalog_service","module.retail_app_ecs.module.checkout_service","module.retail_app_ecs.module.container_images","module.retail_app_ecs.module.orders_service","module.retail_app_ecs.module.ui_service"],"depends_on_calls":["module.dependencies","module.dependencies.module.catalog_opensearch","module.dependencies.module.catalog_rds","module.dependencies.module.checkout_elasticache_redis","module.dependencies.module.dynamodb_carts","module.dependencies.module.orders_rds","module.vpc","module.vpc.module.vpc"],"depended_on_by_calls":["module.dependencies","module.dependencies.module.catalog_rds","module.dependencies.module.checkout_elasticache_redis","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","module.dependencies.module.orders_rds"],"internals":["module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","module.retail_app_ecs.aws_ecs_cluster.cluster","module.retail_app_ecs.aws_kms_key.cmk","module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","module.retail_app_ecs.module.alb.aws_security_group.this","module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","module.retail_app_ecs.module.carts_service.aws_security_group.this","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","module.retail_app_ecs.module.catalog_service.aws_security_group.this","module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","module.retail_app_ecs.module.checkout_service.aws_security_group.this","module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","module.retail_app_ecs.module.orders_service.aws_security_group.this","module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","module.retail_app_ecs.module.ui_service.aws_security_group.this","module.retail_app_ecs.module.alb.aws_lb.this","module.retail_app_ecs.module.carts_service.aws_ecs_service.this","module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","module.retail_app_ecs.aws_secretsmanager_secret.mq","module.retail_app_ecs.aws_secretsmanager_secret.orders_db","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","module.retail_app_ecs.module.orders_service.aws_ecs_service.this","module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","module.retail_app_ecs.module.ui_service.aws_ecs_service.this","module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events","module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights","module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs","module.retail_app_ecs.module.alb.aws_lambda_permission.lb","module.retail_app_ecs.module.alb.aws_wafv2_web_acl_association.this","module.retail_app_ecs.module.alb_sg.aws_security_group.this"]},{"address":"module.retail_app_ecs.module.alb","parent":"module.retail_app_ecs","source":"terraform-aws-modules/alb/aws","source_kind":"registry","version_constraint":"~\u003e 8.0","version_resolved":"8.7.0","dir":".terraform/modules/retail_app_ecs.alb","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":12,"support":2,"by_presence":{"known_present":2,"conditional":0,"absent":2,"uncertain_facets":0},"units":2,"by_class":{"RECONFIGURE":2},"by_confidence":{"MEDIUM":2},"worst_class":"RECONFIGURE","worst_confidence":"MEDIUM","targets":["STACKIT Application Load Balancer","STACKIT security group"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["NETWORK","UNKNOWN"],"waves":[2,3],"depends_on_calls":["module.retail_app_ecs.module.alb_sg","module.vpc","module.vpc.module.vpc"],"depended_on_by_calls":["module.retail_app_ecs.module.ui_service"],"internals":["module.retail_app_ecs.module.alb.aws_security_group.this","module.retail_app_ecs.module.alb.aws_lb.this","module.retail_app_ecs.module.alb.aws_lambda_permission.lb","module.retail_app_ecs.module.alb.aws_wafv2_web_acl_association.this"]},{"address":"module.retail_app_ecs.module.alb_sg","parent":"module.retail_app_ecs","source":"terraform-aws-modules/security-group/aws","source_kind":"registry","version_constraint":"~\u003e 4.0","version_resolved":"4.17.2","dir":".terraform/modules/retail_app_ecs.alb_sg","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":22,"support":0,"by_presence":{"known_present":1,"conditional":0,"absent":1,"uncertain_facets":0},"units":1,"by_class":{"RECONFIGURE":1},"by_confidence":{"MEDIUM":1},"worst_class":"RECONFIGURE","worst_confidence":"MEDIUM","targets":["STACKIT security group"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["NETWORK","UNKNOWN"],"waves":[2],"depends_on_calls":["module.vpc","module.vpc.module.vpc"],"depended_on_by_calls":["module.retail_app_ecs.module.alb"],"internals":["module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","module.retail_app_ecs.module.alb_sg.aws_security_group.this"]},{"address":"module.retail_app_ecs.module.carts_service","parent":"module.retail_app_ecs","source":"./service","source_kind":"local","dir":"../../lib/ecs/service","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":14,"support":3,"by_presence":{"known_present":4,"conditional":0,"absent":0,"uncertain_facets":0},"units":4,"by_class":{"RECONFIGURE":3,"REPLATFORM":1},"by_confidence":{"LOW":2,"MEDIUM":2},"worst_class":"REPLATFORM","worst_confidence":"LOW","targets":["STACKIT Kubernetes Engine (SKE)","STACKIT security group","STACKIT service account for the workload"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["FEATURE","IDENTITY","NETWORK","UNKNOWN"],"waves":[1,2,3],"depends_on_calls":["module.dependencies","module.dependencies.module.dynamodb_carts","module.vpc","module.vpc.module.vpc"],"depended_on_by_calls":["module.retail_app_ecs.module.ui_service"],"internals":["module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","module.retail_app_ecs.module.carts_service.aws_security_group.this","module.retail_app_ecs.module.carts_service.aws_ecs_service.this"]},{"address":"module.retail_app_ecs.module.catalog_service","parent":"module.retail_app_ecs","source":"./service","source_kind":"local","dir":"../../lib/ecs/service","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":14,"support":3,"by_presence":{"known_present":4,"conditional":0,"absent":0,"uncertain_facets":0},"units":4,"by_class":{"RECONFIGURE":3,"REPLATFORM":1},"by_confidence":{"LOW":2,"MEDIUM":2},"worst_class":"REPLATFORM","worst_confidence":"LOW","targets":["STACKIT Kubernetes Engine (SKE)","STACKIT security group","STACKIT service account for the workload"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["FEATURE","IDENTITY","NETWORK","UNKNOWN"],"waves":[2,6,7],"depends_on_calls":["module.dependencies","module.dependencies.module.catalog_opensearch","module.vpc","module.vpc.module.vpc"],"depended_on_by_calls":["module.dependencies","module.dependencies.module.catalog_rds","module.retail_app_ecs.module.ui_service"],"internals":["module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","module.retail_app_ecs.module.catalog_service.aws_security_group.this","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.catalog_service.aws_ecs_service.this"]},{"address":"module.retail_app_ecs.module.checkout_service","parent":"module.retail_app_ecs","source":"./service","source_kind":"local","dir":"../../lib/ecs/service","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":14,"support":3,"by_presence":{"known_present":4,"conditional":0,"absent":0,"uncertain_facets":0},"units":4,"by_class":{"RECONFIGURE":3,"REPLATFORM":1},"by_confidence":{"LOW":1,"MEDIUM":3},"worst_class":"REPLATFORM","worst_confidence":"LOW","targets":["STACKIT Kubernetes Engine (SKE)","STACKIT security group","STACKIT service account for the workload"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["FEATURE","IDENTITY","NETWORK","UNKNOWN"],"waves":[1,2,8],"depends_on_calls":["module.dependencies","module.dependencies.module.checkout_elasticache_redis","module.retail_app_ecs.module.orders_service","module.vpc","module.vpc.module.vpc"],"depended_on_by_calls":["module.dependencies","module.dependencies.module.checkout_elasticache_redis","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","module.retail_app_ecs.module.ui_service"],"internals":["module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","module.retail_app_ecs.module.checkout_service.aws_security_group.this","module.retail_app_ecs.module.checkout_service.aws_ecs_service.this"]},{"address":"module.retail_app_ecs.module.container_images","parent":"module.retail_app_ecs","source":"../images","source_kind":"local","dir":"../../lib/images","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":0,"support":0,"by_presence":{"known_present":0,"conditional":0,"absent":0,"uncertain_facets":0},"units":0,"by_class":{},"by_confidence":{},"production_eligible":0,"automation_eligible":0},{"address":"module.retail_app_ecs.module.orders_service","parent":"module.retail_app_ecs","source":"./service","source_kind":"local","dir":"../../lib/ecs/service","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":14,"support":3,"by_presence":{"known_present":4,"conditional":0,"absent":0,"uncertain_facets":0},"units":4,"by_class":{"RECONFIGURE":3,"REPLATFORM":1},"by_confidence":{"LOW":2,"MEDIUM":2},"worst_class":"REPLATFORM","worst_confidence":"LOW","targets":["STACKIT Kubernetes Engine (SKE)","STACKIT security group","STACKIT service account for the workload"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["FEATURE","IDENTITY","NETWORK","UNKNOWN"],"waves":[2,6,7],"depends_on_calls":["module.vpc","module.vpc.module.vpc"],"depended_on_by_calls":["module.dependencies","module.dependencies.module.orders_rds","module.retail_app_ecs.module.checkout_service","module.retail_app_ecs.module.ui_service"],"internals":["module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","module.retail_app_ecs.module.orders_service.aws_security_group.this","module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.orders_service.aws_ecs_service.this"]},{"address":"module.retail_app_ecs.module.ui_service","parent":"module.retail_app_ecs","source":"./service","source_kind":"local","dir":"../../lib/ecs/service","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":14,"support":3,"by_presence":{"known_present":4,"conditional":0,"absent":0,"uncertain_facets":0},"units":4,"by_class":{"RECONFIGURE":3,"REPLATFORM":1},"by_confidence":{"MEDIUM":4},"worst_class":"REPLATFORM","worst_confidence":"MEDIUM","targets":["STACKIT Kubernetes Engine (SKE)","STACKIT security group","STACKIT service account for the workload"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["FEATURE","IDENTITY","NETWORK","UNKNOWN"],"waves":[1,2,9],"depends_on_calls":["module.retail_app_ecs.module.alb","module.retail_app_ecs.module.carts_service","module.retail_app_ecs.module.catalog_service","module.retail_app_ecs.module.checkout_service","module.retail_app_ecs.module.orders_service","module.vpc","module.vpc.module.vpc"],"internals":["module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","module.retail_app_ecs.module.ui_service.aws_security_group.this","module.retail_app_ecs.module.ui_service.aws_ecs_service.this"]},{"address":"module.tags","source":"../../lib/tags","source_kind":"local","dir":"../../lib/tags","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":0,"support":0,"by_presence":{"known_present":0,"conditional":0,"absent":0,"uncertain_facets":0},"units":0,"by_class":{},"by_confidence":{},"production_eligible":0,"automation_eligible":0},{"address":"module.vpc","source":"../../lib/vpc","source_kind":"local","dir":"../../lib/vpc","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":79,"support":5,"by_presence":{"known_present":3,"conditional":5,"absent":25,"uncertain_facets":0},"units":3,"by_class":{"RECONFIGURE":3},"by_confidence":{"MEDIUM":3},"worst_class":"RECONFIGURE","worst_confidence":"MEDIUM","targets":["STACKIT project networking / Network Area (SNA)","implicit (belongs to the NAT gateway)","implicit outbound (STACKIT network)"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["NETWORK","UNKNOWN"],"waves":[1,2],"nested_calls":["module.vpc.module.vpc"],"depended_on_by_calls":["module.dependencies","module.dependencies.module.catalog_opensearch","module.dependencies.module.catalog_rds","module.dependencies.module.checkout_elasticache_redis","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","module.dependencies.module.orders_rds","module.retail_app_ecs","module.retail_app_ecs.module.alb","module.retail_app_ecs.module.alb_sg","module.retail_app_ecs.module.carts_service","module.retail_app_ecs.module.catalog_service","module.retail_app_ecs.module.checkout_service","module.retail_app_ecs.module.orders_service","module.retail_app_ecs.module.ui_service"],"internals":["module.vpc.module.vpc.aws_eip.nat","module.vpc.module.vpc.aws_vpc.this","module.vpc.module.vpc.aws_nat_gateway.this","module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log","module.vpc.module.vpc.aws_default_vpc.this","module.vpc.module.vpc.aws_flow_log.this","module.vpc.module.vpc.aws_iam_role.vpc_flow_log_cloudwatch","module.vpc.module.vpc.aws_internet_gateway.this","module.vpc.module.vpc.aws_network_acl.database","module.vpc.module.vpc.aws_network_acl.elasticache","module.vpc.module.vpc.aws_network_acl.intra","module.vpc.module.vpc.aws_network_acl.outpost","module.vpc.module.vpc.aws_network_acl.private","module.vpc.module.vpc.aws_network_acl.public","module.vpc.module.vpc.aws_network_acl.redshift","module.vpc.module.vpc.aws_route_table.database","module.vpc.module.vpc.aws_route_table.elasticache","module.vpc.module.vpc.aws_route_table.intra","module.vpc.module.vpc.aws_route_table.private","module.vpc.module.vpc.aws_route_table.public","module.vpc.module.vpc.aws_route_table.redshift","module.vpc.module.vpc.aws_subnet.database","module.vpc.module.vpc.aws_subnet.elasticache","module.vpc.module.vpc.aws_subnet.intra","module.vpc.module.vpc.aws_subnet.outpost","module.vpc.module.vpc.aws_subnet.private","module.vpc.module.vpc.aws_subnet.public","module.vpc.module.vpc.aws_subnet.redshift","module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","module.vpc.module.vpc.aws_vpc_block_public_access_options.this","module.vpc.module.vpc.aws_vpc_dhcp_options.this","module.vpc.module.vpc.aws_vpn_gateway.this","module.vpc.module.vpc.aws_vpn_gateway_attachment.this"]},{"address":"module.vpc.module.vpc","parent":"module.vpc","source":"terraform-aws-modules/vpc/aws","source_kind":"registry","version_constraint":"5.21.0","version_resolved":"5.21.0","dir":".terraform/modules/vpc.vpc","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":79,"support":5,"by_presence":{"known_present":3,"conditional":5,"absent":25,"uncertain_facets":0},"units":3,"by_class":{"RECONFIGURE":3},"by_confidence":{"MEDIUM":3},"worst_class":"RECONFIGURE","worst_confidence":"MEDIUM","targets":["STACKIT project networking / Network Area (SNA)","implicit (belongs to the NAT gateway)","implicit outbound (STACKIT network)"],"production_eligible":0,"automation_eligible":0,"blocker_categories":["NETWORK","UNKNOWN"],"waves":[1,2],"depended_on_by_calls":["module.dependencies","module.dependencies.module.catalog_opensearch","module.dependencies.module.catalog_rds","module.dependencies.module.checkout_elasticache_redis","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","module.dependencies.module.orders_rds","module.retail_app_ecs","module.retail_app_ecs.module.alb","module.retail_app_ecs.module.alb_sg","module.retail_app_ecs.module.carts_service","module.retail_app_ecs.module.catalog_service","module.retail_app_ecs.module.checkout_service","module.retail_app_ecs.module.orders_service","module.retail_app_ecs.module.ui_service"],"internals":["module.vpc.module.vpc.aws_eip.nat","module.vpc.module.vpc.aws_vpc.this","module.vpc.module.vpc.aws_nat_gateway.this","module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log","module.vpc.module.vpc.aws_default_vpc.this","module.vpc.module.vpc.aws_flow_log.this","module.vpc.module.vpc.aws_iam_role.vpc_flow_log_cloudwatch","module.vpc.module.vpc.aws_internet_gateway.this","module.vpc.module.vpc.aws_network_acl.database","module.vpc.module.vpc.aws_network_acl.elasticache","module.vpc.module.vpc.aws_network_acl.intra","module.vpc.module.vpc.aws_network_acl.outpost","module.vpc.module.vpc.aws_network_acl.private","module.vpc.module.vpc.aws_network_acl.public","module.vpc.module.vpc.aws_network_acl.redshift","module.vpc.module.vpc.aws_route_table.database","module.vpc.module.vpc.aws_route_table.elasticache","module.vpc.module.vpc.aws_route_table.intra","module.vpc.module.vpc.aws_route_table.private","module.vpc.module.vpc.aws_route_table.public","module.vpc.module.vpc.aws_route_table.redshift","module.vpc.module.vpc.aws_subnet.database","module.vpc.module.vpc.aws_subnet.elasticache","module.vpc.module.vpc.aws_subnet.intra","module.vpc.module.vpc.aws_subnet.outpost","module.vpc.module.vpc.aws_subnet.private","module.vpc.module.vpc.aws_subnet.public","module.vpc.module.vpc.aws_subnet.redshift","module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","module.vpc.module.vpc.aws_vpc_block_public_access_options.this","module.vpc.module.vpc.aws_vpc_dhcp_options.this","module.vpc.module.vpc.aws_vpn_gateway.this","module.vpc.module.vpc.aws_vpn_gateway_attachment.this"]}],"dependencies":109,"by_class":{"RECONFIGURE":34,"REDESIGN":1,"REPLATFORM":9},"by_confidence":{"LOW":9,"MEDIUM":35},"source_status":"RUNTIME_TOPOLOGY_PARTIAL","source_gaps":["RUNTIME_TOPOLOGY_PARTIAL"],"source_status_reason":"8 unit(s) have a count/for_each that is not known statically; whether and how often they exist is decided at plan time","source_validation":{"status":"SOURCE_VALID","checks":[{"id":"hcl-syntax","status":"OK"},{"id":"declarations","status":"OK"},{"id":"files-read","status":"OK"},{"id":"module-sources","status":"OK"},{"id":"inputs","status":"OK"},{"id":"loader-warnings","status":"OK"}],"native":{"status":"NOT_RUN","reason":"LOCK_FILE","engine":"OpenTofu","engine_version":"1.13.1","platform":"darwin_arm64","snapshot_id":"keyed-sha256:50e4635302e22bab9b0cd7018d6258b51379de7f2f492dfd0e0c3c9cf46aa3a8","input_digest":"keyed-sha256:26df77802db380480c1cbc45c3395ea5532c6b890dfe1017e437b243939e6ea1"}},"support":{"nodes":46,"tooling":12,"generated_secrets":["module.dependencies.module.catalog_rds.random_password.master_password","module.dependencies.module.orders_rds.random_password.master_password","module.dependencies.random_password.mq_password"],"accounted":23,"critical_open":40},"property_accounting":{"units":38,"units_not_generated":11,"units_with_unaccounted":0,"set":489,"excluded":85,"excluded_by":{"aws-apply-immediately":3,"aws-db-apply-and-destroy":2,"aws-name-prefix":2,"aws-tags":29,"description":5,"empty set is omit-equivalent (p2b13-aws-033)":2,"facet-link":29,"terraform-timeouts":13},"meaningful":404,"by_status":{"CONSUMED":20,"CONTRACT":175,"NOT_CARRIED":209,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"by_source_type":{"aws_cloudwatch_log_group":{"nodes":1,"meaningful":1,"unaccounted":0},"aws_dynamodb_table":{"nodes":1,"meaningful":13,"unaccounted":0},"aws_ecs_cluster":{"nodes":1,"meaningful":3,"unaccounted":0},"aws_ecs_service":{"nodes":5,"meaningful":83,"unaccounted":0},"aws_ecs_task_definition":{"nodes":5,"meaningful":40,"unaccounted":0},"aws_elasticache_replication_group":{"nodes":1,"meaningful":18,"unaccounted":0},"aws_iam_role":{"nodes":10,"meaningful":20,"unaccounted":0},"aws_iam_role_policy_attachment":{"nodes":19,"meaningful":19,"unaccounted":0},"aws_kms_key":{"nodes":1,"meaningful":1,"unaccounted":0},"aws_lb":{"nodes":1,"meaningful":17,"unaccounted":0},"aws_lb_listener":{"nodes":1,"meaningful":4,"unaccounted":0},"aws_mq_broker":{"nodes":1,"meaningful":12,"unaccounted":0},"aws_opensearch_domain":{"nodes":1,"meaningful":23,"unaccounted":0},"aws_opensearch_domain_policy":{"nodes":1,"meaningful":1,"unaccounted":0},"aws_rds_cluster":{"nodes":2,"meaningful":35,"unaccounted":0},"aws_rds_cluster_instance":{"nodes":2,"meaningful":18,"unaccounted":0},"aws_secretsmanager_secret":{"nodes":4,"meaningful":6,"unaccounted":0},"aws_secretsmanager_secret_version":{"nodes":4,"meaningful":4,"unaccounted":0},"aws_security_group":{"nodes":7,"meaningful":53,"unaccounted":0},"aws_security_group_rule":{"nodes":2,"meaningful":14,"unaccounted":0},"aws_subnet":{"nodes":2,"meaningful":19,"unaccounted":0}},"top_unaccounted":[]},"root_issues":[{"id":"source-provider-unpinned:aws","check_id":"source-provider-unpinned","impact":"ROOT_BLOCKER","severity":"warning","provider":"aws","message":"No lock file entry pins aws (\u003e= 3.0, \u003e= 3.29, \u003e= 4.18, \u003e= 4.30, \u003e= 4.59, \u003e= 5.64, \u003e= 5.79, ~\u003e 5.0): the version the plan would use is not proven, so the knowledge base (checked against 5.100.0) is not taken as proof of it. Affects 93 units (confidence at most MEDIUM).","affected_units":93}]},"units":[{"id":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","source_type":"aws_dynamodb_table","category":"data","kind":"nosql_table","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.dependencies.module.dynamodb_carts","configuration_completeness":"COMPLETE","wave":1,"provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/main.tf","line":1,"end_line":86},"result":{"rule_id":"aws.dynamodb_table","case_id":"dynamodb","class":"REDESIGN","confidence":"MEDIUM","target":{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","resources":["stackit_mongodbflex_instance"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): mongodbflex lists 16 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): mongodbflex lists 5 offerings"}]},"reason":"There is no DynamoDB-compatible service on STACKIT. The access layer is rewritten against a document store (MongoDB Flex) or relational JSONB (PostgreSQL Flex); key design, capacity modes and conditional writes do not carry over. The draft is an alternative, not an equivalent: one MongoDB Flex instance for the estate's tables, each table a collection with its keys and secondary indexes named as MongoDB indexes.","review":["Rewrite the data access layer against the MongoDB API (queries, conditional writes, transactions).","Size the instance from the tables' data volume and request load; capacity units do not translate."],"evidence":["https://docs.stackit.cloud/products/databases/mongodb-flex/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/mongodbflex_instance"],"validated_against":"STACKIT product catalogue 2026-09-23 (no managed key-value NoSQL with a DynamoDB-compatible API); terraform-provider-stackit@0.116.0 (stackit_mongodbflex_instance: flavor, storage, replicas, backup schedule, point-in-time window; no encryption key attribute); STACKIT catalogue eu01 2026-09-24","findings":[{"check_id":"dynamodb-secondary-indexes","severity":"info","message":"Secondary indexes become MongoDB indexes on the collection; projections and the eventual consistency of global secondary indexes do not carry over."},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.dynamodb_table","expected":44,"observed":8,"accounted":8,"unaccounted":0,"critical_unaccounted":[],"critical_open":["key-schema","index-projection-and-name","encryption-at-rest","point-in-time-recovery","ttl","tc-dynamodb-table-name"],"items":[{"id":"key-schema","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:dynamodb"},{"id":"index-projection-and-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:dynamodb"},{"id":"global-table","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"global-table-replica-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"global-table-witness","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"restore-import-source","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"streams","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"encryption-at-rest","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:dynamodb"},{"id":"point-in-time-recovery","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:dynamodb"},{"id":"ttl","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:dynamodb"},{"id":"secondary-indexes","critical":false,"observed":"yes","disposition":"REVIEW","by":"check:dynamodb-secondary-indexes"},{"id":"capacity-autoscaling","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"scheduled-capacity","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-target-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-policy-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-target-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-policy-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"scheduled-capacity-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"terraform-items","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"capacity-mode","critical":false,"observed":"yes","disposition":"UNSUPPORTED","by":"case:dynamodb"},{"id":"deletion-protection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-protection-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-protection-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-server-side-encryption--kms-key-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-dynamodb-table-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:dynamodb"},{"id":"nbr-aws-appsync-datasource","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dynamodb-global-secondary-index","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dynamodb-kinesis-streaming-destination","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dynamodb-resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dynamodb-table-export","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dynamodb-table-replica","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dynamodb-tag","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-pipes-pipe","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scaling-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-appsync-data-source","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-dynamodb-backup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-awscc-dynamodb-backup-backup-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-event-source-mapping","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-pipes-pipe","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-stepfunctions-state-machine","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dynamodb-contributor-insights","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dynamodb-table-item","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE","DATA"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","confidence":"MEDIUM"}},"property_accounting":{"set":17,"excluded":4,"meaningful":13,"by_status":{"CONSUMED":0,"CONTRACT":11,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","attribute":"billing_mode"},{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","attribute":"global_secondary_index.projection_type"}],"class_counts":{"CRITICAL":11,"NON_CRITICAL":2},"critical":[{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","attribute":"attribute.name","class":"CRITICAL","category":"data-semantics","closure":"CLOSED:REVIEW","by":"aws.dynamodb_table/key-schema:REVIEW"},{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","attribute":"attribute.type","class":"CRITICAL","category":"data-semantics","closure":"CLOSED:REVIEW","by":"aws.dynamodb_table/key-schema:REVIEW"},{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","attribute":"global_secondary_index.hash_key","class":"CRITICAL","category":"data-semantics","closure":"CLOSED:REVIEW","by":"aws.dynamodb_table/key-schema:REVIEW"},{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","attribute":"global_secondary_index.name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"aws.dynamodb_table/index-projection-and-name:REVIEW"},{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","attribute":"global_secondary_index.projection_type","class":"CRITICAL","category":"data-semantics","closure":"CLOSED:NC+REVIEW","by":"TABLE module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (.terraform/modules/dependencies.dynamodb_carts/main.tf:1) → collection \"retail-store-ecs-carts\": key id → _id (or a unique index on id); GSI idx_global_customerId {customerId: 1} → secondary index (strongly consistent in MongoDB; the projection is not needed); GSI projections and capacities → NOT CARRIED (a MongoDB index finds whole documents; capacity is flavor sizing); billing mode PAY_PER_REQUEST → NOT CARRIED (flavor sizing). (contract aws.dynamodb_table/index-projection-and-name:REVIEW)"},{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","attribute":"hash_key","class":"CRITICAL","category":"data-semantics","closure":"CLOSED:REVIEW","by":"aws.dynamodb_table/key-schema:REVIEW"},{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","attribute":"name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"aws.dynamodb_table/tc-dynamodb-table-name:REVIEW"},{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","attribute":"point_in_time_recovery.enabled","class":"CRITICAL","category":"backup-retention","closure":"CLOSED:REVIEW","by":"aws.dynamodb_table/point-in-time-recovery:REVIEW"},{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","attribute":"server_side_encryption.enabled","class":"CRITICAL","category":"encryption","closure":"CLOSED:REVIEW","by":"aws.dynamodb_table/encryption-at-rest:REVIEW"},{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","attribute":"ttl.attribute_name","class":"CRITICAL","category":"backup-retention","closure":"CLOSED:REVIEW","by":"aws.dynamodb_table/ttl:REVIEW"},{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","attribute":"ttl.enabled","class":"CRITICAL","category":"backup-retention","closure":"CLOSED:REVIEW","by":"aws.dynamodb_table/ttl:REVIEW"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_dynamodb_table","attribute":"global_secondary_index.projection_type","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_dynamodb_table","attribute":"attribute.name","closure":"CLOSED:REVIEW"},{"source_type":"aws_dynamodb_table","attribute":"attribute.type","closure":"CLOSED:REVIEW"},{"source_type":"aws_dynamodb_table","attribute":"global_secondary_index.hash_key","closure":"CLOSED:REVIEW"},{"source_type":"aws_dynamodb_table","attribute":"global_secondary_index.name","closure":"CLOSED:REVIEW"},{"source_type":"aws_dynamodb_table","attribute":"hash_key","closure":"CLOSED:REVIEW"},{"source_type":"aws_dynamodb_table","attribute":"name","closure":"CLOSED:REVIEW"},{"source_type":"aws_dynamodb_table","attribute":"point_in_time_recovery.enabled","closure":"CLOSED:REVIEW"},{"source_type":"aws_dynamodb_table","attribute":"server_side_encryption.enabled","closure":"CLOSED:REVIEW"},{"source_type":"aws_dynamodb_table","attribute":"ttl.attribute_name","closure":"CLOSED:REVIEW"},{"source_type":"aws_dynamodb_table","attribute":"ttl.enabled","closure":"CLOSED:REVIEW"},{"source_type":"aws_dynamodb_table","semantic":"convert:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this:data:DATA_MOVEMENT","closure":"CONVERT:open-decision"},{"source_type":"aws_dynamodb_table","closure":"NOT_AUTOMATABLE_CLASS:REDESIGN"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","source_type":"aws_cloudwatch_log_group","category":"observability","kind":"log_group","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs","configuration_completeness":"COMPLETE","wave":1,"provenance":{"file":"../../lib/ecs/cluster.tf","line":10,"end_line":12},"result":{"rule_id":"aws.cloudwatch_log_group","case_id":"log-group","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Logs","resources":["stackit_logs_instance","stackit_logs_access_token"],"maturity":"ga","lifecycle":"active"},"reason":"Log groups become label sets in a STACKIT Logs instance (a label-based Grafana Loki store written over OTLP or the Loki API, retention in days for the whole instance). STACKIT has no log group or stream object: a group's name survives only as a label the shipper sends. Agents switch from the CloudWatch agent to a documented shipper (Grafana Alloy, OpenTelemetry Collector, Vector or Fluent Bit); log groups that keep their logs for the same number of days share one instance.","evidence":["https://docs.stackit.cloud/products/logging-and-monitoring/observability/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/logs_instance","https://docs.stackit.cloud/products/logging-and-monitoring/logs/","https://docs.stackit.cloud/products/logging-and-monitoring/logs/basics/core-features-and-use-cases-of-logs/","https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.cloudwatch_log_group","expected":33,"observed":1,"accounted":1,"unaccounted":0,"critical_unaccounted":[],"critical_open":["tc-name"],"items":[{"id":"retention","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"retention-never-expires","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"explicit-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"metric-filters","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-filters","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-filter-settings","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-filter-destination","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-filter-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-filter-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-filter-distribution","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-protection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"skip-destroy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-class","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:log-group"},{"id":"tcf-cloudwatch-log-stream--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-cloudwatch-log-anomaly-detector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-cloudwatch-log-data-protection-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-cloudwatch-log-index-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-cloudwatch-log-transformer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-datasync-task","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-route53-query-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-storagegateway-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-instance-logging-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-access-log-subscription","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-flow-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-logs-delivery-destination","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-logs-log-anomaly-detector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53-hosted-zone","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53-query-logging-config","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-query-logging-config","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-access-log-subscription","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-cloudwatch-log-metric-filter","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT Logs","confidence":"MEDIUM"}},"property_accounting":{"set":1,"excluded":0,"meaningful":1,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":1,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","attribute":"name"}],"class_counts":{"CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","attribute":"name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:NC+REVIEW","by":"plan: stackit_logs_instance.logs_retention_180d name of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks MANUAL_ACTION (stackitlogs:label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks) (contract aws.cloudwatch_log_group/tc-name:REVIEW)"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_cloudwatch_log_group","attribute":"name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_cloudwatch_log_group","semantic":"stackitlogs:archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","closure":"PLAN:manual-action"},{"source_type":"aws_cloudwatch_log_group","semantic":"stackitlogs:label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","closure":"PLAN:manual-action"},{"source_type":"aws_cloudwatch_log_group","semantic":"stackitlogs:token:stackit_logs_instance.logs_retention_180d","closure":"PLAN:manual-action"},{"source_type":"aws_cloudwatch_log_group","semantic":"stackitlogs:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks:retention_over_180_days","closure":"PLAN:open-decision"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.retail_app_ecs.aws_ecs_cluster.cluster","source_type":"aws_ecs_cluster","category":"compute","kind":"container_cluster","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs","configuration_completeness":"COMPLETE","wave":1,"provenance":{"file":"../../lib/ecs/cluster.tf","line":1,"end_line":8},"result":{"rule_id":"aws.ecs","case_id":"ecs-to-ske","class":"REPLATFORM","confidence":"MEDIUM","target":{"service":"STACKIT Kubernetes Engine (SKE)","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): ske lists 161 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): ske lists 77 offerings"}]},"reason":"Containers already exist; ECS task definitions and services are rewritten as Kubernetes Deployments/Services on SKE (or pushed to Cloud Foundry for simple web apps).","review":["Translate task definitions (CPU/memory, env, secrets, health checks) into Kubernetes manifests."],"evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/ske_cluster"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.ecs","expected":122,"observed":0,"accounted":0,"unaccounted":0,"critical_unaccounted":[],"critical_open":[],"items":[{"id":"nbr-aws-networkfirewall-container-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-events-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkfirewall-container-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-scheduler-schedule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-stepfunctions-state-machine","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-platform-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-timeouts","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-capacity-provider-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-access-log-format","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"capacity-providers","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-capacity-providers-legacy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"scheduled-scaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-target-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-policy-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-discovery","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"public-ip","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-desired-count","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-scheduling-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-limits","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-controller","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-circuit-breaker","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-alarms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-execute-command","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-health-check-grace","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-az-rebalancing","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-iam-role-and-delete","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-load-balancer-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-network-placement","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-public-ip-setting","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-registry-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-size","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-file-system-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-iops","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-throughput","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-initialization-rate","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tag-propagate","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tag-resource-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-vpc-lattice","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-execute-command","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-managed-storage","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-service-connect-defaults","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-container-definitions","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-container-secret-references","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-container-plaintext-secret-env","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-container-image-registry","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-execution-role-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-network-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-skip-destroy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-task-role-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-host-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-configure-at-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-configure-at-launch-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-file-system-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-access-point-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-iam-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-transit-encryption","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-transit-encryption-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-placement-constraints-expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-placement-constraints-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-ipc-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-pid-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-proxy-configuration-properties","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-proxy-configuration-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-driver","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-scratch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-driver-opts","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-scope","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-defaults","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-authorization-config-credentials-parameter","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-authorization-config-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-file-system-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-access-point-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-file-system-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-enable-fault-injection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ecs-cluster-configuration--execute-command-configuration--log-configuration--s3-key-prefix","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ecs-service-service-connect-configuration--log-configuration--secret-option--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ak181-facets-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-traffic-shift-and-bake","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-pause-hook-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-external-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-force-delete","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-launch-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-platform-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-wait-until-stable","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-wait-until-stable-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--base","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--weight","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--container-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--container-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--load-balancer-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--target-group-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--assign-public-ip","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--security-groups","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--subnets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-scale--unit","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-scale--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--container-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--container-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--registry-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scaling-policy","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"SUPPORTED","motion":"REPLATFORM","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT Kubernetes Engine (SKE)","confidence":"MEDIUM"}},"property_accounting":{"set":3,"excluded":0,"meaningful":3,"by_status":{"CONSUMED":1,"CONTRACT":0,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.aws_ecs_cluster.cluster","attribute":"setting.name"},{"node":"module.retail_app_ecs.aws_ecs_cluster.cluster","attribute":"setting.value"}],"class_counts":{"NON_CRITICAL":3},"automation_eligible":false,"gate_blockers":[{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.retail_app_ecs.aws_kms_key.cmk","source_type":"aws_kms_key","category":"identity","kind":"encryption_key","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs","configuration_completeness":"COMPLETE","wave":1,"provenance":{"file":"../../lib/ecs/common.tf","line":1,"end_line":4},"result":{"rule_id":"aws.kms_key","case_id":"kms","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT KMS","resources":["stackit_kms_keyring","stackit_kms_key"],"maturity":"ga","lifecycle":"active"},"reason":"Keys are re-created in STACKIT KMS (keyring + key); key material generated in AWS KMS cannot be exported, so encrypted data is re-encrypted during migration. Consumers (volumes, PostgreSQL Flex, Secrets Manager) reference the new key.","evidence":["https://docs.stackit.cloud/products/security/kms/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/kms_key"],"validated_against":"terraform-provider-stackit@0.116.0; docs security/kms 2026-09-23 (eu01, eu02 since 2026-04-07); docs security/kms create-and-manage-keys 2026-09-27 (deleted after 30 days, active after creation)","findings":[{"check_id":"kms-deletion-window","severity":"info","message":"The key's deletion window is not 30 days. STACKIT KMS deletes a key scheduled for deletion after 30 days, with no setting (stackit_kms_key has none) — check that a different recovery window is acceptable.","evidence":["https://docs.stackit.cloud/products/security/kms/how-tos/create-and-manage-keys/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/kms_key"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.kms_key","expected":48,"observed":1,"accounted":1,"unaccounted":0,"critical_unaccounted":[],"critical_open":["deletion-window"],"items":[{"id":"iam-kms-policy-conditions","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tag-conditioned-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-kms-policy-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"key-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"imported-key-material","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rotation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rotation-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rotation-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"explicit-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"multi-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-window","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:kms-deletion-window"},{"id":"key-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"key-spec","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"key-spec-not-default","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"grants","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"replicas","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"alias","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-kms-key-custom-key-store-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-kms-key-xks-key-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ebs-default-kms-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ebs-snapshot-copy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ebs-snapshot-import","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-component","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-container-recipe","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-distribution-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image-recipe","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-workflow","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-trust-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-volume","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-repository","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-component","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-container-recipe","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-distribution-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image-recipe","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-workflow","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-event-source-mapping","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-proton-environment-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-proton-service-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53-key-signing-key","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT KMS","confidence":"MEDIUM"}},"property_accounting":{"set":2,"excluded":1,"meaningful":1,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":1,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.aws_kms_key.cmk","attribute":"deletion_window_in_days"}],"class_counts":{"CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.aws_kms_key.cmk","attribute":"deletion_window_in_days","class":"CRITICAL","category":"deletion-protection","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.aws_kms_key.cmk): deletion_window_in_days = 7 — STACKIT KMS deletes a key scheduled for deletion after 30 days; stackit_kms_key has no deletion window (pinned provider). (contract aws.kms_key/deletion-window:REVIEW)"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_kms_key","attribute":"deletion_window_in_days","closure":"CLOSED:NC+REVIEW"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","source_type":"aws_iam_role","category":"identity","kind":"iam_role","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.carts_service","facets":["module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_execution_role_policy"],"configuration_completeness":"COMPLETE","wave":1,"provenance":{"file":"../../lib/ecs/service/iam.tf","line":14,"end_line":18},"result":{"rule_id":"aws.iam_role","case_id":"role-workload-execution","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"Execution role of an application (Lambda function or ECS task). The application keeps needing these permissions on STACKIT: it gets a service account (or data-service credentials such as database users and object-storage keys) with equivalent grants.","review":["List what the attached policies allow (tables, buckets, queues) and grant the same on the STACKIT targets."],"evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam); SKE workload identity docs 2026-09-15; IAM checks of 2026-10-06: provider 0.117.0 schema, docs.stackit.cloud access-and-identity 2026-10-06; IAM notes wording (Act-As, S3 bucket policy carrier, Container Registry has no resource): provider 0.119.0 schema and the docs.stackit.cloud pages cited in the checks, checked 2026-10-11; iam-managed-ssm-instance wording: provider 0.119.0 schema (stackit_server agent), docs.stackit.cloud server-agent, run-command and server pages and the AWS AmazonSSMManagedInstanceCore and Systems Manager instance-permission pages, fetched 2026-10-12; role-ec2-no-profile: provider 0.119.0 docs stackit_server_service_account_attach and stackit_service_account, read 2026-11-01; role-ec2-no-profile skips a role an awscc_iam_instance_profile names: awscc 1.103.0 docs/resources/iam_instance_profile.md (roles), read 2026-11-01; role-instance-profile of an awscc_iam_instance_profile that holds the role exactly (2026-11-01): awscc 1.103.0 docs/resources/iam_instance_profile.md (roles: a Set of String, one role per EC2 instance) and the awscc provider source of the instance profile resource, instance_profile_resource_gen.go:114 (knowledge-base evidence, not in this folder: the primary identifier is the name), read 2026-11-01","findings":[{"check_id":"iam-trust-service-workload","severity":"info","message":"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. On STACKIT the workload runs as a service account (stackit_service_account) and nothing assumes it: it authenticates with a service account key (stackit_service_account_key, key flow) or, on SKE, by Workload Identity Federation (a federated identity provider on the account). What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","evidence":["https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","https://docs.stackit.cloud/platform/access-and-identity/service-accounts/authentication-flows/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_key","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_federated_identity_provider"]},{"check_id":"iam-managed-ecs","severity":"info","message":"Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). STACKIT has no ECS: image pull is a registry credential (Container Registry roles, Guest is read-only) and log shipping a platform or credential setting (stackit_logs_access_token); no STACKIT role replaces these grants. Container Registry: STACKIT offers this service. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed. (schema checked 2026-10-11: none of the 115 resource types of the pinned STACKIT provider), so the pull credential is not drafted (project roles: docs.stackit.cloud, updated Jul 2, 2026). What to decide: the registry pull credential and the log destination of the replacing workload.","evidence":["https://docs.stackit.cloud/products/developer-platform/container-registry/how-tos/securing-access-with-role-based-access-control-_rbac_/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/logs_access_token","https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSTaskExecutionRolePolicy.html","https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2ContainerServiceforEC2Role.html","data/stackit/provider-schema-0.119.0.json"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.iam_role","expected":103,"observed":6,"accounted":6,"unaccounted":0,"critical_unaccounted":[],"critical_open":["trust","permissions","tcfp-iam-role-policy-attachment--policy-arn","iam-trust-service-workload","iam-managed-ecs"],"items":[{"id":"trust","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"permissions","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"facet-link-role","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:role-workload-execution"},{"id":"permissions-boundary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tag-conditioned-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-policy-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"instance-profile-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"force-detach","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"session-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-iam-role-policy-attachment-policy-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy-attachment--policy-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution","withdrawn_by":["iam-managed-ecs","permissions"]},{"id":"iam-trust-aws-principal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-cognito","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-conditions","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-oidc","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-saml","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-workload","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-trust-service-workload"},{"id":"iam-trust-service-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-principal-partly-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-customer-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-administrator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-poweruser","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-readonly","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ssm-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-cloudwatch-agent","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-registry-read","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-eks-internal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-sqs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ecs","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-managed-ecs"},{"id":"iam-managed-rds-monitoring","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-xray","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-application-insights","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-support","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-backup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-condition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-assume-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-wildcard-admin","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-not-action","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-kms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-secrets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-logs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ebs-snapshot-import","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-microvm","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-spot-fleet-request","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-auth-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-job-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-direct-connect-gateway-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-private-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-public-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-transit-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-dlm-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-enclave-certificate-iam-role-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-flow-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-spot-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-addon","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-fargate-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-pod-identity-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticbeanstalk-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-iam-managed-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-microvm-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-proton-environment-account-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT service account for the workload","confidence":"MEDIUM"}},"property_accounting":{"set":5,"excluded":2,"meaningful":3,"by_status":{"CONSUMED":0,"CONTRACT":1,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","attribute":"assume_role_policy"},{"node":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","attribute":"name"}],"class_counts":{"CRITICAL":2,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","attribute":"assume_role_policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated. (contract aws.iam_role/iam-trust-service-workload:REVIEW)"},{"node":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_execution_role_policy","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-ecs:REVIEW"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_iam_role","attribute":"assume_role_policy","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_iam_role_policy_attachment","attribute":"policy_arn","closure":"CLOSED:REVIEW"},{"target":"type:stackit_authorization_project_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","source_type":"aws_iam_role","category":"identity","kind":"iam_role","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.checkout_service","facets":["module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_execution_role_policy"],"configuration_completeness":"COMPLETE","wave":1,"provenance":{"file":"../../lib/ecs/service/iam.tf","line":14,"end_line":18},"result":{"rule_id":"aws.iam_role","case_id":"role-workload-execution","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"Execution role of an application (Lambda function or ECS task). The application keeps needing these permissions on STACKIT: it gets a service account (or data-service credentials such as database users and object-storage keys) with equivalent grants.","review":["List what the attached policies allow (tables, buckets, queues) and grant the same on the STACKIT targets."],"evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam); SKE workload identity docs 2026-09-15; IAM checks of 2026-10-06: provider 0.117.0 schema, docs.stackit.cloud access-and-identity 2026-10-06; IAM notes wording (Act-As, S3 bucket policy carrier, Container Registry has no resource): provider 0.119.0 schema and the docs.stackit.cloud pages cited in the checks, checked 2026-10-11; iam-managed-ssm-instance wording: provider 0.119.0 schema (stackit_server agent), docs.stackit.cloud server-agent, run-command and server pages and the AWS AmazonSSMManagedInstanceCore and Systems Manager instance-permission pages, fetched 2026-10-12; role-ec2-no-profile: provider 0.119.0 docs stackit_server_service_account_attach and stackit_service_account, read 2026-11-01; role-ec2-no-profile skips a role an awscc_iam_instance_profile names: awscc 1.103.0 docs/resources/iam_instance_profile.md (roles), read 2026-11-01; role-instance-profile of an awscc_iam_instance_profile that holds the role exactly (2026-11-01): awscc 1.103.0 docs/resources/iam_instance_profile.md (roles: a Set of String, one role per EC2 instance) and the awscc provider source of the instance profile resource, instance_profile_resource_gen.go:114 (knowledge-base evidence, not in this folder: the primary identifier is the name), read 2026-11-01","findings":[{"check_id":"iam-trust-service-workload","severity":"info","message":"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. On STACKIT the workload runs as a service account (stackit_service_account) and nothing assumes it: it authenticates with a service account key (stackit_service_account_key, key flow) or, on SKE, by Workload Identity Federation (a federated identity provider on the account). What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","evidence":["https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","https://docs.stackit.cloud/platform/access-and-identity/service-accounts/authentication-flows/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_key","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_federated_identity_provider"]},{"check_id":"iam-managed-ecs","severity":"info","message":"Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). STACKIT has no ECS: image pull is a registry credential (Container Registry roles, Guest is read-only) and log shipping a platform or credential setting (stackit_logs_access_token); no STACKIT role replaces these grants. Container Registry: STACKIT offers this service. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed. (schema checked 2026-10-11: none of the 115 resource types of the pinned STACKIT provider), so the pull credential is not drafted (project roles: docs.stackit.cloud, updated Jul 2, 2026). What to decide: the registry pull credential and the log destination of the replacing workload.","evidence":["https://docs.stackit.cloud/products/developer-platform/container-registry/how-tos/securing-access-with-role-based-access-control-_rbac_/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/logs_access_token","https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSTaskExecutionRolePolicy.html","https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2ContainerServiceforEC2Role.html","data/stackit/provider-schema-0.119.0.json"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.iam_role","expected":103,"observed":6,"accounted":6,"unaccounted":0,"critical_unaccounted":[],"critical_open":["trust","permissions","tcfp-iam-role-policy-attachment--policy-arn","iam-trust-service-workload","iam-managed-ecs"],"items":[{"id":"trust","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"permissions","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"facet-link-role","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:role-workload-execution"},{"id":"permissions-boundary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tag-conditioned-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-policy-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"instance-profile-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"force-detach","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"session-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-iam-role-policy-attachment-policy-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy-attachment--policy-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution","withdrawn_by":["iam-managed-ecs","permissions"]},{"id":"iam-trust-aws-principal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-cognito","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-conditions","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-oidc","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-saml","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-workload","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-trust-service-workload"},{"id":"iam-trust-service-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-principal-partly-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-customer-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-administrator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-poweruser","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-readonly","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ssm-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-cloudwatch-agent","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-registry-read","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-eks-internal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-sqs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ecs","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-managed-ecs"},{"id":"iam-managed-rds-monitoring","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-xray","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-application-insights","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-support","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-backup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-condition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-assume-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-wildcard-admin","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-not-action","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-kms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-secrets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-logs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ebs-snapshot-import","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-microvm","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-spot-fleet-request","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-auth-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-job-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-direct-connect-gateway-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-private-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-public-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-transit-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-dlm-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-enclave-certificate-iam-role-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-flow-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-spot-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-addon","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-fargate-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-pod-identity-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticbeanstalk-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-iam-managed-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-microvm-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-proton-environment-account-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT service account for the workload","confidence":"MEDIUM"}},"property_accounting":{"set":5,"excluded":2,"meaningful":3,"by_status":{"CONSUMED":0,"CONTRACT":1,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","attribute":"assume_role_policy"},{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","attribute":"name"}],"class_counts":{"CRITICAL":2,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","attribute":"assume_role_policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated. (contract aws.iam_role/iam-trust-service-workload:REVIEW)"},{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_execution_role_policy","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-ecs:REVIEW"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_iam_role","attribute":"assume_role_policy","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_iam_role_policy_attachment","attribute":"policy_arn","closure":"CLOSED:REVIEW"},{"target":"type:stackit_authorization_project_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","source_type":"aws_iam_role","category":"identity","kind":"iam_role","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.ui_service","facets":["module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.task_execution_role_policy"],"configuration_completeness":"COMPLETE","wave":1,"provenance":{"file":"../../lib/ecs/service/iam.tf","line":14,"end_line":18},"result":{"rule_id":"aws.iam_role","case_id":"role-workload-execution","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"Execution role of an application (Lambda function or ECS task). The application keeps needing these permissions on STACKIT: it gets a service account (or data-service credentials such as database users and object-storage keys) with equivalent grants.","review":["List what the attached policies allow (tables, buckets, queues) and grant the same on the STACKIT targets."],"evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam); SKE workload identity docs 2026-09-15; IAM checks of 2026-10-06: provider 0.117.0 schema, docs.stackit.cloud access-and-identity 2026-10-06; IAM notes wording (Act-As, S3 bucket policy carrier, Container Registry has no resource): provider 0.119.0 schema and the docs.stackit.cloud pages cited in the checks, checked 2026-10-11; iam-managed-ssm-instance wording: provider 0.119.0 schema (stackit_server agent), docs.stackit.cloud server-agent, run-command and server pages and the AWS AmazonSSMManagedInstanceCore and Systems Manager instance-permission pages, fetched 2026-10-12; role-ec2-no-profile: provider 0.119.0 docs stackit_server_service_account_attach and stackit_service_account, read 2026-11-01; role-ec2-no-profile skips a role an awscc_iam_instance_profile names: awscc 1.103.0 docs/resources/iam_instance_profile.md (roles), read 2026-11-01; role-instance-profile of an awscc_iam_instance_profile that holds the role exactly (2026-11-01): awscc 1.103.0 docs/resources/iam_instance_profile.md (roles: a Set of String, one role per EC2 instance) and the awscc provider source of the instance profile resource, instance_profile_resource_gen.go:114 (knowledge-base evidence, not in this folder: the primary identifier is the name), read 2026-11-01","findings":[{"check_id":"iam-trust-service-workload","severity":"info","message":"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. On STACKIT the workload runs as a service account (stackit_service_account) and nothing assumes it: it authenticates with a service account key (stackit_service_account_key, key flow) or, on SKE, by Workload Identity Federation (a federated identity provider on the account). What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","evidence":["https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","https://docs.stackit.cloud/platform/access-and-identity/service-accounts/authentication-flows/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_key","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_federated_identity_provider"]},{"check_id":"iam-managed-ecs","severity":"info","message":"Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). STACKIT has no ECS: image pull is a registry credential (Container Registry roles, Guest is read-only) and log shipping a platform or credential setting (stackit_logs_access_token); no STACKIT role replaces these grants. Container Registry: STACKIT offers this service. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed. (schema checked 2026-10-11: none of the 115 resource types of the pinned STACKIT provider), so the pull credential is not drafted (project roles: docs.stackit.cloud, updated Jul 2, 2026). What to decide: the registry pull credential and the log destination of the replacing workload.","evidence":["https://docs.stackit.cloud/products/developer-platform/container-registry/how-tos/securing-access-with-role-based-access-control-_rbac_/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/logs_access_token","https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSTaskExecutionRolePolicy.html","https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2ContainerServiceforEC2Role.html","data/stackit/provider-schema-0.119.0.json"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.iam_role","expected":103,"observed":6,"accounted":6,"unaccounted":0,"critical_unaccounted":[],"critical_open":["trust","permissions","tcfp-iam-role-policy-attachment--policy-arn","iam-trust-service-workload","iam-managed-ecs"],"items":[{"id":"trust","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"permissions","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"facet-link-role","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:role-workload-execution"},{"id":"permissions-boundary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tag-conditioned-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-policy-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"instance-profile-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"force-detach","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"session-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-iam-role-policy-attachment-policy-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy-attachment--policy-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution","withdrawn_by":["iam-managed-ecs","permissions"]},{"id":"iam-trust-aws-principal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-cognito","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-conditions","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-oidc","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-saml","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-workload","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-trust-service-workload"},{"id":"iam-trust-service-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-principal-partly-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-customer-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-administrator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-poweruser","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-readonly","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ssm-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-cloudwatch-agent","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-registry-read","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-eks-internal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-sqs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ecs","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-managed-ecs"},{"id":"iam-managed-rds-monitoring","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-xray","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-application-insights","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-support","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-backup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-condition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-assume-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-wildcard-admin","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-not-action","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-kms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-secrets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-logs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ebs-snapshot-import","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-microvm","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-spot-fleet-request","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-auth-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-job-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-direct-connect-gateway-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-private-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-public-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-transit-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-dlm-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-enclave-certificate-iam-role-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-flow-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-spot-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-addon","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-fargate-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-pod-identity-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticbeanstalk-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-iam-managed-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-microvm-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-proton-environment-account-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT service account for the workload","confidence":"MEDIUM"}},"property_accounting":{"set":5,"excluded":2,"meaningful":3,"by_status":{"CONSUMED":0,"CONTRACT":1,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","attribute":"assume_role_policy"},{"node":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","attribute":"name"}],"class_counts":{"CRITICAL":2,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","attribute":"assume_role_policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated. (contract aws.iam_role/iam-trust-service-workload:REVIEW)"},{"node":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.task_execution_role_policy","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-ecs:REVIEW"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_iam_role","attribute":"assume_role_policy","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_iam_role_policy_attachment","attribute":"policy_arn","closure":"CLOSED:REVIEW"},{"target":"type:stackit_authorization_project_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.vpc.module.vpc.aws_eip.nat","source_type":"aws_eip","category":"network","kind":"public_ip","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.vpc.module.vpc","open_dependencies":["module.vpc.module.vpc.aws_internet_gateway.this"],"configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_internet_gateway.this"],"wave":1,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1092,"end_line":1109},"result":{"rule_id":"aws.eip","case_id":"eip-for-nat","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"implicit (belongs to the NAT gateway)","maturity":"ga"},"reason":"This Elastic IP only exists for a NAT gateway; it goes away together with the NAT gateway.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/public_ip.md"],"validated_against":"terraform-provider-stackit@0.116.0; terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_public_ip schema unchanged, page re-read)","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.eip","expected":15,"observed":1,"accounted":1,"unaccounted":0,"critical_unaccounted":[],"critical_open":["public-address"],"items":[{"id":"public-address","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:eip-for-nat"},{"id":"address-pool","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"private-ip-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"association-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"association-address-selection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"association-not-wired","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-network-border-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-associate-with-private-ip","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-eip-domain-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-globalaccelerator-cross-account-attachment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-nat-gateway-eip-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-globalaccelerator-cross-account-attachment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-globalaccelerator-endpoint-group","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"implicit (belongs to the NAT gateway)","confidence":"MEDIUM"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"automation_eligible":false,"open_critical_without_read_set":["public-address"],"gate_blockers":[{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"public-address","closure":"open-critical-without-read-set"}],"implicit":true}},{"id":"module.vpc.module.vpc.aws_vpc.this","source_type":"aws_vpc","category":"network","kind":"virtual_network","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.vpc.module.vpc","facets":["module.vpc.module.vpc.aws_default_network_acl.this","module.vpc.module.vpc.aws_default_route_table.default","module.vpc.module.vpc.aws_default_security_group.this"],"configuration_completeness":"COMPLETE","wave":1,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":28,"end_line":51},"result":{"rule_id":"aws.vpc","case_id":"vpc","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT project networking / Network Area (SNA)","resources":["stackit_network_area","stackit_network"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT has no VPC container object in its GA model: each subnet becomes a stackit_network in a project, and networks that must talk to each other privately join a Network Area. The newer stackit_vpc resources exist but are experimental (provider experiment \"vpc\"). With exactly one VPC in the estate the project is that VPC's boundary (STACKIT_STABLE profile) and the draft says so at the top of the draft's network file; with several VPCs, or a VPC count that is not visible statically, which architecture holds them is the architect's decision (the checks on several VPCs and on a VPC count that is not visible).","review":["Decide the project layout (one project per environment or per application) before mapping networks.","A Network Area can be enabled in several regions (one stackit_network_area_region per region); verify cross-region routing for multi-region AWS designs."],"evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_vpc* is experimental); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_vpc* still carries the experimental notice; stackit_network attributes unchanged from 0.116.0 (its block description lost the transitional ipv4_nameservers behaviour warning; the attribute description keeps the behaviour); stackit_network_area_region, stackit_security_group, stackit_security_group_rule, stackit_routing_table and stackit_routing_table_route schemas unchanged; no egress-only gateway, network ACL or internet-gateway resource; docs re-read: network, network_area_region, security_group, security_group_rule, routing_table); docs core-networking 2026-09-23","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: a resource of the estate (a subnet, route table, security group, network ACL, flow log, peering connection, a Cloud Control twin of those, ...) names a VPC by a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"vpc-main-table-undecided","severity":"warning","message":"The scan cannot say which route table is the main route table of this VPC: the VPC has count or for_each (or may be absent), an aws_main_route_table_association may name it through a value the scan cannot resolve (a variable, a literal ID, a conditional, a value from a module call), two resources set it (two main associations, or a main association and an aws_default_route_table on one VPC, which the provider documents as conflicting), or the table is a variable or lies outside the configuration. node.vpc_main_table carries the cause. Which table the VPC's subnets follow without an association of their own, and so what their routing and exposure are, is not decided here; the draft attaches no routing table through the main table.","evidence":["https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/main_route_table_association"],"blocker_category":"NETWORK"},{"check_id":"vpc-default-sg-no-ingress-rules","severity":"info","message":"The adopted default security group states no ingress rule. The AWS provider removes every rule of the default group when it adopts it and creates only the stated ones, so after apply the group allows no inbound traffic at all, not even from the members of the group itself. A new STACKIT security group allows no incoming traffic either, not even between its own members: they reach each other only through a rule whose remote_security_group_id is the group (tested on a STACKIT project on 2026-10-08, IPv4; the concepts page sentence that traffic from the same group is allowed holds for the project's default group, which carries explicit rules for its own members, not for a group you create), so in the ingress direction an empty STACKIT group equals the adopted group. IPv6 between members is not established (no IPv6 network could be created in the probed project). Nothing is drafted for the adopted group: decide which servers relied on the default group and attach them to a STACKIT group that states no ingress rule, not to the project's default group, whose own-member rules would admit its members.","evidence":["https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/default_security_group","https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","docs/benchmark/probes/2026-10-08_probe10_sg-intragroup-icmpv6/README.md","data/stackit/capabilities.yaml","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md"]},{"check_id":"vpc-default-sg-no-egress-rules","severity":"warning","message":"The adopted default security group states no egress rule. The AWS provider removes every rule of the default group when it adopts it and creates only the stated ones, so after apply the group allows no outbound traffic at all (the provider page calls this denying all egress by omitting the rules). A new STACKIT security group allows all outgoing traffic, so a server that moves onto a STACKIT group is wider than the source unless the allow-all egress rules are deleted after apply.","evidence":["https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/default_security_group","https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.vpc","expected":102,"observed":22,"accounted":22,"unaccounted":0,"critical_unaccounted":[],"critical_open":["network-topology-boundary","dns-settings","default-nacl-rules","default-route-table","default-security-group-omitted-direction","main-table-set","tcfp-default-network-acl--egress--action","tcfp-default-network-acl--egress--cidr-block","tcfp-default-network-acl--egress--from-port","tcfp-default-network-acl--egress--ipv6-cidr-block","tcfp-default-network-acl--egress--protocol","tcfp-default-network-acl--egress--rule-no","tcfp-default-network-acl--egress--to-port","tcfp-default-network-acl--ingress--action","tcfp-default-network-acl--ingress--cidr-block","tcfp-default-network-acl--ingress--from-port","tcfp-default-network-acl--ingress--ipv6-cidr-block","tcfp-default-network-acl--ingress--protocol","tcfp-default-network-acl--ingress--rule-no","tcfp-default-network-acl--ingress--to-port"],"items":[{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven"},{"id":"address-space","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:vpc"},{"id":"ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ipv6-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ipv6-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"default-tenancy","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:vpc"},{"id":"dedicated-tenancy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ipv6-egress-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"secondary-ranges","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"transit-attachment","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-transit-attachment--subnet-ids","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-transit-attachment--appliance-mode-support","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-transit-attachment--dns-support","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-transit-attachment--ipv6-support","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-transit-attachment--sg-referencing","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-transit-attachment--default-route-tables","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-transit-attachment--region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"dns-settings","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc"},{"id":"default-vpc","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"default-nacl-subnets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"default-nacl-rules","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc"},{"id":"default-nacl-rule-fields","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"default-nacl-rule-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"default-nacl-rule-allow-restricting","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"default-route-table","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:vpc-main-table-undecided"},{"id":"default-security-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"default-security-group-omitted-direction","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:vpc-default-sg-no-ingress-rules"},{"id":"default-security-group-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"default-security-group-exclusive-rule-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"main-route-table-routes","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"main-route-table-propagation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"main-route-table-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"main-route-table-reset","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"main-table-set","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:vpc-main-table-undecided"},{"id":"tcfp-default-network-acl--egress--action","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc","withdrawn_by":["default-nacl-rules"]},{"id":"tcfp-default-network-acl--egress--cidr-block","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc","withdrawn_by":["default-nacl-rules"]},{"id":"tcfp-default-network-acl--egress--from-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc","withdrawn_by":["default-nacl-rules"]},{"id":"tcfp-default-network-acl--egress--icmp-code","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-default-network-acl--egress--icmp-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-default-network-acl--egress--ipv6-cidr-block","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc","withdrawn_by":["default-nacl-rules"]},{"id":"tcfp-default-network-acl--egress--protocol","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc","withdrawn_by":["default-nacl-rules"]},{"id":"tcfp-default-network-acl--egress--rule-no","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc","withdrawn_by":["default-nacl-rules"]},{"id":"tcfp-default-network-acl--egress--to-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc","withdrawn_by":["default-nacl-rules"]},{"id":"tcfp-default-network-acl--ingress--action","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc","withdrawn_by":["default-nacl-rules"]},{"id":"tcfp-default-network-acl--ingress--cidr-block","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc","withdrawn_by":["default-nacl-rules"]},{"id":"tcfp-default-network-acl--ingress--from-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc","withdrawn_by":["default-nacl-rules"]},{"id":"tcfp-default-network-acl--ingress--icmp-code","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-default-network-acl--ingress--icmp-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-default-network-acl--ingress--ipv6-cidr-block","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc","withdrawn_by":["default-nacl-rules"]},{"id":"tcfp-default-network-acl--ingress--protocol","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc","withdrawn_by":["default-nacl-rules"]},{"id":"tcfp-default-network-acl--ingress--rule-no","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc","withdrawn_by":["default-nacl-rules"]},{"id":"tcfp-default-network-acl--ingress--to-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:vpc","withdrawn_by":["default-nacl-rules"]},{"id":"nbr-aws-apprunner-vpc-ingress-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ec2-carrier-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-internet-gateway-attachment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-networkmanager-vpc-attachment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-route53-resolver-config","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-route53-resolver-dnssec-config","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-route53-resolver-firewall-config","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-route53profiles-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-block-public-access-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-encryption-control","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-ipv6-cidr-block-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-security-group-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-target-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-ingress-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-launch-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-carrier-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-egress-only-internet-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-flow-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-local-gateway-route-table-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-acl","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-route-server-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-block-public-access-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-encryption-control","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-peering-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpcdhcp-options-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-target-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkfirewall-firewall","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkfirewall-vpc-endpoint-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkmanager-vpc-attachment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53-hosted-zone","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53profiles-profile-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-firewall-rule-group-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-config","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-dnssec-config","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-query-logging-config-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-rule-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-ipv4-cidr-block-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-ipv4-cidr-block-association-cidr-block","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-ipv4-cidr-block-association-ipv4-ipam-pool-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-ipv4-cidr-block-association-ipv4-netmask-length","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-ipv4-cidr-block-association-region","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT project networking / Network Area (SNA)","confidence":"MEDIUM"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"critical":[{"node":"module.vpc.module.vpc.aws_vpc.this","attribute":"enable_dns_hostnames","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.vpc/dns-settings:REVIEW"},{"node":"module.vpc.module.vpc.aws_vpc.this","attribute":"enable_dns_support","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.vpc/dns-settings:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_network_acl.this","attribute":"egress.action","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-nacl-rules:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_network_acl.this","attribute":"egress.cidr_block","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-nacl-rules:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_network_acl.this","attribute":"egress.from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-nacl-rules:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_network_acl.this","attribute":"egress.ipv6_cidr_block","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-nacl-rules:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_network_acl.this","attribute":"egress.protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-nacl-rules:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_network_acl.this","attribute":"egress.rule_no","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-nacl-rules:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_network_acl.this","attribute":"egress.to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-nacl-rules:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_network_acl.this","attribute":"ingress.action","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-nacl-rules:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_network_acl.this","attribute":"ingress.cidr_block","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-nacl-rules:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_network_acl.this","attribute":"ingress.from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-nacl-rules:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_network_acl.this","attribute":"ingress.ipv6_cidr_block","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-nacl-rules:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_network_acl.this","attribute":"ingress.protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-nacl-rules:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_network_acl.this","attribute":"ingress.rule_no","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-nacl-rules:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_network_acl.this","attribute":"ingress.to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-nacl-rules:REVIEW"},{"node":"module.vpc.module.vpc.aws_default_route_table.default","attribute":"propagating_vgws","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.vpc/default-route-table:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["default-security-group-omitted-direction","main-table-set","network-topology-boundary"],"gate_blockers":[{"source_type":"aws_default_network_acl","attribute":"egress.action","closure":"CLOSED:REVIEW"},{"source_type":"aws_default_network_acl","attribute":"egress.cidr_block","closure":"CLOSED:REVIEW"},{"source_type":"aws_default_network_acl","attribute":"egress.from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_default_network_acl","attribute":"egress.ipv6_cidr_block","closure":"CLOSED:REVIEW"},{"source_type":"aws_default_network_acl","attribute":"egress.protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_default_network_acl","attribute":"egress.rule_no","closure":"CLOSED:REVIEW"},{"source_type":"aws_default_network_acl","attribute":"egress.to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_default_network_acl","attribute":"ingress.action","closure":"CLOSED:REVIEW"},{"source_type":"aws_default_network_acl","attribute":"ingress.cidr_block","closure":"CLOSED:REVIEW"},{"source_type":"aws_default_network_acl","attribute":"ingress.from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_default_network_acl","attribute":"ingress.ipv6_cidr_block","closure":"CLOSED:REVIEW"},{"source_type":"aws_default_network_acl","attribute":"ingress.protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_default_network_acl","attribute":"ingress.rule_no","closure":"CLOSED:REVIEW"},{"source_type":"aws_default_network_acl","attribute":"ingress.to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_default_route_table","attribute":"propagating_vgws","closure":"CLOSED:REVIEW"},{"source_type":"aws_vpc","attribute":"enable_dns_hostnames","closure":"CLOSED:REVIEW"},{"source_type":"aws_vpc","attribute":"enable_dns_support","closure":"CLOSED:REVIEW"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"default-security-group-omitted-direction","closure":"open-critical-without-read-set"},{"semantic":"main-table-set","closure":"open-critical-without-read-set"}],"implicit":true}},{"id":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","source_type":"aws_secretsmanager_secret","category":"identity","kind":"secret","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs","facets":["module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch"],"configuration_completeness":"COMPLETE","depends_on":["module.retail_app_ecs.aws_kms_key.cmk"],"wave":2,"provenance":{"file":"../../lib/ecs/catalog.tf","line":82,"end_line":85},"result":{"rule_id":"aws.secretsmanager_secret","case_id":"secret","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Secrets Manager","resources":["stackit_secretsmanager_instance","stackit_secretsmanager_user"],"maturity":"ga","lifecycle":"active"},"reason":"Secrets move to STACKIT Secrets Manager (a Vault-compatible KV store). Applications switch from the AWS SDK to a Vault client or to injection via the platform (e.g. External Secrets Operator on SKE).","evidence":["https://docs.stackit.cloud/products/security/secrets-manager/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/secretsmanager_instance"],"validated_against":"terraform-provider-stackit@0.116.0; docs security/secrets-manager 2026-09-23","findings":[{"check_id":"secret-cmk","severity":"info","message":"The secret is encrypted with a customer-managed KMS key. STACKIT Secrets Manager can encrypt with a customer-chosen key too, but the AWS key does not move: the instance's kms_key block (stackit_secretsmanager_instance: key_id, key_ring_id, key_version, service_account_email) names a STACKIT KMS key, one key for all secret values of the instance. The draft sets that block only when every source of the shared instance is an AWS secret that references the same drafted key; otherwise it does not set it and names the key NOT CARRIED with the reason. Decide whether to create the key (stackit_kms_keyring, stackit_kms_key) and a service account with at least the Secrets Manager Reader role in the same project and region, put the kms_key block on the instance, and which secrets share an instance when they used different keys (one key per instance, not per secret). Without the block the instance uses STACKIT's default encryption.","evidence":["https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/secretsmanager_instance","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/secrets-manager/v1/secrets-manager.json"],"blocker_category":"COMPLIANCE"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.secretsmanager_secret","expected":34,"observed":3,"accounted":3,"unaccounted":0,"critical_unaccounted":[],"critical_open":["secret-value","customer-managed-key","tc-secretsmanager-secret-name"],"items":[{"id":"secret-value","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:secret"},{"id":"plain-parameter","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"plain-parameter-kind","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"plain-parameter-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rotation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"replication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"customer-managed-key","critical":true,"observed":"unknown","disposition":"REVIEW","by":"check:secret-cmk"},{"id":"default-key-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"recovery-window","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-secretsmanager-secret-force-overwrite-replica-secret","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ssm-parameter-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ssm-parameter-value-wo","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-policy--block-public-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--external-secret-rotation-metadata--key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--external-secret-rotation-metadata--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--rotation-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-version--secret-string-wo","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-version--version-stages","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-secretsmanager-secret-replica--region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-secretsmanager-secret-replica--kms-key-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfr-secretsmanager-secret-rotation--external-secret-rotation-role-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-secretsmanager-secret-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:secret"},{"id":"tc-ssm-parameter-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--external-secret-rotation-metadata--key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--external-secret-rotation-metadata--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--rotation-rules--automatically-after-days","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--rotation-rules--schedule-expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dx-macsec-key-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-distribution-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-secretsmanager-tag","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-job-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["COMPLIANCE","IDENTITY","UNKNOWN"],"target_platform":"STACKIT Secrets Manager","confidence":"MEDIUM"}},"property_accounting":{"set":4,"excluded":1,"meaningful":3,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":3,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","attribute":"kms_key_id"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","attribute":"name"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch","attribute":"secret_string"}],"class_counts":{"CRITICAL":3},"critical":[{"node":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","attribute":"kms_key_id","class":"CRITICAL","category":"encryption","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch): kms_key_id — the source encrypts with a customer-managed key that the draft does not set on the Secrets Manager instance: the instance also holds module.retail_app_ecs.aws_secretsmanager_secret.mq, which states no customer-managed key (the default key encrypts it), and it would be encrypted with the key too. The instance takes one STACKIT KMS key for all its secret values (kms_key); set it once the keys of the sources are decided. (contract aws.secretsmanager_secret/customer-managed-key:REVIEW)"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","attribute":"name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch): name — the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. (contract aws.secretsmanager_secret/tc-secretsmanager-secret-name:REVIEW)"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch","attribute":"secret_string","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch): secret_id, secret_string — a setting of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch: the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. (contract aws.secretsmanager_secret/secret-value:REVIEW)"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_secretsmanager_secret","attribute":"kms_key_id","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_secretsmanager_secret","attribute":"name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_secretsmanager_secret_version","attribute":"secret_string","closure":"CLOSED:NC+REVIEW"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.retail_app_ecs.module.alb.aws_security_group.this","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.alb","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":2,"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":807,"end_line":824},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT security groups are stateful rule sets like AWS's, including rules that reference another security group (remote_security_group_id). Rules are re-created one by one; CIDRs of AWS-internal ranges (VPC, prefix lists) must be replaced with STACKIT network prefixes.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"sg-egress-restricted","severity":"warning","message":"The source restricts egress (the AWS provider removes AWS's default allow-all egress rule; only the listed egress rules apply). Every new STACKIT security group gets two default egress rules, IPv4 and IPv6, with no ip range (any address), no protocol and no port restriction (the test of 2026-10-07, 2026-10-07: API read-back of a new group, docs concepts page), that stackit_security_group (the pinned STACKIT provider) does not manage — as generated, the draft allows all egress. After apply, delete them (stackit security-group rule list / delete --security-group-id \u003cid\u003e), or egress is wider than in the source.","evidence":["https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.security_group","expected":116,"observed":4,"accounted":4,"unaccounted":0,"critical_unaccounted":[],"critical_open":["egress-restriction","network-topology-boundary","security-group-vpc-membership","stateful"],"items":[{"id":"security-group-vpc-membership","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"check:topology-vpc-unproven"},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven"},{"id":"stateful","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"egress-restriction","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-egress-restricted"},{"id":"prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rule-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"revoke-rules-on-delete","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-ipv6-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-group-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-remote-group-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-direction-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-remote-not-resolved","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"exclusive-rule-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-ipv6-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-self","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--from-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--to-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--cidr-ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-security-group-rule-source-security-group-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-egress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dax-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-endpoint-security-group-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-security-group-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apigatewayv2-vpc-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-launch-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance-connect-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-launch-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-ingress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-verified-access-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-cache-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-replication-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-serverless-cache","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancing-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchservice-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security group","confidence":"MEDIUM"}},"property_accounting":{"set":3,"excluded":2,"meaningful":1,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":1,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.alb.aws_security_group.this","attribute":"vpc_id"}],"class_counts":{"CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.alb.aws_security_group.this","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+UNSUPPORTED","by":"plan: stackit_security_group.retail_app_ecs_alb_this vpc_id UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried (contract aws.security_group/security-group-vpc-membership:UNSUPPORTED)"}],"automation_eligible":false,"open_critical_without_read_set":["egress-restriction","network-topology-boundary","stateful"],"gate_blockers":[{"source_type":"aws_security_group","attribute":"vpc_id","closure":"CLOSED:NC+UNSUPPORTED"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"egress-restriction","closure":"open-critical-without-read-set"},{"semantic":"stateful","closure":"open-critical-without-read-set"}]}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.alb_sg","facets":["module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules"],"configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":2,"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":37,"end_line":60},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT security groups are stateful rule sets like AWS's, including rules that reference another security group (remote_security_group_id). Rules are re-created one by one; CIDRs of AWS-internal ranges (VPC, prefix lists) must be replaced with STACKIT network prefixes.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"sg-rule-not-rendered","severity":"warning","message":"At least one rule of this group is not in the draft as the source has it. The plan withholds it, holds it as a commented-out rule until a value or a decision is filled in, writes it with a fact that decides what it allows not carried exactly, or cannot name it at all because the source has more rules than are visible statically (a dynamic block over a collection, a count or a rule list that is not known until apply, or a list with a hidden member: the plan's INCOMPLETE action says which set and why, the draft's TODO \"rules beyond the known set\" names it, and only the known rules are drafted). Typical causes: a protocol, port or source whose value is known only at apply time or comes from a root variable; a source group that is a choice between groups or not a group of the draft; a protocol with no STACKIT counterpart; an ICMP type with every code; an ICMP or ICMPv6 rule whose range is of the other IP family (the API answers HTTP 400, the test of 2026-10-08); a tcp or udp rule with a negative port, a port above 65535, a reversed range, or port 0 only (STACKIT stores no port range for 0 to 0, so the rule would match every port). A tcp or udp range that starts at port 0 and ends below 65535 is written from port 1 (the STACKIT API rejects a range that starts at 0; tested on a STACKIT project on 2026-10-07): port 0 itself is not carried. A stackit_security_group_rule without protocol, port_range or source allows everything (the pinned STACKIT provider), so such a rule is never widened; re-create it with the values it needs (the plan names each one).","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/security_group_rule","https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpPermission.html","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md","docs/benchmark/probes/2026-10-07_probe7_vpc-wiring-portrange/README.md","docs/benchmark/probes/2026-10-08_probe10_sg-intragroup-icmpv6/README.md"]}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.security_group","expected":116,"observed":10,"accounted":10,"unaccounted":0,"critical_unaccounted":[],"critical_open":["network-topology-boundary","rule-ports","security-group-vpc-membership","standalone-rule-empty-sources","standalone-rule-other-sources","standalone-rule-values","stateful","tcfp-security-group-rule--from-port","tcfp-security-group-rule--to-port"],"items":[{"id":"security-group-vpc-membership","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"check:topology-vpc-unproven"},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven"},{"id":"stateful","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"egress-restriction","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-ports","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-rule-not-rendered"},{"id":"egress-rule-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"revoke-rules-on-delete","critical":false,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:sg"},{"id":"vpc-ingress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-ipv6-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-group-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-values","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-rule-not-rendered"},{"id":"own-resource-remote-group-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-direction-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-other-sources","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-rule-not-rendered"},{"id":"standalone-rule-empty-sources","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-rule-not-rendered"},{"id":"standalone-rule-remote-not-resolved","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"exclusive-rule-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-ipv6-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-self","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--from-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sg","withdrawn_by":["rule-ports"]},{"id":"tcfp-security-group-rule--to-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sg","withdrawn_by":["rule-ports"]},{"id":"tcfp-vpc-security-group-ingress-rule--cidr-ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-security-group-rule-source-security-group-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-egress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dax-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-endpoint-security-group-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-security-group-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apigatewayv2-vpc-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-launch-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance-connect-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-launch-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-ingress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-verified-access-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-cache-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-replication-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-serverless-cache","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancing-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchservice-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security group","confidence":"MEDIUM"}},"property_accounting":{"set":25,"excluded":9,"meaningful":16,"by_status":{"CONSUMED":0,"CONTRACT":1,"NOT_CARRIED":15,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","attribute":"vpc_id"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","attribute":"cidr_blocks"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","attribute":"from_port"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","attribute":"ipv6_cidr_blocks"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","attribute":"prefix_list_ids"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","attribute":"protocol"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","attribute":"to_port"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","attribute":"type"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","attribute":"cidr_blocks"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","attribute":"from_port"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","attribute":"ipv6_cidr_blocks"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","attribute":"prefix_list_ids"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","attribute":"protocol"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","attribute":"to_port"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","attribute":"type"}],"class_counts":{"CRITICAL":15,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+UNSUPPORTED","by":"plan: stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix vpc_id UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried (contract aws.security_group/security-group-vpc-membership:UNSUPPORTED)"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","attribute":"cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] (contract aws.security_group/standalone-rule-values:REVIEW)"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","attribute":"from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] (contract aws.security_group/rule-ports:REVIEW)"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","attribute":"ipv6_cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] (contract aws.security_group/standalone-rule-other-sources:REVIEW)"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","attribute":"prefix_list_ids","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] (contract aws.security_group/standalone-rule-other-sources:REVIEW)"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","attribute":"protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] (contract aws.security_group/standalone-rule-values:REVIEW)"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","attribute":"to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] (contract aws.security_group/rule-ports:REVIEW)"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","attribute":"type","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] (contract aws.security_group/standalone-rule-values:REVIEW)"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","attribute":"cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] (contract aws.security_group/standalone-rule-values:REVIEW)"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","attribute":"from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] (contract aws.security_group/rule-ports:REVIEW)"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","attribute":"ipv6_cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] (contract aws.security_group/standalone-rule-empty-sources:REVIEW)"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","attribute":"prefix_list_ids","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] (contract aws.security_group/standalone-rule-empty-sources:REVIEW)"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","attribute":"protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] (contract aws.security_group/standalone-rule-values:REVIEW)"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","attribute":"to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] (contract aws.security_group/rule-ports:REVIEW)"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","attribute":"type","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] (contract aws.security_group/standalone-rule-values:REVIEW)"}],"automation_eligible":false,"open_critical_without_read_set":["network-topology-boundary","stateful"],"gate_blockers":[{"source_type":"aws_security_group_rule","attribute":"cidr_blocks","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_security_group_rule","attribute":"from_port","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_security_group_rule","attribute":"ipv6_cidr_blocks","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_security_group_rule","attribute":"prefix_list_ids","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_security_group_rule","attribute":"protocol","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_security_group_rule","attribute":"to_port","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_security_group_rule","attribute":"type","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_security_group","attribute":"vpc_id","closure":"CLOSED:NC+UNSUPPORTED"},{"source_type":"aws_security_group","semantic":"awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","closure":"PLAN:manual-action"},{"source_type":"aws_security_group","semantic":"awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","closure":"PLAN:manual-action"},{"source_type":"aws_security_group","semantic":"awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]","closure":"PLAN:manual-action"},{"source_type":"aws_security_group","semantic":"awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]","closure":"PLAN:manual-action"},{"source_type":"aws_security_group","semantic":"awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","closure":"PLAN:open-item"},{"source_type":"aws_security_group","semantic":"awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","closure":"PLAN:open-item"},{"source_type":"aws_security_group","semantic":"awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]","closure":"PLAN:open-item"},{"source_type":"aws_security_group","semantic":"awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]","closure":"PLAN:open-item"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"stateful","closure":"open-critical-without-read-set"}]}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","source_type":"aws_iam_role","category":"identity","kind":"iam_role","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.carts_service","facets":["module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_logs","module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.ecs_exec","module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_role_additional"],"configuration_completeness":"CONDITIONAL","conditional_facets":[{"id":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_agent","source_type":"aws_iam_role_policy_attachment","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"switched_off":true}],"depends_on":["module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"],"wave":2,"provenance":{"file":"../../lib/ecs/service/iam.tf","line":31,"end_line":35},"result":{"rule_id":"aws.iam_role","case_id":"role-workload-execution","class":"RECONFIGURE","confidence":"LOW","target":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"Execution role of an application (Lambda function or ECS task). The application keeps needing these permissions on STACKIT: it gets a service account (or data-service credentials such as database users and object-storage keys) with equivalent grants.","review":["List what the attached policies allow (tables, buckets, queues) and grant the same on the STACKIT targets."],"evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam); SKE workload identity docs 2026-09-15; IAM checks of 2026-10-06: provider 0.117.0 schema, docs.stackit.cloud access-and-identity 2026-10-06; IAM notes wording (Act-As, S3 bucket policy carrier, Container Registry has no resource): provider 0.119.0 schema and the docs.stackit.cloud pages cited in the checks, checked 2026-10-11; iam-managed-ssm-instance wording: provider 0.119.0 schema (stackit_server agent), docs.stackit.cloud server-agent, run-command and server pages and the AWS AmazonSSMManagedInstanceCore and Systems Manager instance-permission pages, fetched 2026-10-12; role-ec2-no-profile: provider 0.119.0 docs stackit_server_service_account_attach and stackit_service_account, read 2026-11-01; role-ec2-no-profile skips a role an awscc_iam_instance_profile names: awscc 1.103.0 docs/resources/iam_instance_profile.md (roles), read 2026-11-01; role-instance-profile of an awscc_iam_instance_profile that holds the role exactly (2026-11-01): awscc 1.103.0 docs/resources/iam_instance_profile.md (roles: a Set of String, one role per EC2 instance) and the awscc provider source of the instance profile resource, instance_profile_resource_gen.go:114 (knowledge-base evidence, not in this folder: the primary identifier is the name), read 2026-11-01","findings":[{"check_id":"iam-trust-service-workload","severity":"info","message":"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. On STACKIT the workload runs as a service account (stackit_service_account) and nothing assumes it: it authenticates with a service account key (stackit_service_account_key, key flow) or, on SKE, by Workload Identity Federation (a federated identity provider on the account). What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","evidence":["https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","https://docs.stackit.cloud/platform/access-and-identity/service-accounts/authentication-flows/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_key","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_federated_identity_provider"]},{"check_id":"iam-managed-customer-policy","severity":"info","message":"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. STACKIT has no managed-policy object to attach: the permissions become role assignments of the service account (stackit_authorization_project_role_assignment: resource_id, role, subject), decided from the policy's document, whose shape is reported on the policy itself (a Deny, a Condition and sts:AssumeRole are UNSUPPORTED there; the service families s3, kms, secrets, logs, ec2 and iam name the STACKIT role or credential). What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several. — a variable's default, not a fact","evidence":["https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/","https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/custom-roles/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_role_assignment","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_custom_role"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table), whose own decision the target does not carry (it is REDESIGN), and the semantic contract of aws_iam_role does not read aws_dynamodb_table, so what the reference becomes is not assessed."},{"check_id":"iam-document-hidden","severity":"info","message":"jsonencode: the permission document of `module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_logs` is not visible statically: jsonencode, first hidden reference data.aws_region.current.name (a data source, read when a plan runs). `module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_logs` names it. What it allows or denies cannot be read, so the permission findings of this unit (Deny, Condition, sts:AssumeRole, the service families) do not cover it. What to decide: read the effective policy (aws iam get-role-policy, aws iam get-policy-version), or give the value the document is made of, so the document is visible."},{"check_id":"iam-document-hidden","severity":"info","message":"heredoc: the permission document of `module.dependencies.aws_iam_policy.carts_dynamo` is not visible statically: a heredoc, first hidden reference local.aws_partition (a data source, read when a plan runs). `module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_role_additional` names it. What it allows or denies cannot be read, so the permission findings of this unit (Deny, Condition, sts:AssumeRole, the service families) do not cover it. What to decide: read the effective policy (aws iam get-role-policy, aws iam get-policy-version), or give the value the document is made of, so the document is visible."}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.iam_role","expected":103,"observed":6,"accounted":6,"unaccounted":0,"critical_unaccounted":[],"critical_open":["iam-managed-customer-policy","iam-trust-service-workload","linked-dependency:aws_dynamodb_table","permissions","tcfp-iam-role-policy-attachment--policy-arn","trust"],"items":[{"id":"trust","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"permissions","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"facet-link-role","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:role-workload-execution"},{"id":"permissions-boundary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tag-conditioned-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-policy-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"instance-profile-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"force-detach","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"session-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-iam-role-policy-attachment-policy-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy-attachment--policy-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution","withdrawn_by":["iam-managed-customer-policy","permissions"]},{"id":"iam-trust-aws-principal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-cognito","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-conditions","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-oidc","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-saml","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-workload","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-trust-service-workload"},{"id":"iam-trust-service-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-principal-partly-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-customer-policy","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-managed-customer-policy"},{"id":"iam-managed-administrator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-poweruser","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-readonly","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ssm-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-cloudwatch-agent","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-registry-read","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-eks-internal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-sqs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ecs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-rds-monitoring","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-xray","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-application-insights","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-support","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-backup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-condition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-assume-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-wildcard-admin","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-not-action","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-kms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-secrets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-logs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ebs-snapshot-import","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-microvm","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-spot-fleet-request","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-auth-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-job-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-direct-connect-gateway-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-private-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-public-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-transit-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-dlm-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-enclave-certificate-iam-role-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-flow-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-spot-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-addon","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-fargate-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-pod-identity-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticbeanstalk-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-iam-managed-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-microvm-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-proton-environment-account-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"linked-dependency:aws_dynamodb_table","critical":true,"observed":"yes","disposition":"REVIEW","by":"linked-dependency:aws_dynamodb_table"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT service account for the workload","confidence":"LOW"}},"property_accounting":{"set":9,"excluded":4,"meaningful":5,"by_status":{"CONSUMED":0,"CONTRACT":3,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","attribute":"assume_role_policy"},{"node":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","attribute":"name"}],"class_counts":{"CRITICAL":4,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","attribute":"assume_role_policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated. (contract aws.iam_role/iam-trust-service-workload:REVIEW)"},{"node":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_logs","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-customer-policy:REVIEW"},{"node":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.ecs_exec","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-customer-policy:REVIEW"},{"node":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_role_additional","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/permissions:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["linked-dependency:aws_dynamodb_table"],"gate_blockers":[{"source_type":"aws_iam_role","attribute":"assume_role_policy","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_iam_role_policy_attachment","attribute":"policy_arn","closure":"CLOSED:REVIEW"},{"source_type":"aws_iam_role_policy_attachment","closure":"CONFIGURATION:conditional-facet"},{"target":"type:stackit_authorization_project_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"source_type":"aws_iam_policy","attribute":"policy","closure":"HIDDEN_DOCUMENT:heredoc"},{"source_type":"aws_iam_policy","attribute":"policy","closure":"HIDDEN_DOCUMENT:jsonencode"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"linked-dependency:aws_dynamodb_table","closure":"open-critical-without-read-set"}]}},{"id":"module.retail_app_ecs.module.carts_service.aws_security_group.this","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.carts_service","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":2,"provenance":{"file":"../../lib/ecs/service/sg.tf","line":1,"end_line":18},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT security groups are stateful rule sets like AWS's, including rules that reference another security group (remote_security_group_id). Rules are re-created one by one; CIDRs of AWS-internal ranges (VPC, prefix lists) must be replaced with STACKIT network prefixes.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.security_group","expected":116,"observed":7,"accounted":7,"unaccounted":0,"critical_unaccounted":[],"critical_open":["egress-rule-protocol","egress-sources","ingress-sources","network-topology-boundary","rule-ports","security-group-vpc-membership","stateful"],"items":[{"id":"security-group-vpc-membership","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"check:topology-vpc-unproven"},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven"},{"id":"stateful","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"egress-restriction","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-ports","critical":true,"observed":"yes","disposition":"LEDGER","by":"ledger:security group rules"},{"id":"egress-rule-protocol","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"ingress-sources","critical":true,"observed":"yes","disposition":"LEDGER","by":"ledger:security group rules"},{"id":"egress-sources","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"revoke-rules-on-delete","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-ipv6-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-group-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-remote-group-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-direction-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-remote-not-resolved","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"exclusive-rule-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-ipv6-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-self","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--from-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--to-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--cidr-ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-security-group-rule-source-security-group-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-egress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dax-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-endpoint-security-group-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-security-group-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apigatewayv2-vpc-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-launch-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance-connect-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-launch-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-ingress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-verified-access-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-cache-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-replication-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-serverless-cache","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancing-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchservice-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security group","confidence":"MEDIUM"}},"property_accounting":{"set":10,"excluded":0,"meaningful":10,"by_status":{"CONSUMED":0,"CONTRACT":8,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.carts_service.aws_security_group.this","attribute":"name"},{"node":"module.retail_app_ecs.module.carts_service.aws_security_group.this","attribute":"vpc_id"}],"class_counts":{"CRITICAL":9,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.carts_service.aws_security_group.this","attribute":"egress.cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/egress-sources:REVIEW"},{"node":"module.retail_app_ecs.module.carts_service.aws_security_group.this","attribute":"egress.from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.carts_service.aws_security_group.this","attribute":"egress.protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/egress-rule-protocol:REVIEW"},{"node":"module.retail_app_ecs.module.carts_service.aws_security_group.this","attribute":"egress.to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.carts_service.aws_security_group.this","attribute":"ingress.cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/ingress-sources:LEDGER"},{"node":"module.retail_app_ecs.module.carts_service.aws_security_group.this","attribute":"ingress.from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.carts_service.aws_security_group.this","attribute":"ingress.protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.carts_service.aws_security_group.this","attribute":"ingress.to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.carts_service.aws_security_group.this","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+UNSUPPORTED","by":"plan: stackit_security_group.retail_app_ecs_carts_service_this vpc_id UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried (contract aws.security_group/security-group-vpc-membership:UNSUPPORTED)"}],"automation_eligible":false,"open_critical_without_read_set":["network-topology-boundary","stateful"],"gate_blockers":[{"source_type":"aws_security_group","attribute":"vpc_id","closure":"CLOSED:NC+UNSUPPORTED"},{"source_type":"aws_security_group","attribute":"egress.cidr_blocks","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.cidr_blocks","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","semantic":"convert:module.retail_app_ecs.module.carts_service.aws_security_group.this:security-group:POD_SEGMENTATION","closure":"CONVERT:open-decision"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"stateful","closure":"open-critical-without-read-set"}]}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","source_type":"aws_iam_role","category":"identity","kind":"iam_role","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.catalog_service","facets":["module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_logs","module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.ecs_exec"],"configuration_completeness":"CONDITIONAL","conditional_facets":[{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_agent","source_type":"aws_iam_role_policy_attachment","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"switched_off":true}],"depends_on":["module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"],"wave":2,"provenance":{"file":"../../lib/ecs/service/iam.tf","line":31,"end_line":35},"result":{"rule_id":"aws.iam_role","case_id":"role-workload-execution","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"Execution role of an application (Lambda function or ECS task). The application keeps needing these permissions on STACKIT: it gets a service account (or data-service credentials such as database users and object-storage keys) with equivalent grants.","review":["List what the attached policies allow (tables, buckets, queues) and grant the same on the STACKIT targets."],"evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam); SKE workload identity docs 2026-09-15; IAM checks of 2026-10-06: provider 0.117.0 schema, docs.stackit.cloud access-and-identity 2026-10-06; IAM notes wording (Act-As, S3 bucket policy carrier, Container Registry has no resource): provider 0.119.0 schema and the docs.stackit.cloud pages cited in the checks, checked 2026-10-11; iam-managed-ssm-instance wording: provider 0.119.0 schema (stackit_server agent), docs.stackit.cloud server-agent, run-command and server pages and the AWS AmazonSSMManagedInstanceCore and Systems Manager instance-permission pages, fetched 2026-10-12; role-ec2-no-profile: provider 0.119.0 docs stackit_server_service_account_attach and stackit_service_account, read 2026-11-01; role-ec2-no-profile skips a role an awscc_iam_instance_profile names: awscc 1.103.0 docs/resources/iam_instance_profile.md (roles), read 2026-11-01; role-instance-profile of an awscc_iam_instance_profile that holds the role exactly (2026-11-01): awscc 1.103.0 docs/resources/iam_instance_profile.md (roles: a Set of String, one role per EC2 instance) and the awscc provider source of the instance profile resource, instance_profile_resource_gen.go:114 (knowledge-base evidence, not in this folder: the primary identifier is the name), read 2026-11-01","findings":[{"check_id":"iam-trust-service-workload","severity":"info","message":"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. On STACKIT the workload runs as a service account (stackit_service_account) and nothing assumes it: it authenticates with a service account key (stackit_service_account_key, key flow) or, on SKE, by Workload Identity Federation (a federated identity provider on the account). What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","evidence":["https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","https://docs.stackit.cloud/platform/access-and-identity/service-accounts/authentication-flows/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_key","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_federated_identity_provider"]},{"check_id":"iam-managed-customer-policy","severity":"info","message":"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. STACKIT has no managed-policy object to attach: the permissions become role assignments of the service account (stackit_authorization_project_role_assignment: resource_id, role, subject), decided from the policy's document, whose shape is reported on the policy itself (a Deny, a Condition and sts:AssumeRole are UNSUPPORTED there; the service families s3, kms, secrets, logs, ec2 and iam name the STACKIT role or credential). What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.","evidence":["https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/","https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/custom-roles/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_role_assignment","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_custom_role"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"iam-document-hidden","severity":"info","message":"jsonencode: the permission document of `module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_logs` is not visible statically: jsonencode, first hidden reference data.aws_region.current.name (a data source, read when a plan runs). `module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_logs` names it. What it allows or denies cannot be read, so the permission findings of this unit (Deny, Condition, sts:AssumeRole, the service families) do not cover it. What to decide: read the effective policy (aws iam get-role-policy, aws iam get-policy-version), or give the value the document is made of, so the document is visible."}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.iam_role","expected":103,"observed":6,"accounted":6,"unaccounted":0,"critical_unaccounted":[],"critical_open":["trust","permissions","tcfp-iam-role-policy-attachment--policy-arn","iam-trust-service-workload","iam-managed-customer-policy"],"items":[{"id":"trust","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"permissions","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"facet-link-role","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:role-workload-execution"},{"id":"permissions-boundary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tag-conditioned-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-policy-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"instance-profile-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"force-detach","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"session-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-iam-role-policy-attachment-policy-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy-attachment--policy-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution","withdrawn_by":["iam-managed-customer-policy","permissions"]},{"id":"iam-trust-aws-principal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-cognito","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-conditions","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-oidc","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-saml","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-workload","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-trust-service-workload"},{"id":"iam-trust-service-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-principal-partly-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-customer-policy","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-managed-customer-policy"},{"id":"iam-managed-administrator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-poweruser","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-readonly","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ssm-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-cloudwatch-agent","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-registry-read","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-eks-internal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-sqs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ecs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-rds-monitoring","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-xray","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-application-insights","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-support","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-backup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-condition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-assume-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-wildcard-admin","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-not-action","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-kms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-secrets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-logs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ebs-snapshot-import","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-microvm","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-spot-fleet-request","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-auth-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-job-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-direct-connect-gateway-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-private-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-public-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-transit-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-dlm-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-enclave-certificate-iam-role-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-flow-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-spot-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-addon","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-fargate-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-pod-identity-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticbeanstalk-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-iam-managed-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-microvm-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-proton-environment-account-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT service account for the workload","confidence":"MEDIUM"}},"property_accounting":{"set":7,"excluded":3,"meaningful":4,"by_status":{"CONSUMED":0,"CONTRACT":2,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","attribute":"assume_role_policy"},{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","attribute":"name"}],"class_counts":{"CRITICAL":3,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","attribute":"assume_role_policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated. (contract aws.iam_role/iam-trust-service-workload:REVIEW)"},{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_logs","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-customer-policy:REVIEW"},{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.ecs_exec","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-customer-policy:REVIEW"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_iam_role","attribute":"assume_role_policy","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_iam_role_policy_attachment","attribute":"policy_arn","closure":"CLOSED:REVIEW"},{"source_type":"aws_iam_role_policy_attachment","closure":"CONFIGURATION:conditional-facet"},{"target":"type:stackit_authorization_project_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"source_type":"aws_iam_policy","attribute":"policy","closure":"HIDDEN_DOCUMENT:jsonencode"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.catalog_service","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":2,"provenance":{"file":"../../lib/ecs/service/sg.tf","line":1,"end_line":18},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT security groups are stateful rule sets like AWS's, including rules that reference another security group (remote_security_group_id). Rules are re-created one by one; CIDRs of AWS-internal ranges (VPC, prefix lists) must be replaced with STACKIT network prefixes.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.security_group","expected":116,"observed":7,"accounted":7,"unaccounted":0,"critical_unaccounted":[],"critical_open":["egress-rule-protocol","egress-sources","ingress-sources","network-topology-boundary","rule-ports","security-group-vpc-membership","stateful"],"items":[{"id":"security-group-vpc-membership","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"check:topology-vpc-unproven"},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven"},{"id":"stateful","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"egress-restriction","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-ports","critical":true,"observed":"yes","disposition":"LEDGER","by":"ledger:security group rules"},{"id":"egress-rule-protocol","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"ingress-sources","critical":true,"observed":"yes","disposition":"LEDGER","by":"ledger:security group rules"},{"id":"egress-sources","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"revoke-rules-on-delete","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-ipv6-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-group-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-remote-group-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-direction-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-remote-not-resolved","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"exclusive-rule-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-ipv6-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-self","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--from-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--to-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--cidr-ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-security-group-rule-source-security-group-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-egress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dax-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-endpoint-security-group-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-security-group-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apigatewayv2-vpc-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-launch-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance-connect-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-launch-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-ingress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-verified-access-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-cache-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-replication-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-serverless-cache","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancing-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchservice-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security group","confidence":"MEDIUM"}},"property_accounting":{"set":10,"excluded":0,"meaningful":10,"by_status":{"CONSUMED":0,"CONTRACT":8,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","attribute":"name"},{"node":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","attribute":"vpc_id"}],"class_counts":{"CRITICAL":9,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","attribute":"egress.cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/egress-sources:REVIEW"},{"node":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","attribute":"egress.from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","attribute":"egress.protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/egress-rule-protocol:REVIEW"},{"node":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","attribute":"egress.to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","attribute":"ingress.cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/ingress-sources:LEDGER"},{"node":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","attribute":"ingress.from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","attribute":"ingress.protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","attribute":"ingress.to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+UNSUPPORTED","by":"plan: stackit_security_group.retail_app_ecs_catalog_service_this vpc_id UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried (contract aws.security_group/security-group-vpc-membership:UNSUPPORTED)"}],"automation_eligible":false,"open_critical_without_read_set":["network-topology-boundary","stateful"],"gate_blockers":[{"source_type":"aws_security_group","attribute":"vpc_id","closure":"CLOSED:NC+UNSUPPORTED"},{"source_type":"aws_security_group","attribute":"egress.cidr_blocks","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.cidr_blocks","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","semantic":"convert:module.retail_app_ecs.module.catalog_service.aws_security_group.this:security-group:POD_SEGMENTATION","closure":"CONVERT:open-decision"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"stateful","closure":"open-critical-without-read-set"}]}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","source_type":"aws_iam_role","category":"identity","kind":"iam_role","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.checkout_service","facets":["module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_logs","module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.ecs_exec","module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_role_additional"],"configuration_completeness":"CONDITIONAL","conditional_facets":[{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_agent","source_type":"aws_iam_role_policy_attachment","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"switched_off":true}],"depends_on":["module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"],"wave":2,"provenance":{"file":"../../lib/ecs/service/iam.tf","line":31,"end_line":35},"result":{"rule_id":"aws.iam_role","case_id":"role-workload-execution","class":"RECONFIGURE","confidence":"LOW","target":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"Execution role of an application (Lambda function or ECS task). The application keeps needing these permissions on STACKIT: it gets a service account (or data-service credentials such as database users and object-storage keys) with equivalent grants.","review":["List what the attached policies allow (tables, buckets, queues) and grant the same on the STACKIT targets."],"evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam); SKE workload identity docs 2026-09-15; IAM checks of 2026-10-06: provider 0.117.0 schema, docs.stackit.cloud access-and-identity 2026-10-06; IAM notes wording (Act-As, S3 bucket policy carrier, Container Registry has no resource): provider 0.119.0 schema and the docs.stackit.cloud pages cited in the checks, checked 2026-10-11; iam-managed-ssm-instance wording: provider 0.119.0 schema (stackit_server agent), docs.stackit.cloud server-agent, run-command and server pages and the AWS AmazonSSMManagedInstanceCore and Systems Manager instance-permission pages, fetched 2026-10-12; role-ec2-no-profile: provider 0.119.0 docs stackit_server_service_account_attach and stackit_service_account, read 2026-11-01; role-ec2-no-profile skips a role an awscc_iam_instance_profile names: awscc 1.103.0 docs/resources/iam_instance_profile.md (roles), read 2026-11-01; role-instance-profile of an awscc_iam_instance_profile that holds the role exactly (2026-11-01): awscc 1.103.0 docs/resources/iam_instance_profile.md (roles: a Set of String, one role per EC2 instance) and the awscc provider source of the instance profile resource, instance_profile_resource_gen.go:114 (knowledge-base evidence, not in this folder: the primary identifier is the name), read 2026-11-01","findings":[{"check_id":"iam-trust-service-workload","severity":"info","message":"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. On STACKIT the workload runs as a service account (stackit_service_account) and nothing assumes it: it authenticates with a service account key (stackit_service_account_key, key flow) or, on SKE, by Workload Identity Federation (a federated identity provider on the account). What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","evidence":["https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","https://docs.stackit.cloud/platform/access-and-identity/service-accounts/authentication-flows/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_key","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_federated_identity_provider"]},{"check_id":"iam-managed-customer-policy","severity":"info","message":"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. STACKIT has no managed-policy object to attach: the permissions become role assignments of the service account (stackit_authorization_project_role_assignment: resource_id, role, subject), decided from the policy's document, whose shape is reported on the policy itself (a Deny, a Condition and sts:AssumeRole are UNSUPPORTED there; the service families s3, kms, secrets, logs, ec2 and iam name the STACKIT role or credential). What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several. — a variable's default, not a fact","evidence":["https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/","https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/custom-roles/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_role_assignment","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_custom_role"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table), whose own decision the target does not carry (it is REDESIGN), and the semantic contract of aws_iam_role does not read aws_dynamodb_table, so what the reference becomes is not assessed."},{"check_id":"iam-document-hidden","severity":"info","message":"jsonencode: the permission document of `module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_logs` is not visible statically: jsonencode, first hidden reference data.aws_region.current.name (a data source, read when a plan runs). `module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_logs` names it. What it allows or denies cannot be read, so the permission findings of this unit (Deny, Condition, sts:AssumeRole, the service families) do not cover it. What to decide: read the effective policy (aws iam get-role-policy, aws iam get-policy-version), or give the value the document is made of, so the document is visible."},{"check_id":"iam-document-hidden","severity":"info","message":"heredoc: the permission document of `module.dependencies.aws_iam_policy.carts_dynamo` is not visible statically: a heredoc, first hidden reference local.aws_partition (a data source, read when a plan runs). `module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_role_additional` names it. What it allows or denies cannot be read, so the permission findings of this unit (Deny, Condition, sts:AssumeRole, the service families) do not cover it. What to decide: read the effective policy (aws iam get-role-policy, aws iam get-policy-version), or give the value the document is made of, so the document is visible."}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.iam_role","expected":103,"observed":6,"accounted":6,"unaccounted":0,"critical_unaccounted":[],"critical_open":["iam-managed-customer-policy","iam-trust-service-workload","linked-dependency:aws_dynamodb_table","permissions","tcfp-iam-role-policy-attachment--policy-arn","trust"],"items":[{"id":"trust","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"permissions","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"facet-link-role","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:role-workload-execution"},{"id":"permissions-boundary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tag-conditioned-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-policy-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"instance-profile-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"force-detach","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"session-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-iam-role-policy-attachment-policy-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy-attachment--policy-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution","withdrawn_by":["iam-managed-customer-policy","permissions"]},{"id":"iam-trust-aws-principal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-cognito","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-conditions","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-oidc","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-saml","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-workload","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-trust-service-workload"},{"id":"iam-trust-service-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-principal-partly-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-customer-policy","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-managed-customer-policy"},{"id":"iam-managed-administrator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-poweruser","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-readonly","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ssm-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-cloudwatch-agent","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-registry-read","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-eks-internal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-sqs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ecs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-rds-monitoring","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-xray","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-application-insights","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-support","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-backup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-condition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-assume-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-wildcard-admin","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-not-action","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-kms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-secrets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-logs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ebs-snapshot-import","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-microvm","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-spot-fleet-request","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-auth-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-job-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-direct-connect-gateway-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-private-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-public-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-transit-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-dlm-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-enclave-certificate-iam-role-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-flow-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-spot-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-addon","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-fargate-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-pod-identity-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticbeanstalk-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-iam-managed-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-microvm-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-proton-environment-account-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"linked-dependency:aws_dynamodb_table","critical":true,"observed":"yes","disposition":"REVIEW","by":"linked-dependency:aws_dynamodb_table"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT service account for the workload","confidence":"LOW"}},"property_accounting":{"set":9,"excluded":4,"meaningful":5,"by_status":{"CONSUMED":0,"CONTRACT":3,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","attribute":"assume_role_policy"},{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","attribute":"name"}],"class_counts":{"CRITICAL":4,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","attribute":"assume_role_policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated. (contract aws.iam_role/iam-trust-service-workload:REVIEW)"},{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_logs","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-customer-policy:REVIEW"},{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.ecs_exec","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-customer-policy:REVIEW"},{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_role_additional","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/permissions:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["linked-dependency:aws_dynamodb_table"],"gate_blockers":[{"source_type":"aws_iam_role","attribute":"assume_role_policy","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_iam_role_policy_attachment","attribute":"policy_arn","closure":"CLOSED:REVIEW"},{"source_type":"aws_iam_role_policy_attachment","closure":"CONFIGURATION:conditional-facet"},{"target":"type:stackit_authorization_project_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"source_type":"aws_iam_policy","attribute":"policy","closure":"HIDDEN_DOCUMENT:heredoc"},{"source_type":"aws_iam_policy","attribute":"policy","closure":"HIDDEN_DOCUMENT:jsonencode"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"linked-dependency:aws_dynamodb_table","closure":"open-critical-without-read-set"}]}},{"id":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.checkout_service","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":2,"provenance":{"file":"../../lib/ecs/service/sg.tf","line":1,"end_line":18},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT security groups are stateful rule sets like AWS's, including rules that reference another security group (remote_security_group_id). Rules are re-created one by one; CIDRs of AWS-internal ranges (VPC, prefix lists) must be replaced with STACKIT network prefixes.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.security_group","expected":116,"observed":7,"accounted":7,"unaccounted":0,"critical_unaccounted":[],"critical_open":["egress-rule-protocol","egress-sources","ingress-sources","network-topology-boundary","rule-ports","security-group-vpc-membership","stateful"],"items":[{"id":"security-group-vpc-membership","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"check:topology-vpc-unproven"},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven"},{"id":"stateful","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"egress-restriction","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-ports","critical":true,"observed":"yes","disposition":"LEDGER","by":"ledger:security group rules"},{"id":"egress-rule-protocol","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"ingress-sources","critical":true,"observed":"yes","disposition":"LEDGER","by":"ledger:security group rules"},{"id":"egress-sources","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"revoke-rules-on-delete","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-ipv6-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-group-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-remote-group-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-direction-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-remote-not-resolved","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"exclusive-rule-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-ipv6-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-self","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--from-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--to-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--cidr-ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-security-group-rule-source-security-group-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-egress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dax-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-endpoint-security-group-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-security-group-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apigatewayv2-vpc-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-launch-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance-connect-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-launch-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-ingress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-verified-access-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-cache-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-replication-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-serverless-cache","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancing-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchservice-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security group","confidence":"MEDIUM"}},"property_accounting":{"set":10,"excluded":0,"meaningful":10,"by_status":{"CONSUMED":0,"CONTRACT":8,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","attribute":"name"},{"node":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","attribute":"vpc_id"}],"class_counts":{"CRITICAL":9,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","attribute":"egress.cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/egress-sources:REVIEW"},{"node":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","attribute":"egress.from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","attribute":"egress.protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/egress-rule-protocol:REVIEW"},{"node":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","attribute":"egress.to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","attribute":"ingress.cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/ingress-sources:LEDGER"},{"node":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","attribute":"ingress.from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","attribute":"ingress.protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","attribute":"ingress.to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+UNSUPPORTED","by":"plan: stackit_security_group.retail_app_ecs_checkout_service_this vpc_id UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried (contract aws.security_group/security-group-vpc-membership:UNSUPPORTED)"}],"automation_eligible":false,"open_critical_without_read_set":["network-topology-boundary","stateful"],"gate_blockers":[{"source_type":"aws_security_group","attribute":"vpc_id","closure":"CLOSED:NC+UNSUPPORTED"},{"source_type":"aws_security_group","attribute":"egress.cidr_blocks","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.cidr_blocks","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","semantic":"convert:module.retail_app_ecs.module.checkout_service.aws_security_group.this:security-group:POD_SEGMENTATION","closure":"CONVERT:open-decision"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"stateful","closure":"open-critical-without-read-set"}]}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","source_type":"aws_iam_role","category":"identity","kind":"iam_role","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.orders_service","facets":["module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_logs","module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.ecs_exec"],"configuration_completeness":"CONDITIONAL","conditional_facets":[{"id":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_agent","source_type":"aws_iam_role_policy_attachment","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"switched_off":true}],"depends_on":["module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"],"wave":2,"provenance":{"file":"../../lib/ecs/service/iam.tf","line":31,"end_line":35},"result":{"rule_id":"aws.iam_role","case_id":"role-workload-execution","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"Execution role of an application (Lambda function or ECS task). The application keeps needing these permissions on STACKIT: it gets a service account (or data-service credentials such as database users and object-storage keys) with equivalent grants.","review":["List what the attached policies allow (tables, buckets, queues) and grant the same on the STACKIT targets."],"evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam); SKE workload identity docs 2026-09-15; IAM checks of 2026-10-06: provider 0.117.0 schema, docs.stackit.cloud access-and-identity 2026-10-06; IAM notes wording (Act-As, S3 bucket policy carrier, Container Registry has no resource): provider 0.119.0 schema and the docs.stackit.cloud pages cited in the checks, checked 2026-10-11; iam-managed-ssm-instance wording: provider 0.119.0 schema (stackit_server agent), docs.stackit.cloud server-agent, run-command and server pages and the AWS AmazonSSMManagedInstanceCore and Systems Manager instance-permission pages, fetched 2026-10-12; role-ec2-no-profile: provider 0.119.0 docs stackit_server_service_account_attach and stackit_service_account, read 2026-11-01; role-ec2-no-profile skips a role an awscc_iam_instance_profile names: awscc 1.103.0 docs/resources/iam_instance_profile.md (roles), read 2026-11-01; role-instance-profile of an awscc_iam_instance_profile that holds the role exactly (2026-11-01): awscc 1.103.0 docs/resources/iam_instance_profile.md (roles: a Set of String, one role per EC2 instance) and the awscc provider source of the instance profile resource, instance_profile_resource_gen.go:114 (knowledge-base evidence, not in this folder: the primary identifier is the name), read 2026-11-01","findings":[{"check_id":"iam-trust-service-workload","severity":"info","message":"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. On STACKIT the workload runs as a service account (stackit_service_account) and nothing assumes it: it authenticates with a service account key (stackit_service_account_key, key flow) or, on SKE, by Workload Identity Federation (a federated identity provider on the account). What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","evidence":["https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","https://docs.stackit.cloud/platform/access-and-identity/service-accounts/authentication-flows/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_key","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_federated_identity_provider"]},{"check_id":"iam-managed-customer-policy","severity":"info","message":"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. STACKIT has no managed-policy object to attach: the permissions become role assignments of the service account (stackit_authorization_project_role_assignment: resource_id, role, subject), decided from the policy's document, whose shape is reported on the policy itself (a Deny, a Condition and sts:AssumeRole are UNSUPPORTED there; the service families s3, kms, secrets, logs, ec2 and iam name the STACKIT role or credential). What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.","evidence":["https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/","https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/custom-roles/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_role_assignment","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_custom_role"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"iam-document-hidden","severity":"info","message":"jsonencode: the permission document of `module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_logs` is not visible statically: jsonencode, first hidden reference data.aws_region.current.name (a data source, read when a plan runs). `module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_logs` names it. What it allows or denies cannot be read, so the permission findings of this unit (Deny, Condition, sts:AssumeRole, the service families) do not cover it. What to decide: read the effective policy (aws iam get-role-policy, aws iam get-policy-version), or give the value the document is made of, so the document is visible."}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.iam_role","expected":103,"observed":6,"accounted":6,"unaccounted":0,"critical_unaccounted":[],"critical_open":["trust","permissions","tcfp-iam-role-policy-attachment--policy-arn","iam-trust-service-workload","iam-managed-customer-policy"],"items":[{"id":"trust","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"permissions","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"facet-link-role","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:role-workload-execution"},{"id":"permissions-boundary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tag-conditioned-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-policy-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"instance-profile-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"force-detach","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"session-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-iam-role-policy-attachment-policy-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy-attachment--policy-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution","withdrawn_by":["iam-managed-customer-policy","permissions"]},{"id":"iam-trust-aws-principal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-cognito","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-conditions","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-oidc","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-saml","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-workload","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-trust-service-workload"},{"id":"iam-trust-service-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-principal-partly-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-customer-policy","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-managed-customer-policy"},{"id":"iam-managed-administrator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-poweruser","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-readonly","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ssm-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-cloudwatch-agent","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-registry-read","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-eks-internal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-sqs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ecs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-rds-monitoring","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-xray","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-application-insights","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-support","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-backup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-condition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-assume-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-wildcard-admin","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-not-action","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-kms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-secrets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-logs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ebs-snapshot-import","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-microvm","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-spot-fleet-request","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-auth-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-job-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-direct-connect-gateway-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-private-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-public-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-transit-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-dlm-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-enclave-certificate-iam-role-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-flow-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-spot-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-addon","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-fargate-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-pod-identity-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticbeanstalk-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-iam-managed-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-microvm-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-proton-environment-account-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT service account for the workload","confidence":"MEDIUM"}},"property_accounting":{"set":7,"excluded":3,"meaningful":4,"by_status":{"CONSUMED":0,"CONTRACT":2,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","attribute":"assume_role_policy"},{"node":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","attribute":"name"}],"class_counts":{"CRITICAL":3,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","attribute":"assume_role_policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated. (contract aws.iam_role/iam-trust-service-workload:REVIEW)"},{"node":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_logs","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-customer-policy:REVIEW"},{"node":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.ecs_exec","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-customer-policy:REVIEW"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_iam_role","attribute":"assume_role_policy","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_iam_role_policy_attachment","attribute":"policy_arn","closure":"CLOSED:REVIEW"},{"source_type":"aws_iam_role_policy_attachment","closure":"CONFIGURATION:conditional-facet"},{"target":"type:stackit_authorization_project_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"source_type":"aws_iam_policy","attribute":"policy","closure":"HIDDEN_DOCUMENT:jsonencode"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.retail_app_ecs.module.orders_service.aws_security_group.this","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.orders_service","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":2,"provenance":{"file":"../../lib/ecs/service/sg.tf","line":1,"end_line":18},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT security groups are stateful rule sets like AWS's, including rules that reference another security group (remote_security_group_id). Rules are re-created one by one; CIDRs of AWS-internal ranges (VPC, prefix lists) must be replaced with STACKIT network prefixes.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.security_group","expected":116,"observed":7,"accounted":7,"unaccounted":0,"critical_unaccounted":[],"critical_open":["egress-rule-protocol","egress-sources","ingress-sources","network-topology-boundary","rule-ports","security-group-vpc-membership","stateful"],"items":[{"id":"security-group-vpc-membership","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"check:topology-vpc-unproven"},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven"},{"id":"stateful","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"egress-restriction","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-ports","critical":true,"observed":"yes","disposition":"LEDGER","by":"ledger:security group rules"},{"id":"egress-rule-protocol","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"ingress-sources","critical":true,"observed":"yes","disposition":"LEDGER","by":"ledger:security group rules"},{"id":"egress-sources","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"revoke-rules-on-delete","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-ipv6-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-group-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-remote-group-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-direction-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-remote-not-resolved","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"exclusive-rule-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-ipv6-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-self","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--from-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--to-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--cidr-ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-security-group-rule-source-security-group-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-egress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dax-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-endpoint-security-group-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-security-group-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apigatewayv2-vpc-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-launch-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance-connect-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-launch-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-ingress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-verified-access-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-cache-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-replication-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-serverless-cache","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancing-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchservice-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security group","confidence":"MEDIUM"}},"property_accounting":{"set":10,"excluded":0,"meaningful":10,"by_status":{"CONSUMED":0,"CONTRACT":8,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.orders_service.aws_security_group.this","attribute":"name"},{"node":"module.retail_app_ecs.module.orders_service.aws_security_group.this","attribute":"vpc_id"}],"class_counts":{"CRITICAL":9,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.orders_service.aws_security_group.this","attribute":"egress.cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/egress-sources:REVIEW"},{"node":"module.retail_app_ecs.module.orders_service.aws_security_group.this","attribute":"egress.from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.orders_service.aws_security_group.this","attribute":"egress.protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/egress-rule-protocol:REVIEW"},{"node":"module.retail_app_ecs.module.orders_service.aws_security_group.this","attribute":"egress.to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.orders_service.aws_security_group.this","attribute":"ingress.cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/ingress-sources:LEDGER"},{"node":"module.retail_app_ecs.module.orders_service.aws_security_group.this","attribute":"ingress.from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.orders_service.aws_security_group.this","attribute":"ingress.protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.orders_service.aws_security_group.this","attribute":"ingress.to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.orders_service.aws_security_group.this","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+UNSUPPORTED","by":"plan: stackit_security_group.retail_app_ecs_orders_service_this vpc_id UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried (contract aws.security_group/security-group-vpc-membership:UNSUPPORTED)"}],"automation_eligible":false,"open_critical_without_read_set":["network-topology-boundary","stateful"],"gate_blockers":[{"source_type":"aws_security_group","attribute":"vpc_id","closure":"CLOSED:NC+UNSUPPORTED"},{"source_type":"aws_security_group","attribute":"egress.cidr_blocks","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.cidr_blocks","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","semantic":"convert:module.retail_app_ecs.module.orders_service.aws_security_group.this:security-group:POD_SEGMENTATION","closure":"CONVERT:open-decision"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"stateful","closure":"open-critical-without-read-set"}]}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","source_type":"aws_iam_role","category":"identity","kind":"iam_role","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.ui_service","facets":["module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_logs","module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.ecs_exec"],"configuration_completeness":"CONDITIONAL","conditional_facets":[{"id":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_agent","source_type":"aws_iam_role_policy_attachment","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"switched_off":true}],"depends_on":["module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"],"wave":2,"provenance":{"file":"../../lib/ecs/service/iam.tf","line":31,"end_line":35},"result":{"rule_id":"aws.iam_role","case_id":"role-workload-execution","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"Execution role of an application (Lambda function or ECS task). The application keeps needing these permissions on STACKIT: it gets a service account (or data-service credentials such as database users and object-storage keys) with equivalent grants.","review":["List what the attached policies allow (tables, buckets, queues) and grant the same on the STACKIT targets."],"evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam); SKE workload identity docs 2026-09-15; IAM checks of 2026-10-06: provider 0.117.0 schema, docs.stackit.cloud access-and-identity 2026-10-06; IAM notes wording (Act-As, S3 bucket policy carrier, Container Registry has no resource): provider 0.119.0 schema and the docs.stackit.cloud pages cited in the checks, checked 2026-10-11; iam-managed-ssm-instance wording: provider 0.119.0 schema (stackit_server agent), docs.stackit.cloud server-agent, run-command and server pages and the AWS AmazonSSMManagedInstanceCore and Systems Manager instance-permission pages, fetched 2026-10-12; role-ec2-no-profile: provider 0.119.0 docs stackit_server_service_account_attach and stackit_service_account, read 2026-11-01; role-ec2-no-profile skips a role an awscc_iam_instance_profile names: awscc 1.103.0 docs/resources/iam_instance_profile.md (roles), read 2026-11-01; role-instance-profile of an awscc_iam_instance_profile that holds the role exactly (2026-11-01): awscc 1.103.0 docs/resources/iam_instance_profile.md (roles: a Set of String, one role per EC2 instance) and the awscc provider source of the instance profile resource, instance_profile_resource_gen.go:114 (knowledge-base evidence, not in this folder: the primary identifier is the name), read 2026-11-01","findings":[{"check_id":"iam-trust-service-workload","severity":"info","message":"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. On STACKIT the workload runs as a service account (stackit_service_account) and nothing assumes it: it authenticates with a service account key (stackit_service_account_key, key flow) or, on SKE, by Workload Identity Federation (a federated identity provider on the account). What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","evidence":["https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","https://docs.stackit.cloud/platform/access-and-identity/service-accounts/authentication-flows/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_key","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_federated_identity_provider"]},{"check_id":"iam-managed-customer-policy","severity":"info","message":"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. STACKIT has no managed-policy object to attach: the permissions become role assignments of the service account (stackit_authorization_project_role_assignment: resource_id, role, subject), decided from the policy's document, whose shape is reported on the policy itself (a Deny, a Condition and sts:AssumeRole are UNSUPPORTED there; the service families s3, kms, secrets, logs, ec2 and iam name the STACKIT role or credential). What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.","evidence":["https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/","https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/custom-roles/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_role_assignment","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_custom_role"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"iam-document-hidden","severity":"info","message":"jsonencode: the permission document of `module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_logs` is not visible statically: jsonencode, first hidden reference data.aws_region.current.name (a data source, read when a plan runs). `module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_logs` names it. What it allows or denies cannot be read, so the permission findings of this unit (Deny, Condition, sts:AssumeRole, the service families) do not cover it. What to decide: read the effective policy (aws iam get-role-policy, aws iam get-policy-version), or give the value the document is made of, so the document is visible."}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.iam_role","expected":103,"observed":6,"accounted":6,"unaccounted":0,"critical_unaccounted":[],"critical_open":["trust","permissions","tcfp-iam-role-policy-attachment--policy-arn","iam-trust-service-workload","iam-managed-customer-policy"],"items":[{"id":"trust","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"permissions","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"facet-link-role","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:role-workload-execution"},{"id":"permissions-boundary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tag-conditioned-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-policy-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"instance-profile-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"force-detach","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"session-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-iam-role-policy-attachment-policy-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy-attachment--policy-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution","withdrawn_by":["iam-managed-customer-policy","permissions"]},{"id":"iam-trust-aws-principal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-cognito","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-conditions","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-oidc","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-saml","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-workload","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-trust-service-workload"},{"id":"iam-trust-service-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-principal-partly-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-customer-policy","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-managed-customer-policy"},{"id":"iam-managed-administrator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-poweruser","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-readonly","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ssm-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-cloudwatch-agent","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-registry-read","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-eks-internal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-sqs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ecs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-rds-monitoring","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-xray","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-application-insights","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-support","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-backup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-condition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-assume-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-wildcard-admin","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-not-action","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-kms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-secrets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-logs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ebs-snapshot-import","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-microvm","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-spot-fleet-request","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-auth-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-job-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-direct-connect-gateway-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-private-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-public-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-transit-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-dlm-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-enclave-certificate-iam-role-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-flow-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-spot-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-addon","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-fargate-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-pod-identity-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticbeanstalk-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-iam-managed-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-microvm-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-proton-environment-account-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT service account for the workload","confidence":"MEDIUM"}},"property_accounting":{"set":7,"excluded":3,"meaningful":4,"by_status":{"CONSUMED":0,"CONTRACT":2,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","attribute":"assume_role_policy"},{"node":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","attribute":"name"}],"class_counts":{"CRITICAL":3,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","attribute":"assume_role_policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated. (contract aws.iam_role/iam-trust-service-workload:REVIEW)"},{"node":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_logs","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-customer-policy:REVIEW"},{"node":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.ecs_exec","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-customer-policy:REVIEW"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_iam_role","attribute":"assume_role_policy","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_iam_role_policy_attachment","attribute":"policy_arn","closure":"CLOSED:REVIEW"},{"source_type":"aws_iam_role_policy_attachment","closure":"CONFIGURATION:conditional-facet"},{"target":"type:stackit_authorization_project_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"source_type":"aws_iam_policy","attribute":"policy","closure":"HIDDEN_DOCUMENT:jsonencode"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.retail_app_ecs.module.ui_service.aws_security_group.this","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.ui_service","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":2,"provenance":{"file":"../../lib/ecs/service/sg.tf","line":1,"end_line":18},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT security groups are stateful rule sets like AWS's, including rules that reference another security group (remote_security_group_id). Rules are re-created one by one; CIDRs of AWS-internal ranges (VPC, prefix lists) must be replaced with STACKIT network prefixes.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.security_group","expected":116,"observed":7,"accounted":7,"unaccounted":0,"critical_unaccounted":[],"critical_open":["egress-rule-protocol","egress-sources","ingress-sources","network-topology-boundary","rule-ports","security-group-vpc-membership","stateful"],"items":[{"id":"security-group-vpc-membership","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"check:topology-vpc-unproven"},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven"},{"id":"stateful","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"egress-restriction","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-ports","critical":true,"observed":"yes","disposition":"LEDGER","by":"ledger:security group rules"},{"id":"egress-rule-protocol","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"ingress-sources","critical":true,"observed":"yes","disposition":"LEDGER","by":"ledger:security group rules"},{"id":"egress-sources","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"revoke-rules-on-delete","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-ipv6-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-group-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-remote-group-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-direction-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-remote-not-resolved","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"exclusive-rule-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-ipv6-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-self","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--from-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--to-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--cidr-ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-security-group-rule-source-security-group-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-egress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dax-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-endpoint-security-group-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-security-group-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apigatewayv2-vpc-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-launch-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance-connect-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-launch-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-ingress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-verified-access-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-cache-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-replication-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-serverless-cache","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancing-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchservice-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security group","confidence":"MEDIUM"}},"property_accounting":{"set":10,"excluded":0,"meaningful":10,"by_status":{"CONSUMED":0,"CONTRACT":8,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.ui_service.aws_security_group.this","attribute":"name"},{"node":"module.retail_app_ecs.module.ui_service.aws_security_group.this","attribute":"vpc_id"}],"class_counts":{"CRITICAL":9,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.ui_service.aws_security_group.this","attribute":"egress.cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/egress-sources:REVIEW"},{"node":"module.retail_app_ecs.module.ui_service.aws_security_group.this","attribute":"egress.from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.ui_service.aws_security_group.this","attribute":"egress.protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/egress-rule-protocol:REVIEW"},{"node":"module.retail_app_ecs.module.ui_service.aws_security_group.this","attribute":"egress.to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.ui_service.aws_security_group.this","attribute":"ingress.cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/ingress-sources:LEDGER"},{"node":"module.retail_app_ecs.module.ui_service.aws_security_group.this","attribute":"ingress.from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.ui_service.aws_security_group.this","attribute":"ingress.protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.ui_service.aws_security_group.this","attribute":"ingress.to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:LEDGER"},{"node":"module.retail_app_ecs.module.ui_service.aws_security_group.this","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+UNSUPPORTED","by":"plan: stackit_security_group.retail_app_ecs_ui_service_this vpc_id UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried (contract aws.security_group/security-group-vpc-membership:UNSUPPORTED)"}],"automation_eligible":false,"open_critical_without_read_set":["network-topology-boundary","stateful"],"gate_blockers":[{"source_type":"aws_security_group","attribute":"vpc_id","closure":"CLOSED:NC+UNSUPPORTED"},{"source_type":"aws_security_group","attribute":"egress.cidr_blocks","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"egress.to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.cidr_blocks","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"ingress.to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","semantic":"convert:module.retail_app_ecs.module.ui_service.aws_security_group.this:security-group:POD_SEGMENTATION","closure":"CONVERT:open-decision"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"stateful","closure":"open-critical-without-read-set"}]}},{"id":"module.vpc.module.vpc.aws_nat_gateway.this","source_type":"aws_nat_gateway","category":"network","kind":"nat_gateway","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.vpc.module.vpc","open_dependencies":["module.vpc.module.vpc.aws_internet_gateway.this","module.vpc.module.vpc.aws_subnet.public"],"configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_eip.nat","module.vpc.module.vpc.aws_internet_gateway.this","module.vpc.module.vpc.aws_subnet.public"],"wave":2,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1111,"end_line":1135},"result":{"rule_id":"aws.nat_gateway","case_id":"nat","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"implicit outbound (STACKIT network)","maturity":"ga"},"reason":"STACKIT has no discrete NAT gateway resource. Outbound traffic from private workloads leaves through the network's default routing (observed on the target, the test of 2026-10-10, in a project outside a Network Area), by the network's publicIp - one address shared by every routed network of the project.","review":["If partners allowlist the fixed egress IP of the NAT gateway, that address is lost (observed, tested on a STACKIT project on 2026-10-10: the network's publicIp is shared by every routed network of the project, changed twice when every network of the project was deleted, and cannot be set - a PATCH answers 202 and is ignored). A STACKIT public IP per server keeps its address (the test of 2026-10-10); otherwise the allow-list has to follow the changing address."],"evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/"],"validated_against":"terraform-provider-stackit@0.116.0 (no NAT-gateway resource); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: no such resource in the 0.120.0 schema (115 resources; since 0.116.0 only stackit_volume_automation was added))","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: a resource of the estate (a subnet, route table, security group, network ACL, flow log, peering connection, a Cloud Control twin of those, ...) names a VPC by a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.nat_gateway","expected":8,"observed":4,"accounted":4,"unaccounted":0,"critical_unaccounted":[],"critical_open":["network-topology-boundary","fixed-egress-ip","nat-placement"],"items":[{"id":"nat-gateway-drain-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven"},{"id":"outbound-nat","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:nat"},{"id":"fixed-egress-ip","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:nat"},{"id":"nat-placement","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:nat"},{"id":"private-nat","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nat-addressing","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-nat-gateway-eip-association","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"implicit outbound (STACKIT network)","confidence":"MEDIUM"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"critical":[{"node":"module.vpc.module.vpc.aws_nat_gateway.this","attribute":"allocation_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.nat_gateway/fixed-egress-ip:REVIEW"},{"node":"module.vpc.module.vpc.aws_nat_gateway.this","attribute":"subnet_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.nat_gateway/nat-placement:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["network-topology-boundary"],"gate_blockers":[{"source_type":"aws_nat_gateway","attribute":"allocation_id","closure":"CLOSED:REVIEW"},{"source_type":"aws_nat_gateway","attribute":"subnet_id","closure":"CLOSED:REVIEW"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"}],"implicit":true}},{"id":"module.dependencies.aws_security_group.catalog_opensearch_sg","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.dependencies","facets":["module.dependencies.aws_security_group_rule.allow_https_from_client"],"configuration_completeness":"COMPLETE","depends_on":["module.retail_app_ecs.module.catalog_service.aws_security_group.this","module.vpc.module.vpc.aws_vpc.this"],"wave":3,"provenance":{"file":"../../lib/dependencies/catalog_opensearch.tf","line":14,"end_line":18},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","maturity":"ga","lifecycle":"active"},"reason":"This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. The knowledge base maps the unit to STACKIT security group (stackit_security_group, stackit_security_group_rule); this draft writes no block of it, so it creates nothing for the unit on STACKIT.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"sg-egress-restricted","severity":"warning","message":"The source restricts egress (the AWS provider removes AWS's default allow-all egress rule; only the listed egress rules apply). Every new STACKIT security group gets two default egress rules, IPv4 and IPv6, with no ip range (any address), no protocol and no port restriction (the test of 2026-10-07, 2026-10-07: API read-back of a new group, docs concepts page), that stackit_security_group (the pinned STACKIT provider) does not manage — as generated, the draft allows all egress. After apply, delete them (stackit security-group rule list / delete --security-group-id \u003cid\u003e), or egress is wider than in the source.","evidence":["https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"sg-rule-not-rendered","severity":"warning","message":"At least one rule of this group is not in the draft as the source has it. The plan withholds it, holds it as a commented-out rule until a value or a decision is filled in, writes it with a fact that decides what it allows not carried exactly, or cannot name it at all because the source has more rules than are visible statically (a dynamic block over a collection, a count or a rule list that is not known until apply, or a list with a hidden member: the plan's INCOMPLETE action says which set and why, the draft's TODO \"rules beyond the known set\" names it, and only the known rules are drafted). Typical causes: a protocol, port or source whose value is known only at apply time or comes from a root variable; a source group that is a choice between groups or not a group of the draft; a protocol with no STACKIT counterpart; an ICMP type with every code; an ICMP or ICMPv6 rule whose range is of the other IP family (the API answers HTTP 400, the test of 2026-10-08); a tcp or udp rule with a negative port, a port above 65535, a reversed range, or port 0 only (STACKIT stores no port range for 0 to 0, so the rule would match every port). A tcp or udp range that starts at port 0 and ends below 65535 is written from port 1 (the STACKIT API rejects a range that starts at 0; tested on a STACKIT project on 2026-10-07): port 0 itself is not carried. A stackit_security_group_rule without protocol, port_range or source allows everything (the pinned STACKIT provider), so such a rule is never widened; re-create it with the values it needs (the plan names each one).","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/security_group_rule","https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpPermission.html","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md","docs/benchmark/probes/2026-10-07_probe7_vpc-wiring-portrange/README.md","docs/benchmark/probes/2026-10-08_probe10_sg-intragroup-icmpv6/README.md"]}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.security_group","expected":116,"observed":8,"accounted":8,"unaccounted":0,"critical_unaccounted":[],"critical_open":["egress-restriction","network-topology-boundary","security-group-vpc-membership","standalone-rule-not-generated","standalone-rule-remote-not-resolved","stateful","tcfp-security-group-rule--from-port","tcfp-security-group-rule--to-port"],"items":[{"id":"security-group-vpc-membership","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"check:topology-vpc-unproven"},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven"},{"id":"stateful","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"egress-restriction","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-egress-restricted"},{"id":"prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rule-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"revoke-rules-on-delete","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-ipv6-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-not-generated","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sg"},{"id":"vpc-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-group-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-remote-group-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-direction-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-remote-not-resolved","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:sg"},{"id":"ingress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"exclusive-rule-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-ipv6-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-self","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--from-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sg","withdrawn_by":["standalone-rule-not-generated"]},{"id":"tcfp-security-group-rule--to-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sg","withdrawn_by":["standalone-rule-not-generated"]},{"id":"tcfp-vpc-security-group-ingress-rule--cidr-ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-security-group-rule-source-security-group-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-egress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dax-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-endpoint-security-group-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-security-group-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apigatewayv2-vpc-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-launch-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance-connect-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-launch-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-ingress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-verified-access-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-cache-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-replication-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-serverless-cache","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancing-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchservice-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"not written by this draft (stackit_security_group, stackit_security_group_rule)","confidence":"MEDIUM"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"critical":[{"node":"module.dependencies.aws_security_group.catalog_opensearch_sg","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:UNSUPPORTED","by":"aws.security_group/security-group-vpc-membership:UNSUPPORTED"},{"node":"module.dependencies.aws_security_group_rule.allow_https_from_client","attribute":"from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-not-generated:REVIEW"},{"node":"module.dependencies.aws_security_group_rule.allow_https_from_client","attribute":"protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-not-generated:REVIEW"},{"node":"module.dependencies.aws_security_group_rule.allow_https_from_client","attribute":"source_security_group_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-not-generated:REVIEW"},{"node":"module.dependencies.aws_security_group_rule.allow_https_from_client","attribute":"to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-not-generated:REVIEW"},{"node":"module.dependencies.aws_security_group_rule.allow_https_from_client","attribute":"type","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-not-generated:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["egress-restriction","network-topology-boundary","standalone-rule-remote-not-resolved","stateful"],"gate_blockers":[{"source_type":"aws_security_group_rule","attribute":"from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"source_security_group_id","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"type","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"vpc_id","closure":"CLOSED:UNSUPPORTED"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"egress-restriction","closure":"open-critical-without-read-set"},{"semantic":"standalone-rule-remote-not-resolved","closure":"open-critical-without-read-set"},{"semantic":"stateful","closure":"open-critical-without-read-set"}],"implicit":true},"draft_left_out":{"resources":["stackit_security_group","stackit_security_group_rule"],"service":"STACKIT security group","cause":"every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only","implicit":true}},{"id":"module.dependencies.aws_security_group.mq","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.dependencies","facets":["module.dependencies.aws_security_group_rule.mq"],"configuration_completeness":"COMPLETE","depends_on":["module.retail_app_ecs.module.orders_service.aws_security_group.this","module.vpc.module.vpc.aws_vpc.this"],"wave":3,"provenance":{"file":"../../lib/dependencies/mq.tf","line":33,"end_line":43},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","maturity":"ga","lifecycle":"active"},"reason":"This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. The knowledge base maps the unit to STACKIT security group (stackit_security_group, stackit_security_group_rule); this draft writes no block of it, so it creates nothing for the unit on STACKIT.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"sg-egress-restricted","severity":"warning","message":"The source restricts egress (the AWS provider removes AWS's default allow-all egress rule; only the listed egress rules apply). Every new STACKIT security group gets two default egress rules, IPv4 and IPv6, with no ip range (any address), no protocol and no port restriction (the test of 2026-10-07, 2026-10-07: API read-back of a new group, docs concepts page), that stackit_security_group (the pinned STACKIT provider) does not manage — as generated, the draft allows all egress. After apply, delete them (stackit security-group rule list / delete --security-group-id \u003cid\u003e), or egress is wider than in the source.","evidence":["https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"sg-rule-not-rendered","severity":"warning","message":"At least one rule of this group is not in the draft as the source has it. The plan withholds it, holds it as a commented-out rule until a value or a decision is filled in, writes it with a fact that decides what it allows not carried exactly, or cannot name it at all because the source has more rules than are visible statically (a dynamic block over a collection, a count or a rule list that is not known until apply, or a list with a hidden member: the plan's INCOMPLETE action says which set and why, the draft's TODO \"rules beyond the known set\" names it, and only the known rules are drafted). Typical causes: a protocol, port or source whose value is known only at apply time or comes from a root variable; a source group that is a choice between groups or not a group of the draft; a protocol with no STACKIT counterpart; an ICMP type with every code; an ICMP or ICMPv6 rule whose range is of the other IP family (the API answers HTTP 400, the test of 2026-10-08); a tcp or udp rule with a negative port, a port above 65535, a reversed range, or port 0 only (STACKIT stores no port range for 0 to 0, so the rule would match every port). A tcp or udp range that starts at port 0 and ends below 65535 is written from port 1 (the STACKIT API rejects a range that starts at 0; tested on a STACKIT project on 2026-10-07): port 0 itself is not carried. A stackit_security_group_rule without protocol, port_range or source allows everything (the pinned STACKIT provider), so such a rule is never widened; re-create it with the values it needs (the plan names each one).","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/security_group_rule","https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpPermission.html","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md","docs/benchmark/probes/2026-10-07_probe7_vpc-wiring-portrange/README.md","docs/benchmark/probes/2026-10-08_probe10_sg-intragroup-icmpv6/README.md"]}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.security_group","expected":116,"observed":7,"accounted":7,"unaccounted":0,"critical_unaccounted":[],"critical_open":["egress-restriction","network-topology-boundary","security-group-vpc-membership","standalone-rule-not-generated","stateful","tcfp-security-group-rule--from-port","tcfp-security-group-rule--to-port"],"items":[{"id":"security-group-vpc-membership","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"check:topology-vpc-unproven"},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven"},{"id":"stateful","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"egress-restriction","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-egress-restricted"},{"id":"prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rule-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"revoke-rules-on-delete","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-ipv6-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-not-generated","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sg"},{"id":"vpc-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-group-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-remote-group-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-direction-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-remote-not-resolved","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"exclusive-rule-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-ipv6-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-self","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--from-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sg","withdrawn_by":["standalone-rule-not-generated"]},{"id":"tcfp-security-group-rule--to-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sg","withdrawn_by":["standalone-rule-not-generated"]},{"id":"tcfp-vpc-security-group-ingress-rule--cidr-ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-security-group-rule-source-security-group-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-egress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dax-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-endpoint-security-group-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-security-group-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apigatewayv2-vpc-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-launch-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance-connect-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-launch-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-ingress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-verified-access-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-cache-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-replication-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-serverless-cache","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancing-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchservice-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"not written by this draft (stackit_security_group, stackit_security_group_rule)","confidence":"MEDIUM"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"critical":[{"node":"module.dependencies.aws_security_group.mq","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:UNSUPPORTED","by":"aws.security_group/security-group-vpc-membership:UNSUPPORTED"},{"node":"module.dependencies.aws_security_group_rule.mq","attribute":"from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-not-generated:REVIEW"},{"node":"module.dependencies.aws_security_group_rule.mq","attribute":"protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-not-generated:REVIEW"},{"node":"module.dependencies.aws_security_group_rule.mq","attribute":"source_security_group_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-not-generated:REVIEW"},{"node":"module.dependencies.aws_security_group_rule.mq","attribute":"to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-not-generated:REVIEW"},{"node":"module.dependencies.aws_security_group_rule.mq","attribute":"type","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-not-generated:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["egress-restriction","network-topology-boundary","stateful"],"gate_blockers":[{"source_type":"aws_security_group_rule","attribute":"from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"source_security_group_id","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"type","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"vpc_id","closure":"CLOSED:UNSUPPORTED"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"egress-restriction","closure":"open-critical-without-read-set"},{"semantic":"stateful","closure":"open-critical-without-read-set"}],"implicit":true},"draft_left_out":{"resources":["stackit_security_group","stackit_security_group_rule"],"service":"STACKIT security group","cause":"every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only","implicit":true}},{"id":"module.dependencies.module.catalog_rds.aws_security_group.this","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.dependencies.module.catalog_rds","facets":["module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress"],"configuration_completeness":"COMPLETE","depends_on":["module.retail_app_ecs.module.catalog_service.aws_security_group.this","module.vpc.module.vpc.aws_vpc.this"],"wave":3,"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":321,"end_line":334},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","maturity":"ga","lifecycle":"active"},"reason":"This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. The knowledge base maps the unit to STACKIT security group (stackit_security_group, stackit_security_group_rule); this draft writes no block of it, so it creates nothing for the unit on STACKIT.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"sg-egress-restricted","severity":"warning","message":"The source restricts egress (the AWS provider removes AWS's default allow-all egress rule; only the listed egress rules apply). Every new STACKIT security group gets two default egress rules, IPv4 and IPv6, with no ip range (any address), no protocol and no port restriction (the test of 2026-10-07, 2026-10-07: API read-back of a new group, docs concepts page), that stackit_security_group (the pinned STACKIT provider) does not manage — as generated, the draft allows all egress. After apply, delete them (stackit security-group rule list / delete --security-group-id \u003cid\u003e), or egress is wider than in the source.","evidence":["https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"sg-rule-not-rendered","severity":"warning","message":"At least one rule of this group is not in the draft as the source has it. The plan withholds it, holds it as a commented-out rule until a value or a decision is filled in, writes it with a fact that decides what it allows not carried exactly, or cannot name it at all because the source has more rules than are visible statically (a dynamic block over a collection, a count or a rule list that is not known until apply, or a list with a hidden member: the plan's INCOMPLETE action says which set and why, the draft's TODO \"rules beyond the known set\" names it, and only the known rules are drafted). Typical causes: a protocol, port or source whose value is known only at apply time or comes from a root variable; a source group that is a choice between groups or not a group of the draft; a protocol with no STACKIT counterpart; an ICMP type with every code; an ICMP or ICMPv6 rule whose range is of the other IP family (the API answers HTTP 400, the test of 2026-10-08); a tcp or udp rule with a negative port, a port above 65535, a reversed range, or port 0 only (STACKIT stores no port range for 0 to 0, so the rule would match every port). A tcp or udp range that starts at port 0 and ends below 65535 is written from port 1 (the STACKIT API rejects a range that starts at 0; tested on a STACKIT project on 2026-10-07): port 0 itself is not carried. A stackit_security_group_rule without protocol, port_range or source allows everything (the pinned STACKIT provider), so such a rule is never widened; re-create it with the values it needs (the plan names each one).","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/security_group_rule","https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpPermission.html","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md","docs/benchmark/probes/2026-10-07_probe7_vpc-wiring-portrange/README.md","docs/benchmark/probes/2026-10-08_probe10_sg-intragroup-icmpv6/README.md"]}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.security_group","expected":116,"observed":8,"accounted":8,"unaccounted":0,"critical_unaccounted":[],"critical_open":["egress-restriction","network-topology-boundary","rule-ports","security-group-vpc-membership","standalone-rule-values","stateful","tcfp-security-group-rule--from-port","tcfp-security-group-rule--to-port"],"items":[{"id":"security-group-vpc-membership","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"check:topology-vpc-unproven"},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven"},{"id":"stateful","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"egress-restriction","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-egress-restricted"},{"id":"prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-ports","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-rule-not-rendered"},{"id":"egress-rule-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"revoke-rules-on-delete","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-ipv6-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-group-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-values","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-rule-not-rendered"},{"id":"own-resource-remote-group-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-direction-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-remote-not-resolved","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"exclusive-rule-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-ipv6-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-self","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--from-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sg","withdrawn_by":["rule-ports"]},{"id":"tcfp-security-group-rule--to-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sg","withdrawn_by":["rule-ports"]},{"id":"tcfp-vpc-security-group-ingress-rule--cidr-ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-security-group-rule-source-security-group-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-egress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dax-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-endpoint-security-group-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-security-group-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apigatewayv2-vpc-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-launch-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance-connect-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-launch-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-ingress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-verified-access-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-cache-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-replication-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-serverless-cache","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancing-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchservice-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"not written by this draft (stackit_security_group, stackit_security_group_rule)","confidence":"MEDIUM"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"critical":[{"node":"module.dependencies.module.catalog_rds.aws_security_group.this","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:UNSUPPORTED","by":"aws.security_group/security-group-vpc-membership:UNSUPPORTED"},{"node":"module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress","attribute":"from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:REVIEW"},{"node":"module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress","attribute":"protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-values:REVIEW"},{"node":"module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress","attribute":"source_security_group_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-values:REVIEW"},{"node":"module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress","attribute":"to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:REVIEW"},{"node":"module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress","attribute":"type","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-values:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["egress-restriction","network-topology-boundary","stateful"],"gate_blockers":[{"source_type":"aws_security_group_rule","attribute":"from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"source_security_group_id","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"type","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"vpc_id","closure":"CLOSED:UNSUPPORTED"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"egress-restriction","closure":"open-critical-without-read-set"},{"semantic":"stateful","closure":"open-critical-without-read-set"}],"implicit":true},"draft_left_out":{"resources":["stackit_security_group","stackit_security_group_rule"],"service":"STACKIT security group","cause":"every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only","implicit":true}},{"id":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","facets":["module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed"],"configuration_completeness":"COMPLETE","depends_on":["module.retail_app_ecs.module.checkout_service.aws_security_group.this","module.vpc.module.vpc.aws_vpc.this"],"wave":3,"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/main.tf","line":81,"end_line":139},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","maturity":"ga","lifecycle":"active"},"reason":"This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. The knowledge base maps the unit to STACKIT security group (stackit_security_group, stackit_security_group_rule); this draft writes no block of it, so it creates nothing for the unit on STACKIT.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"sg-rule-not-rendered","severity":"warning","message":"At least one rule of this group is not in the draft as the source has it. The plan withholds it, holds it as a commented-out rule until a value or a decision is filled in, writes it with a fact that decides what it allows not carried exactly, or cannot name it at all because the source has more rules than are visible statically (a dynamic block over a collection, a count or a rule list that is not known until apply, or a list with a hidden member: the plan's INCOMPLETE action says which set and why, the draft's TODO \"rules beyond the known set\" names it, and only the known rules are drafted). Typical causes: a protocol, port or source whose value is known only at apply time or comes from a root variable; a source group that is a choice between groups or not a group of the draft; a protocol with no STACKIT counterpart; an ICMP type with every code; an ICMP or ICMPv6 rule whose range is of the other IP family (the API answers HTTP 400, the test of 2026-10-08); a tcp or udp rule with a negative port, a port above 65535, a reversed range, or port 0 only (STACKIT stores no port range for 0 to 0, so the rule would match every port). A tcp or udp range that starts at port 0 and ends below 65535 is written from port 1 (the STACKIT API rejects a range that starts at 0; tested on a STACKIT project on 2026-10-07): port 0 itself is not carried. A stackit_security_group_rule without protocol, port_range or source allows everything (the pinned STACKIT provider), so such a rule is never widened; re-create it with the values it needs (the plan names each one).","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/security_group_rule","https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpPermission.html","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md","docs/benchmark/probes/2026-10-07_probe7_vpc-wiring-portrange/README.md","docs/benchmark/probes/2026-10-08_probe10_sg-intragroup-icmpv6/README.md"]}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.security_group","expected":116,"observed":10,"accounted":10,"unaccounted":0,"critical_unaccounted":[],"critical_open":["network-topology-boundary","rule-ports","security-group-vpc-membership","standalone-rule-empty-sources","standalone-rule-other-sources","standalone-rule-values","stateful","tcfp-security-group-rule--from-port","tcfp-security-group-rule--to-port"],"items":[{"id":"security-group-vpc-membership","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"check:topology-vpc-unproven"},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven"},{"id":"stateful","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"egress-restriction","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-ports","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-rule-not-rendered"},{"id":"egress-rule-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"revoke-rules-on-delete","critical":false,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:sg"},{"id":"vpc-ingress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-ipv6-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-group-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-values","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-rule-not-rendered"},{"id":"own-resource-remote-group-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-direction-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-other-sources","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-rule-not-rendered"},{"id":"standalone-rule-empty-sources","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-rule-not-rendered"},{"id":"standalone-rule-remote-not-resolved","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"exclusive-rule-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-ipv6-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-self","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--from-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sg","withdrawn_by":["rule-ports"]},{"id":"tcfp-security-group-rule--to-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sg","withdrawn_by":["rule-ports"]},{"id":"tcfp-vpc-security-group-ingress-rule--cidr-ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-security-group-rule-source-security-group-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-egress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dax-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-endpoint-security-group-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-security-group-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apigatewayv2-vpc-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-launch-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance-connect-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-launch-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-ingress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-verified-access-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-cache-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-replication-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-serverless-cache","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancing-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchservice-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"not written by this draft (stackit_security_group, stackit_security_group_rule)","confidence":"MEDIUM"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"critical":[{"node":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:UNSUPPORTED","by":"aws.security_group/security-group-vpc-membership:UNSUPPORTED"},{"node":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","attribute":"cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-values:REVIEW"},{"node":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","attribute":"from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:REVIEW"},{"node":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","attribute":"ipv6_cidr_blocks","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-empty-sources:REVIEW"},{"node":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","attribute":"prefix_list_ids","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-empty-sources:REVIEW"},{"node":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","attribute":"protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-values:REVIEW"},{"node":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","attribute":"source_security_group_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-values:REVIEW"},{"node":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","attribute":"to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:REVIEW"},{"node":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","attribute":"type","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-values:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["network-topology-boundary","stateful"],"gate_blockers":[{"source_type":"aws_security_group_rule","attribute":"cidr_blocks","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"ipv6_cidr_blocks","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"prefix_list_ids","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"source_security_group_id","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"type","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"vpc_id","closure":"CLOSED:UNSUPPORTED"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"stateful","closure":"open-critical-without-read-set"}],"implicit":true},"draft_left_out":{"resources":["stackit_security_group","stackit_security_group_rule"],"service":"STACKIT security group","cause":"every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only","implicit":true}},{"id":"module.dependencies.module.orders_rds.aws_security_group.this","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.dependencies.module.orders_rds","facets":["module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress"],"configuration_completeness":"COMPLETE","depends_on":["module.retail_app_ecs.module.orders_service.aws_security_group.this","module.vpc.module.vpc.aws_vpc.this"],"wave":3,"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":321,"end_line":334},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","maturity":"ga","lifecycle":"active"},"reason":"This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. The knowledge base maps the unit to STACKIT security group (stackit_security_group, stackit_security_group_rule); this draft writes no block of it, so it creates nothing for the unit on STACKIT.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"sg-egress-restricted","severity":"warning","message":"The source restricts egress (the AWS provider removes AWS's default allow-all egress rule; only the listed egress rules apply). Every new STACKIT security group gets two default egress rules, IPv4 and IPv6, with no ip range (any address), no protocol and no port restriction (the test of 2026-10-07, 2026-10-07: API read-back of a new group, docs concepts page), that stackit_security_group (the pinned STACKIT provider) does not manage — as generated, the draft allows all egress. After apply, delete them (stackit security-group rule list / delete --security-group-id \u003cid\u003e), or egress is wider than in the source.","evidence":["https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"sg-rule-not-rendered","severity":"warning","message":"At least one rule of this group is not in the draft as the source has it. The plan withholds it, holds it as a commented-out rule until a value or a decision is filled in, writes it with a fact that decides what it allows not carried exactly, or cannot name it at all because the source has more rules than are visible statically (a dynamic block over a collection, a count or a rule list that is not known until apply, or a list with a hidden member: the plan's INCOMPLETE action says which set and why, the draft's TODO \"rules beyond the known set\" names it, and only the known rules are drafted). Typical causes: a protocol, port or source whose value is known only at apply time or comes from a root variable; a source group that is a choice between groups or not a group of the draft; a protocol with no STACKIT counterpart; an ICMP type with every code; an ICMP or ICMPv6 rule whose range is of the other IP family (the API answers HTTP 400, the test of 2026-10-08); a tcp or udp rule with a negative port, a port above 65535, a reversed range, or port 0 only (STACKIT stores no port range for 0 to 0, so the rule would match every port). A tcp or udp range that starts at port 0 and ends below 65535 is written from port 1 (the STACKIT API rejects a range that starts at 0; tested on a STACKIT project on 2026-10-07): port 0 itself is not carried. A stackit_security_group_rule without protocol, port_range or source allows everything (the pinned STACKIT provider), so such a rule is never widened; re-create it with the values it needs (the plan names each one).","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/security_group_rule","https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpPermission.html","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md","docs/benchmark/probes/2026-10-07_probe7_vpc-wiring-portrange/README.md","docs/benchmark/probes/2026-10-08_probe10_sg-intragroup-icmpv6/README.md"]}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.security_group","expected":116,"observed":8,"accounted":8,"unaccounted":0,"critical_unaccounted":[],"critical_open":["egress-restriction","network-topology-boundary","rule-ports","security-group-vpc-membership","standalone-rule-values","stateful","tcfp-security-group-rule--from-port","tcfp-security-group-rule--to-port"],"items":[{"id":"security-group-vpc-membership","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"check:topology-vpc-unproven"},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven"},{"id":"stateful","critical":true,"observed":"yes","disposition":"REVIEW","by":"unenforced:security group rules"},{"id":"egress-restriction","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-egress-restricted"},{"id":"prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-ports","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-rule-not-rendered"},{"id":"egress-rule-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-rule-empty-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"revoke-rules-on-delete","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-ipv6-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-ingress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress-rule-carried","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-group-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-rule-not-generated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-values","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:sg-rule-not-rendered"},{"id":"own-resource-remote-group-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-direction-protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-ports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"own-resource-rule-prefix-lists","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-other-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-empty-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-rule-remote-not-resolved","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-rules-of-repeated-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"exclusive-rule-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-ipv6-cidr-blocks","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-security-group-rule-self","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-security-group-rule--from-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sg","withdrawn_by":["rule-ports"]},{"id":"tcfp-security-group-rule--to-port","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sg","withdrawn_by":["rule-ports"]},{"id":"tcfp-vpc-security-group-ingress-rule--cidr-ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-security-group-rule-source-security-group-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-egress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-vpc-security-group-ingress-rule--prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dax-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-endpoint-security-group-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-security-group-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apigatewayv2-vpc-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-launch-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance-connect-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-launch-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-security-group-ingress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-verified-access-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-cache-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-replication-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-serverless-cache","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancing-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-memorydb-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-opensearchservice-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshift-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-timestream-influx-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-service-network-vpc-association","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"not written by this draft (stackit_security_group, stackit_security_group_rule)","confidence":"MEDIUM"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"critical":[{"node":"module.dependencies.module.orders_rds.aws_security_group.this","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:UNSUPPORTED","by":"aws.security_group/security-group-vpc-membership:UNSUPPORTED"},{"node":"module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress","attribute":"from_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:REVIEW"},{"node":"module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress","attribute":"protocol","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-values:REVIEW"},{"node":"module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress","attribute":"source_security_group_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-values:REVIEW"},{"node":"module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress","attribute":"to_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/rule-ports:REVIEW"},{"node":"module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress","attribute":"type","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.security_group/standalone-rule-values:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["egress-restriction","network-topology-boundary","stateful"],"gate_blockers":[{"source_type":"aws_security_group_rule","attribute":"from_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"protocol","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"source_security_group_id","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"to_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group_rule","attribute":"type","closure":"CLOSED:REVIEW"},{"source_type":"aws_security_group","attribute":"vpc_id","closure":"CLOSED:UNSUPPORTED"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"egress-restriction","closure":"open-critical-without-read-set"},{"semantic":"stateful","closure":"open-critical-without-read-set"}],"implicit":true},"draft_left_out":{"resources":["stackit_security_group","stackit_security_group_rule"],"service":"STACKIT security group","cause":"every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only","implicit":true}},{"id":"module.retail_app_ecs.module.alb.aws_lb.this","source_type":"aws_lb","category":"network","kind":"load_balancer","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.alb","open_dependencies":["module.vpc.module.vpc.aws_subnet.public"],"facets":["module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp"],"configuration_completeness":"COMPLETE","depends_on":["module.retail_app_ecs.module.alb.aws_security_group.this","module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","module.vpc.module.vpc.aws_subnet.public","module.vpc.module.vpc.aws_vpc.this"],"wave":3,"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":5,"end_line":63},"result":{"rule_id":"aws.lb","case_id":"alb","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Application Load Balancer","resources":["stackit_application_load_balancer","stackit_alb_certificate"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): alb_plans lists 1 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): alb_plans lists 1 offerings"}]},"reason":"An application load balancer maps to the STACKIT Application Load Balancer (HTTP/HTTPS listeners, target pools with health checks, optional WAF). Listener rules, certificates and targets are re-created; target pools point at STACKIT server or node IPs.","evidence":["https://docs.stackit.cloud/products/network/load-balancing-and-content-delivery/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/application_load_balancer","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/loadbalancer"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_application_load_balancer listeners: http/https/waf_config_name; no OIDC/Cognito/JWT action; rules: cookie_persistence, headers exact_match, host (wildcard), path exact_match/prefix, query_parameters exact_match, target_pool, web_socket; no redirect action, no regex condition matching, no deletion protection, cross-zone, header or IPv6 attribute) 2026-09-29","findings":[{"check_id":"alb-http2-frontend","severity":"info","message":"The source accepts HTTP/2 client connections (enable_http2). The STACKIT ALB's HTTPS listener does not negotiate HTTP/2 (tested in a STACKIT sandbox on 2026-09-24 and 2026-09-30); ordinary HTTP clients fall back to HTTP/1.1, clients that require HTTP/2 do not work.","evidence":["https://docs.stackit.cloud/products/network/load-balancing-and-content-delivery/application-load-balancer/basics/basic-concepts-alb/"]},{"check_id":"lb-security-groups","severity":"info","message":"Security groups restrict clients of the load balancer; on STACKIT this becomes options.access_control.allowed_source_ranges (ALB) or options.acl (NLB). — a variable's default, not a fact","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/application_load_balancer"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.lb","expected":134,"observed":19,"accounted":19,"unaccounted":0,"critical_unaccounted":[],"critical_open":["client-restriction","lb-connection-timeouts","lb-routing-and-addressing","lb-subnets","network-exposure","request-handling","request-header-options","tc-lb-name","tcfp-lb-listener--default-action--target-group-arn","tcfp-lb-listener--default-action--type","tcfp-lb-listener--protocol"],"items":[{"id":"facet-listener-server-header","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"facet-rule-transform","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"facet-listener-cors-expose-and-max-age","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"facet-listener-tcp-idle-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"lb-connection-timeouts","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:alb"},{"id":"network-exposure","critical":true,"observed":"yes","disposition":"LEDGER","by":"ledger:network exposure"},{"id":"authentication-action","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"jwt-validation-action","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"header-condition-regex","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"lambda-targets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"frontend-http2","critical":false,"observed":"yes","disposition":"UNSUPPORTED","by":"check:alb-http2-frontend"},{"id":"target-protocol-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"waf","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"client-restriction","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:lb-security-groups"},{"id":"tls-listeners","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"access-logs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"connection-logs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"request-handling","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:alb"},{"id":"request-header-options","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:alb"},{"id":"listener-tls-header-names","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"lb-routing-and-addressing","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:alb"},{"id":"lb-type","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:alb"},{"id":"lb-subnets","critical":true,"observed":"unknown","disposition":"REVIEW","by":"observed-unknown:case:alb"},{"id":"lb-subnets-several","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"lb-subnets-outside","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"lb-subnets-none","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-protection","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:alb"},{"id":"cross-zone","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:alb"},{"id":"drop-invalid-headers","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:alb"},{"id":"privatelink-sg-enforcement","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ip-address-type","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:alb"},{"id":"listener-protocol","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:alb"},{"id":"listeners","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:alb"},{"id":"listener-port-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"listener-protocol-port-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"listener-target-group-repeated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"listener-port-from-variable","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"listener-rule-target-group-repeated","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"listener-rule-instance-undecided","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"listener-certificate","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"listener-rules","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-listener-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-priority","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"lb-type-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ip-address-type-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"privatelink-sg-enforcement-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subnet-mappings","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--mutual-authentication--ignore-client-certificate-expiry","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--mutual-authentication--mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--routing-http-request-x-amzn-mtls-clientcert-header-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--routing-http-request-x-amzn-mtls-clientcert-issuer-header-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--routing-http-request-x-amzn-mtls-clientcert-leaf-header-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--routing-http-request-x-amzn-mtls-clientcert-serial-number-header-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--routing-http-request-x-amzn-mtls-clientcert-subject-header-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--routing-http-request-x-amzn-mtls-clientcert-validity-header-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--routing-http-response-access-control-allow-credentials-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--routing-http-response-access-control-allow-headers-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--routing-http-response-access-control-allow-methods-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--routing-http-response-access-control-allow-origin-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--routing-http-response-content-security-policy-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--routing-http-response-strict-transport-security-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--routing-http-response-x-content-type-options-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--routing-http-response-x-frame-options-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--mutual-authentication--ignore-client-certificate-expiry","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--mutual-authentication--mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--routing-http-request-x-amzn-mtls-clientcert-header-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--routing-http-request-x-amzn-mtls-clientcert-issuer-header-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--routing-http-request-x-amzn-mtls-clientcert-leaf-header-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--routing-http-request-x-amzn-mtls-clientcert-serial-number-header-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--routing-http-request-x-amzn-mtls-clientcert-subject-header-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--routing-http-request-x-amzn-mtls-clientcert-validity-header-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--routing-http-response-access-control-allow-credentials-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--routing-http-response-access-control-allow-headers-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--routing-http-response-access-control-allow-methods-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--routing-http-response-access-control-allow-origin-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--routing-http-response-content-security-policy-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--routing-http-response-strict-transport-security-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--routing-http-response-x-content-type-options-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--routing-http-response-x-frame-options-header-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener--default-action--order","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener-rule--action--order","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-alb-listener-rule--condition--source-ip--ip-address-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener--default-action--order","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener-rule--action--order","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-lb-listener-rule--condition--source-ip--ip-address-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfr-alb-listener--mutual-authentication--trust-store-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfr-lb-listener--mutual-authentication--trust-store-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-alb-listener--default-action--type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-alb-listener--protocol","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-lb-listener--default-action--type","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:alb","withdrawn_by":["listeners"]},{"id":"tcfp-lb-listener--protocol","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:alb","withdrawn_by":["listener-protocol"]},{"id":"tcfp-alb-listener--default-action--authenticate-cognito--user-pool-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-alb-listener--default-action--authenticate-cognito--user-pool-client-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-alb-listener--default-action--authenticate-oidc--client-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-alb-listener--default-action--target-group-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-alb-listener-certificate--certificate-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-alb-listener-rule--action--authenticate-cognito--user-pool-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-alb-listener-rule--action--authenticate-cognito--user-pool-client-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-alb-listener-rule--action--authenticate-oidc--client-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-alb-listener-rule--action--target-group-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-lb-listener--default-action--authenticate-cognito--user-pool-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-lb-listener--default-action--authenticate-cognito--user-pool-client-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-lb-listener--default-action--authenticate-oidc--client-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-lb-listener--default-action--target-group-arn","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:alb","withdrawn_by":["listeners"]},{"id":"tcfp-lb-listener-certificate--certificate-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-lb-listener-rule--action--authenticate-cognito--user-pool-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-lb-listener-rule--action--authenticate-cognito--user-pool-client-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-lb-listener-rule--action--authenticate-oidc--client-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-lb-listener-rule--action--target-group-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-alb-access-logs--prefix","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-alb-connection-logs--prefix","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-lb-access-logs--prefix","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-lb-connection-logs--prefix","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-alb-listener-rule--condition--query-string--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-alb-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-lb-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:alb"},{"id":"listener-forward-weight","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-forward-weight","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"listener-forward-stickiness-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-forward-stickiness-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"listener-forward-stickiness-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rule-forward-stickiness-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-cloudfront-multitenant-distribution","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ec2-traffic-mirror-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-globalaccelerator-cross-account-attachment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-target-group-attachment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-cloudfront-vpc-origin","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-traffic-mirror-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-globalaccelerator-cross-account-attachment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-globalaccelerator-endpoint-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-logs-delivery-source","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-wafv2-web-acl-association","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT Application Load Balancer","confidence":"MEDIUM"}},"property_accounting":{"set":27,"excluded":6,"meaningful":21,"by_status":{"CONSUMED":0,"CONTRACT":15,"NOT_CARRIED":6,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"desync_mitigation_mode"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"enable_http2"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"enable_xff_client_port"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"idle_timeout"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"security_groups"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"xff_header_processing_mode"}],"class_counts":{"CRITICAL":20,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"desync_mitigation_mode","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.alb.aws_lb.this): enable_http2 = true, desync_mitigation_mode = defensive, xff_header_processing_mode = append, enable_xff_client_port = true — no attribute for it on the STACKIT load balancers (pinned provider). (contract aws.lb/request-handling:REVIEW)"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"enable_tls_version_and_cipher_suite_headers","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"aws.lb/request-header-options:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"enable_waf_fail_open","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.lb/lb-routing-and-addressing:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"enable_xff_client_port","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.alb.aws_lb.this): enable_http2 = true, desync_mitigation_mode = defensive, xff_header_processing_mode = append, enable_xff_client_port = true — no attribute for it on the STACKIT load balancers (pinned provider). (contract aws.lb/request-header-options:REVIEW)"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"idle_timeout","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.alb.aws_lb.this): idle_timeout = 60 — the STACKIT Application Load Balancer has no idle timeout; Network Load Balancer listeners take tcp.idle_timeout — not generated (pinned provider). (contract aws.lb/lb-connection-timeouts:REVIEW)"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"internal","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.lb/network-exposure:LEDGER"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"aws.lb/tc-lb-name:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"preserve_host_header","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"aws.lb/request-header-options:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"security_groups","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.alb.aws_lb.this): security_groups — a STACKIT Application Load Balancer is in no security group, so the attachment of module.retail_app_ecs.module.alb.aws_security_group.this, module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix is not carried (STACKIT assigns its own target security group (loadbalancer/\u003cname\u003e/backend, which admits the load balancer on the pool ports) to the pool servers unless disable_target_security_group_assignment is set); the client restriction of the group rules is public on source, public on target: no access control is written — the load balancer limits clients by options.access_control.allowed_source_ranges (pinned provider schema, resource stackit_application_load_balancer: \"Application Load Balancer is accessible only from an IP address in this range.\", one set for the whole load balancer) only. (contract aws.lb/client-restriction:REVIEW)"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"subnets","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.lb/lb-subnets:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"xff_header_processing_mode","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.alb.aws_lb.this): enable_http2 = true, desync_mitigation_mode = defensive, xff_header_processing_mode = append, enable_xff_client_port = true — no attribute for it on the STACKIT load balancers (pinned provider). (contract aws.lb/request-handling:REVIEW)"}],"automation_eligible":false,"open_critical_without_read_set":["client-restriction"],"gate_blockers":[{"source_type":"aws_lb","attribute":"desync_mitigation_mode","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_lb","attribute":"enable_xff_client_port","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_lb","attribute":"idle_timeout","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_lb","attribute":"security_groups","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_lb","attribute":"xff_header_processing_mode","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_lb","attribute":"enable_tls_version_and_cipher_suite_headers","closure":"CLOSED:REVIEW"},{"source_type":"aws_lb","attribute":"enable_waf_fail_open","closure":"CLOSED:REVIEW"},{"source_type":"aws_lb","attribute":"internal","closure":"CLOSED:REVIEW"},{"source_type":"aws_lb","attribute":"name","closure":"CLOSED:REVIEW"},{"source_type":"aws_lb","attribute":"preserve_host_header","closure":"CLOSED:REVIEW"},{"source_type":"aws_lb","attribute":"subnets","closure":"CLOSED:REVIEW"},{"source_type":"aws_lb","semantic":"convert:module.retail_app_ecs.module.alb.aws_lb.this:network_id:AMBIGUOUS_INSTANCE_SELECTION","closure":"CONVERT:open-decision"},{"source_type":"aws_lb","semantic":"convert:module.retail_app_ecs.module.alb.aws_lb.this:target_pools:INGRESS_EXPOSURE_PATH","closure":"CONVERT:open-decision"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"client-restriction","closure":"open-critical-without-read-set"}]}},{"id":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","source_type":"aws_ecs_service","category":"compute","kind":"container_service","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.carts_service","open_dependencies":["module.vpc.module.vpc.aws_subnet.private"],"facets":["module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this"],"configuration_completeness":"COMPLETE","depends_on":["module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","module.retail_app_ecs.aws_ecs_cluster.cluster","module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","module.retail_app_ecs.module.carts_service.aws_security_group.this","module.vpc.module.vpc.aws_subnet.private","module.vpc.module.vpc.aws_vpc.this"],"wave":3,"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":136,"end_line":175},"result":{"rule_id":"aws.ecs","case_id":"ecs-to-ske","class":"REPLATFORM","confidence":"LOW","target":{"service":"STACKIT Kubernetes Engine (SKE)","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): ske lists 161 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): ske lists 77 offerings"}]},"reason":"Containers already exist; ECS task definitions and services are rewritten as Kubernetes Deployments/Services on SKE (or pushed to Cloud Foundry for simple web apps).","review":["Translate task definitions (CPU/memory, env, secrets, health checks) into Kubernetes manifests."],"evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/ske_cluster"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"ecs-service-discovery","severity":"warning","message":"Services find each other through Cloud Map / Service Connect; on SKE this becomes Kubernetes Services and DNS.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/ske_cluster"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table), whose own decision the target does not carry (it is REDESIGN), and the semantic contract of aws_ecs_service does not read aws_dynamodb_table, so what the reference becomes is not assessed."}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.ecs","expected":122,"observed":15,"accounted":15,"unaccounted":0,"critical_unaccounted":[],"critical_open":["linked-dependency:aws_dynamodb_table","service-connect-values","service-desired-count","service-discovery","service-execute-command","service-network-placement","service-public-ip-setting","service-task-definition","task-definition","td-container-definitions","td-container-image-registry","td-container-plaintext-secret-env","td-container-secret-references","td-execution-role-arn","td-network-mode","td-task-role-arn"],"items":[{"id":"nbr-aws-networkfirewall-container-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-events-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkfirewall-container-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-scheduler-schedule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-stepfunctions-state-machine","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-platform-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-timeouts","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-capacity-provider-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-access-log-format","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"capacity-providers","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-capacity-providers-legacy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"scheduled-scaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-target-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-policy-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-discovery","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:ecs-service-discovery"},{"id":"public-ip","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"task-definition","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-task-definition","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-desired-count","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-scheduling-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-limits","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-controller","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-circuit-breaker","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-alarms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-execute-command","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-health-check-grace","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-az-rebalancing","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-iam-role-and-delete","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-load-balancer-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-network-placement","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-public-ip-setting","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-registry-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-values","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-volume-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-size","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-file-system-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-iops","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-throughput","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-initialization-rate","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tag-propagate","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tag-resource-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-vpc-lattice","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-execute-command","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-managed-storage","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-service-connect-defaults","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-container-definitions","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-secret-references","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-plaintext-secret-env","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-image-registry","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-execution-role-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-network-mode","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-skip-destroy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-task-role-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-volume-host-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-configure-at-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-configure-at-launch-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-file-system-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-access-point-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-iam-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-transit-encryption","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-transit-encryption-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-placement-constraints-expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-placement-constraints-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-ipc-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-pid-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-proxy-configuration-properties","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-proxy-configuration-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-driver","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-scratch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-driver-opts","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-scope","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-defaults","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-authorization-config-credentials-parameter","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-authorization-config-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-file-system-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-access-point-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-file-system-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-enable-fault-injection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ecs-cluster-configuration--execute-command-configuration--log-configuration--s3-key-prefix","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ecs-service-service-connect-configuration--log-configuration--secret-option--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ak181-facets-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-traffic-shift-and-bake","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-pause-hook-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-external-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-force-delete","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-launch-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-platform-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-wait-until-stable","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-wait-until-stable-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--base","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--weight","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--container-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--container-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--load-balancer-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--target-group-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--assign-public-ip","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--security-groups","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--subnets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-scale--unit","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-scale--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--container-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--container-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--registry-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scaling-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"linked-dependency:aws_dynamodb_table","critical":true,"observed":"yes","disposition":"REVIEW","by":"linked-dependency:aws_dynamodb_table"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REPLATFORM","change_types":["CONFIG"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT Kubernetes Engine (SKE)","confidence":"LOW"}},"property_accounting":{"set":25,"excluded":1,"meaningful":24,"by_status":{"CONSUMED":2,"CONTRACT":8,"NOT_CARRIED":14,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"enable_execute_command"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"launch_type"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"network_configuration.assign_public_ip"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"network_configuration.security_groups"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"network_configuration.subnets"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"service_connect_configuration.enabled"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"service_connect_configuration.namespace"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.dns_name"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.port"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.discovery_name"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.port_name"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"wait_for_steady_state"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","attribute":"network_mode"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","attribute":"requires_compatibilities"}],"class_counts":{"CRITICAL":16,"NON_CRITICAL":8},"critical":[{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"desired_count","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.ecs/service-desired-count:REVIEW"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"enable_execute_command","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): enable_execute_command = true, tags, wait_for_steady_state = true — a service setting with no counterpart in the draft manifests: Kubernetes has its own rollout (maxSurge, maxUnavailable), health, scheduling and exec behaviour, and tags are not labels here. (contract aws.ecs/service-execute-command:REVIEW)"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"network_configuration.assign_public_ip","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-public-ip-setting:REVIEW)"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"network_configuration.security_groups","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-network-placement:REVIEW)"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"network_configuration.subnets","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-network-placement:REVIEW)"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"service_connect_configuration.enabled","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: carts:80 → container port 8080 (the Service Connect alias carts:80 of port carts-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"service_connect_configuration.namespace","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: carts:80 → container port 8080 (the Service Connect alias carts:80 of port carts-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.dns_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: carts:80 → container port 8080 (the Service Connect alias carts:80 of port carts-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: carts:80 → container port 8080 (the Service Connect alias carts:80 of port carts-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.discovery_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: carts:80 → container port 8080 (the Service Connect alias carts:80 of port carts-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.port_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: carts:80 → container port 8080 (the Service Connect alias carts:80 of port carts-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","attribute":"task_definition","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/service-task-definition:REVIEW"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","attribute":"container_definitions","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:REVIEW","by":"aws.ecs/td-container-definitions:REVIEW"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","attribute":"execution_role_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/td-execution-role-arn:REVIEW"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","attribute":"network_mode","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this): network_mode = awsvpc, requires_compatibilities — Fargate platform specifics and awsvpc network interface semantics have no Kubernetes counterpart: the pods run on the SKE node pool network and the platform's task sizing steps do not exist. (contract aws.ecs/td-network-mode:REVIEW)"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","attribute":"task_role_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/td-task-role-arn:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["linked-dependency:aws_dynamodb_table","service-discovery"],"gate_blockers":[{"source_type":"aws_ecs_service","attribute":"enable_execute_command","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.assign_public_ip","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.security_groups","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.subnets","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.enabled","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.namespace","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.client_alias.dns_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.client_alias.port","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.discovery_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.port_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"network_mode","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"desired_count","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_service","attribute":"task_definition","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"container_definitions","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"execution_role_arn","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"task_role_arn","closure":"CLOSED:REVIEW"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"linked-dependency:aws_dynamodb_table","closure":"open-critical-without-read-set"},{"semantic":"service-discovery","closure":"open-critical-without-read-set"}]}},{"id":"module.dependencies.aws_mq_broker.mq","source_type":"aws_mq_broker","category":"messaging","kind":"message_broker","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.dependencies","open_dependencies":["module.vpc.module.vpc.aws_subnet.private"],"configuration_completeness":"COMPLETE","depends_on":["module.dependencies.aws_security_group.mq","module.vpc.module.vpc.aws_subnet.private"],"wave":4,"provenance":{"file":"../../lib/dependencies/mq.tf","line":12,"end_line":31},"result":{"rule_id":"aws.mq_broker","case_id":"rabbitmq","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT RabbitMQ","resources":["stackit_rabbitmq_instance","stackit_rabbitmq_credential"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): rabbitmq lists 15 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): rabbitmq lists 15 offerings"}]},"reason":"Same broker software: exchanges, queues and bindings are exported from the Amazon MQ definitions and imported into STACKIT RabbitMQ (the eu01 catalogue lists version 4.1, read 2026-10-18; STACKIT's lifecycle page, last updated 2026-03-11, lists 4.0 and no 4.1, so confirm the version the instance accepts before the cutover); clients change host and credentials, and the broker users are not carried (STACKIT generates the credentials). Moving from 3.x to 4.0 drops classic queue mirroring — mirrored queues become quorum queues.","evidence":["https://docs.stackit.cloud/products/messaging/rabbitmq/","https://docs.stackit.cloud/products/messaging/rabbitmq/reference/lifecycle/","https://docs.stackit.cloud/products/messaging/rabbitmq/release-notes/","https://www.rabbitmq.com/docs/definitions","https://www.rabbitmq.com/blog/2021/08/21/4.0-deprecation-announcements","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/rabbitmq_instance","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/stackit/internal/services/rabbitmq/rabbitmq_acc_test.go#L26"],"validated_against":"terraform-provider-stackit@0.116.0; docs messaging/rabbitmq 2026-09-23; STACKIT catalogue eu01 2026-09-24 and 2026-10-18 (RabbitMQ 4.1; MQTT, STOMP, federation, shovel plugins); J5 2026-10-26: the lifecycle page (Last updated on Mar 11, 2026) lists the versions 4.0 (released April 2025, end of life to be announced), 3.13 (September 2024, end of life September 2025) and 3.10, and no 4.1 row; the provider's acceptance test (v0.119.0) orders version 4.1 — the version the instance accepts is the catalogue's and was not re-read with a login on 2026-10-26","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"engine-version-upgrade","severity":"warning","message":"Engine version UPGRADE: the source runs RabbitMQ 3.13 (engine_version); STACKIT RabbitMQ in eu01 offers 4.1 (service catalogue of eu01, read 2026-10-18), none of them the source's version. Moving the data upgrades the engine: test the application and the data against the version you choose before the cutover; the draft does not choose it.","evidence":["kb/stackit/eu01.json","https://registry.terraform.io/providers/stackitcloud/stackit/0.119.0/docs/resources/rabbitmq_instance"],"blocker_category":"FEATURE"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.mq_broker","expected":44,"observed":14,"accounted":14,"unaccounted":0,"critical_unaccounted":[],"critical_open":["engine-version","broker-network","network-exposure","broker-users","tc-user--password","tc-user--username","tcp-deployment-mode","tcp-engine-type","tcp-engine-version","tcp-security-groups","tcp-subnet-ids","tc-mq-broker-broker-name"],"items":[{"id":"engine-type","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:rabbitmq"},{"id":"engine-version","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rabbitmq"},{"id":"broker-network","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:rabbitmq"},{"id":"engine","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:rabbitmq"},{"id":"high-availability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"network-exposure","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rabbitmq"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"directory-authentication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"broker-users","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rabbitmq"},{"id":"broker-configuration","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"logs","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-authentication-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-data-replication-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ldap-server-metadata--hosts","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ldap-server-metadata--role-base","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ldap-server-metadata--role-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ldap-server-metadata--role-search-matching","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ldap-server-metadata--role-search-subtree","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ldap-server-metadata--service-account-password","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ldap-server-metadata--service-account-username","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ldap-server-metadata--user-base","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ldap-server-metadata--user-role-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ldap-server-metadata--user-search-matching","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ldap-server-metadata--user-search-subtree","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-logs--audit","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-logs--general","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-storage-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-user--console-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-user--groups","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-user--password","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rabbitmq"},{"id":"tc-user--replication-user","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-user--username","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rabbitmq"},{"id":"tcr-configuration--id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-data-replication-primary-broker-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-resource-share-arns","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-deployment-mode","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rabbitmq"},{"id":"tcp-encryption-options--use-aws-owned-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-engine-type","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rabbitmq","withdrawn_by":["engine-type"]},{"id":"tcp-engine-version","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rabbitmq","withdrawn_by":["engine-version"]},{"id":"tcp-security-groups","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rabbitmq","withdrawn_by":["broker-network"]},{"id":"tcp-subnet-ids","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rabbitmq","withdrawn_by":["broker-network"]},{"id":"tc-mq-broker-broker-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rabbitmq"},{"id":"nbr-aws-pipes-pipe","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-pipes-pipe","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT RabbitMQ","confidence":"MEDIUM"}},"property_accounting":{"set":13,"excluded":1,"meaningful":12,"by_status":{"CONSUMED":1,"CONTRACT":7,"NOT_CARRIED":4,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.dependencies.aws_mq_broker.mq","attribute":"apply_immediately"},{"node":"module.dependencies.aws_mq_broker.mq","attribute":"auto_minor_version_upgrade"},{"node":"module.dependencies.aws_mq_broker.mq","attribute":"user.password"},{"node":"module.dependencies.aws_mq_broker.mq","attribute":"user.username"}],"class_counts":{"CRITICAL":9,"NON_CRITICAL":3},"critical":[{"node":"module.dependencies.aws_mq_broker.mq","attribute":"broker_name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"aws.mq_broker/tc-mq-broker-broker-name:REVIEW"},{"node":"module.dependencies.aws_mq_broker.mq","attribute":"deployment_mode","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.mq_broker/tcp-deployment-mode:REVIEW"},{"node":"module.dependencies.aws_mq_broker.mq","attribute":"engine_version","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.mq_broker/engine-version:REVIEW"},{"node":"module.dependencies.aws_mq_broker.mq","attribute":"publicly_accessible","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.mq_broker/network-exposure:REVIEW"},{"node":"module.dependencies.aws_mq_broker.mq","attribute":"security_groups","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.mq_broker/broker-network:REVIEW"},{"node":"module.dependencies.aws_mq_broker.mq","attribute":"subnet_ids","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.mq_broker/broker-network:REVIEW"},{"node":"module.dependencies.aws_mq_broker.mq","attribute":"user.password","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.aws_mq_broker.mq): user — the broker users are not copied: the draft writes one stackit_rabbitmq_credential for the instance, a user whose username and password STACKIT generates (both computed, pinned provider) — clients get new credentials. (contract aws.mq_broker/tc-user--password:REVIEW)"},{"node":"module.dependencies.aws_mq_broker.mq","attribute":"user.username","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.aws_mq_broker.mq): user — the broker users are not copied: the draft writes one stackit_rabbitmq_credential for the instance, a user whose username and password STACKIT generates (both computed, pinned provider) — clients get new credentials. (contract aws.mq_broker/tc-user--username:REVIEW)"}],"automation_eligible":false,"open_critical_without_read_set":["broker-users"],"gate_blockers":[{"source_type":"aws_mq_broker","attribute":"user.password","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_mq_broker","attribute":"user.username","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_mq_broker","attribute":"broker_name","closure":"CLOSED:REVIEW"},{"source_type":"aws_mq_broker","attribute":"deployment_mode","closure":"CLOSED:REVIEW"},{"source_type":"aws_mq_broker","attribute":"engine_version","closure":"CLOSED:REVIEW"},{"source_type":"aws_mq_broker","attribute":"publicly_accessible","closure":"CLOSED:REVIEW"},{"source_type":"aws_mq_broker","attribute":"security_groups","closure":"CLOSED:REVIEW"},{"source_type":"aws_mq_broker","attribute":"subnet_ids","closure":"CLOSED:REVIEW"},{"source_type":"aws_mq_broker","semantic":"convert:module.dependencies.aws_mq_broker.mq:dependencies_mq_plan_name:SIZE_FROM_SOURCE","closure":"CONVERT:open-decision"},{"source_type":"aws_mq_broker","semantic":"convert:module.dependencies.aws_mq_broker.mq:exposure:EXPOSURE_WIDENED","closure":"CONVERT:open-decision"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"broker-users","closure":"open-critical-without-read-set"}]}},{"id":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","source_type":"aws_opensearch_domain","category":"data","kind":"search_cluster","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.dependencies.module.catalog_opensearch","open_dependencies":["module.vpc.module.vpc.aws_subnet.private"],"facets":["module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this"],"configuration_completeness":"COMPLETE","depends_on":["module.dependencies.aws_security_group.catalog_opensearch_sg","module.vpc.module.vpc.aws_subnet.private"],"wave":4,"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":29,"end_line":233},"result":{"rule_id":"aws.opensearch","case_id":"opensearch","class":"REPLATFORM","confidence":"LOW","target":{"service":"STACKIT OpenSearch","resources":["stackit_opensearch_instance","stackit_opensearch_credential"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): opensearch lists 42 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): opensearch lists 42 offerings"}]},"reason":"Indices move to STACKIT OpenSearch by reindexing from the source; a snapshot restores only into the same or a newer OpenSearch version, never an older one, so a source newer than the version STACKIT offers cannot be restored (engine-version-downgrade finding). Cluster sizing becomes a STACKIT plan; UltraWarm/cold tiers and fine-grained IAM access have no equivalent.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/opensearch_instance","https://docs.opensearch.org/latest/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-restore/"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"engine-version-downgrade","severity":"critical","message":"Engine version DOWNGRADE: the source runs OpenSearch 3.3 (engine_version); STACKIT OpenSearch in eu01 offers 2 (service catalogue of eu01, read 2026-10-18), older than the source. A snapshot of 3.3 cannot be restored into 2 (OpenSearch restores a snapshot into the same or a newer version only); reindex from the source, or write to both during the cutover (dual-write), is the path; whether the clients work against 2 is unknown. Options (decision ENGINE_VERSION_DOWNGRADE): move the data into 2 by that path, run OpenSearch 3.3 yourself on SKE (self-managed), or wait until STACKIT offers 3.3; the draft takes none of them for you.","evidence":["kb/stackit/eu01.json","https://docs.opensearch.org/latest/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-restore/","https://docs.stackit.cloud/products/databases/opensearch/release-notes/"],"blocker_category":"FEATURE"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.opensearch","expected":35,"observed":14,"accounted":14,"unaccounted":0,"critical_unaccounted":[],"critical_open":["engine-version","fine-grained-access","private-endpoint","encryption-at-rest","domain-settings","domain-credentials-and-keys","access-and-encryption-settings","cluster-layout-settings","credentials-and-keys-settings","network-settings","storage-settings","tc-opensearch-domain-domain-name","nbr-aws-opensearch-domain-policy","opensearch-domain-policy-resource"],"items":[{"id":"engine-version","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:opensearch"},{"id":"fine-grained-access","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:opensearch"},{"id":"warm-cold-tiers","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"private-endpoint","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:opensearch"},{"id":"encryption-at-rest","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:opensearch"},{"id":"domain-settings","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:opensearch"},{"id":"domain-credentials-and-keys","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"case:opensearch"},{"id":"access-and-encryption-settings","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:opensearch"},{"id":"cluster-layout-settings","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:opensearch"},{"id":"credentials-and-keys-settings","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"case:opensearch"},{"id":"external-login-settings","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-publishing-settings","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"network-settings","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:opensearch"},{"id":"storage-settings","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:opensearch"},{"id":"tc-domain-endpoint-options--custom-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-opensearch-domain-domain-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:opensearch"},{"id":"tc-opensearch-domain-domain-endpoint-options--custom-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-authorize-vpc-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-domain-policy","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:opensearch"},{"id":"nbr-aws-opensearch-domain-saml-options","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-outbound-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-package-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"opensearch-domain-policy-resource","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:opensearch"},{"id":"opensearch-saml-authentication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"opensearch-saml-idp","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"opensearch-vpc-endpoint-resource","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"opensearch-package-association-resource","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"opensearch-cross-cluster-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"opensearch-cross-cluster-search-options","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"opensearch-cross-cluster-local-side","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"opensearch-cross-cluster-peer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"opensearch-part-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"opensearch-part-id","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REPLATFORM","change_types":["CONFIG","DATA"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT OpenSearch","confidence":"LOW"}},"property_accounting":{"set":27,"excluded":3,"meaningful":24,"by_status":{"CONSUMED":0,"CONTRACT":1,"NOT_CARRIED":23,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"advanced_options"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"advanced_security_options.anonymous_auth_enabled"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"advanced_security_options.enabled"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"advanced_security_options.internal_user_database_enabled"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"advanced_security_options.master_user_options.master_user_name"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"advanced_security_options.master_user_options.master_user_password"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"cluster_config.dedicated_master_count"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"cluster_config.dedicated_master_enabled"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"cluster_config.dedicated_master_type"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"cluster_config.instance_count"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"cluster_config.instance_type"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"cluster_config.zone_awareness_enabled"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"domain_endpoint_options.enforce_https"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"domain_endpoint_options.tls_security_policy"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"ebs_options.ebs_enabled"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"ebs_options.volume_size"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"ebs_options.volume_type"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"encrypt_at_rest.enabled"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"engine_version"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"node_to_node_encryption.enabled"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"vpc_options.security_group_ids"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"vpc_options.subnet_ids"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this","attribute":"access_policies"}],"class_counts":{"CRITICAL":20,"NON_CRITICAL":4},"critical":[{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"advanced_options","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters. (contract aws.opensearch/access-and-encryption-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"advanced_security_options.anonymous_auth_enabled","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters. (contract aws.opensearch/access-and-encryption-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"advanced_security_options.enabled","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters. (contract aws.opensearch/access-and-encryption-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"advanced_security_options.internal_user_database_enabled","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters. (contract aws.opensearch/access-and-encryption-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"advanced_security_options.master_user_options.master_user_name","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+UNSUPPORTED","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters. (contract aws.opensearch/credentials-and-keys-settings:UNSUPPORTED)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"advanced_security_options.master_user_options.master_user_password","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:NC+UNSUPPORTED","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters. (contract aws.opensearch/credentials-and-keys-settings:UNSUPPORTED)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"cluster_config.dedicated_master_count","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): cluster_config — the plan (plan_name) sets the size of a stackit_opensearch_instance (pinned provider): the cluster's instance types and counts, dedicated masters and zone awareness are not carried — choose the plan for them. (contract aws.opensearch/cluster-layout-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"cluster_config.dedicated_master_enabled","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): cluster_config — the plan (plan_name) sets the size of a stackit_opensearch_instance (pinned provider): the cluster's instance types and counts, dedicated masters and zone awareness are not carried — choose the plan for them. (contract aws.opensearch/cluster-layout-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"cluster_config.instance_count","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): cluster_config — the plan (plan_name) sets the size of a stackit_opensearch_instance (pinned provider): the cluster's instance types and counts, dedicated masters and zone awareness are not carried — choose the plan for them. (contract aws.opensearch/cluster-layout-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"cluster_config.zone_awareness_enabled","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): cluster_config — the plan (plan_name) sets the size of a stackit_opensearch_instance (pinned provider): the cluster's instance types and counts, dedicated masters and zone awareness are not carried — choose the plan for them. (contract aws.opensearch/cluster-layout-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"domain_endpoint_options.enforce_https","class":"CRITICAL","category":"encryption","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters. (contract aws.opensearch/access-and-encryption-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"domain_endpoint_options.tls_security_policy","class":"CRITICAL","category":"encryption","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters. (contract aws.opensearch/access-and-encryption-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"domain_name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"aws.opensearch/tc-opensearch-domain-domain-name:REVIEW"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"ebs_options.ebs_enabled","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters. (contract aws.opensearch/domain-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"encrypt_at_rest.enabled","class":"CRITICAL","category":"encryption","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters. (contract aws.opensearch/access-and-encryption-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"engine_version","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters. (contract aws.opensearch/engine-version:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"node_to_node_encryption.enabled","class":"CRITICAL","category":"encryption","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters. (contract aws.opensearch/access-and-encryption-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"vpc_options.security_group_ids","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters. (contract aws.opensearch/network-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"vpc_options.subnet_ids","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters. (contract aws.opensearch/network-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this","attribute":"access_policies","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this): access_policies — the access policy of the domain: Statement[0] allows any principal es:* (with a condition or a part that is not visible statically): a stackit_opensearch_instance grants access by generated credentials (stackit_opensearch_credential) and the network ranges of parameters.sgw_acl (pinned provider) and has no resource policy, so a policy that separates principals has no counterpart — list the principals and decide how their separation is kept (one instance per trust level, or in the application). (contract aws.opensearch/opensearch-domain-policy-resource:REVIEW)"}],"automation_eligible":false,"open_critical_without_read_set":["private-endpoint"],"gate_blockers":[{"source_type":"aws_opensearch_domain","attribute":"advanced_options","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"advanced_security_options.anonymous_auth_enabled","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"advanced_security_options.enabled","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"advanced_security_options.internal_user_database_enabled","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"cluster_config.dedicated_master_count","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"cluster_config.dedicated_master_enabled","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"cluster_config.instance_count","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"cluster_config.zone_awareness_enabled","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"domain_endpoint_options.enforce_https","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"domain_endpoint_options.tls_security_policy","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"ebs_options.ebs_enabled","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"encrypt_at_rest.enabled","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"engine_version","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"node_to_node_encryption.enabled","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"vpc_options.security_group_ids","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"vpc_options.subnet_ids","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain_policy","attribute":"access_policies","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_opensearch_domain","attribute":"advanced_security_options.master_user_options.master_user_name","closure":"CLOSED:NC+UNSUPPORTED"},{"source_type":"aws_opensearch_domain","attribute":"advanced_security_options.master_user_options.master_user_password","closure":"CLOSED:NC+UNSUPPORTED"},{"source_type":"aws_opensearch_domain","attribute":"domain_name","closure":"CLOSED:REVIEW"},{"source_type":"aws_opensearch_domain","semantic":"convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:data:DATA_MOVEMENT","closure":"CONVERT:open-decision"},{"source_type":"aws_opensearch_domain","semantic":"convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:exposure:EXPOSURE_WIDENED","closure":"CONVERT:open-decision"},{"source_type":"aws_opensearch_domain","semantic":"convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:version:ENGINE_VERSION_DOWNGRADE","closure":"CONVERT:open-decision"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"private-endpoint","closure":"open-critical-without-read-set"}]}},{"id":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","source_type":"aws_rds_cluster","category":"data","kind":"relational_database_cluster","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.dependencies.module.catalog_rds","open_dependencies":["module.vpc.module.vpc.aws_subnet.private"],"facets":["module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this"],"configuration_completeness":"COMPLETE","depends_on":["module.dependencies.module.catalog_rds.aws_security_group.this","module.vpc.module.vpc.aws_subnet.private"],"wave":4,"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":61,"end_line":169},"result":{"rule_id":"aws.rds_cluster","case_id":"aurora-mysql","class":"REPLATFORM","confidence":"LOW","target":{"service":"STACKIT MariaDB","resources":["stackit_mariadb_instance"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): mariadb lists 43 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): mariadb lists 43 offerings"}]},"reason":"Aurora MySQL has no MySQL target on STACKIT; MariaDB is the closest engine and needs compatibility testing. (Whether deps[0] (the value of db_subnet_group_name of module.dependencies.module.catalog_rds.aws_rds_cluster.this may be null (a condition not known statically); the same cause covers 1 more relationship(s)) exist was evaluated for each possibility; the mapping decides the same either way.)","evidence":["https://docs.stackit.cloud/products/databases/postgresql-flex/","https://docs.stackit.cloud/products/databases/mariadb/"],"validated_against":"terraform-provider-stackit@0.116.0; docs postgresql-flex/mariadb 2026-09-25; aurora-replica and aurora-replica-cross-region review lines re-checked 2026-10-31 against the provider schema 0.119.0 (postgresflex_instance, mariadb_instance: no read replica of another instance), the postgres-flex v3 / mariadb v2 API specs, the PostgreSQL Flex architecture page and the STACKIT regions page; aurora-deletion-protection re-checked 2026-10-07 against provider schema 0.117.0 (stackit_postgresflex_instance: no protection attribute), the postgres-flex v3 API spec (POST .../protections isDeletable) and the PostgreSQL Flex instance-protection docs","findings":[{"check_id":"aurora-storage-encrypted-mariadb","severity":"warning","message":"Storage is encrypted at rest with an AWS-managed key. STACKIT MariaDB lists \"data-at-rest encryption\" as a feature, but a sandbox instance (MariaDB 10.11, 2026-09-24) had database-level encryption off (innodb_encrypt_tables, innodb_encrypt_log, encrypt_binlog, aria_encrypt_tables = OFF); whether the volumes beneath are encrypted cannot be observed from a client and is not stated: no STACKIT fact is documented, so it is UNKNOWN and is not relied on.","evidence":["https://docs.stackit.cloud/products/databases/mariadb/basics/core-features-and-use-cases/","docs/benchmark/probes/2026-09-24_probe1_kvs-mariadb/README.md"],"blocker_category":"COMPLIANCE"},{"check_id":"aurora-mysql-mariadb-auth","severity":"warning","message":"The source engine is MySQL 8 and its accounts do not move. MySQL 8.0's default authentication plugin is caching_sha2_password (system variable default_authentication_plugin), MariaDB 10.11's default is mysql_native_password or unix_socket; users created with MySQL's SHA256 password algorithm cannot be used in MariaDB 10.11 (MDEV-9804), and a caching_sha2_password plugin exists in MariaDB Community Server only from 11.4.9, 11.8.4 and 12.1 and is not installed by default, while STACKIT offers MariaDB 10.11 (catalogue 2026-10-18). Create the accounts on the target and check that every client library authenticates with a plugin MariaDB 10.11 offers: a client setting that requires caching_sha2_password cannot connect.","evidence":["https://mariadb.com/docs/release-notes/community-server/about/compatibility-and-differences/incompatibilities-and-feature-differences-between-mariadb-10-11-and-mysql-8","https://mariadb.com/docs/release-notes/community-server/about/compatibility-and-differences/system-variable-differences-between-mariadb-and-mysql/system-variable-differences-between-mariadb-10-11-and-mysql-8-0","https://mariadb.com/docs/server/server-management/install-and-upgrade-mariadb/migrating-to-mariadb/moving-from-mysql/mysql-to-mariadb-compatibility-matrix","https://mariadb.com/docs/server/reference/plugins/authentication-plugins/authentication-plugin-caching_sha2_password","kb/stackit/eu01.json"]},{"check_id":"aurora-mysql-mariadb-json","severity":"warning","message":"MariaDB stores JSON as text, not in a binary format as MySQL: its JSON data type is an alias for LONGTEXT, so the JSON columns of the source become text columns and JSON values are compared as strings, where MySQL compares them as JSON values. MariaDB 10.11 does not support MySQL's JSON operators -\u003e and -\u003e\u003e (MDEV-13594): a query that uses them is rewritten with the JSON functions (JSON_EXTRACT, JSON_UNQUOTE); JSON_SEARCH given invalid data returns NULL and a warning where MySQL raises an error.","evidence":["https://mariadb.com/docs/release-notes/community-server/about/compatibility-and-differences/incompatibilities-and-feature-differences-between-mariadb-10-11-and-mysql-8","https://mariadb.com/docs/server/server-management/install-and-upgrade-mariadb/migrating-to-mariadb/moving-from-mysql/mysql-to-mariadb-compatibility-matrix","https://mariadb.com/docs/server/reference/sql-functions/special-functions/json-functions"]},{"check_id":"aurora-mysql-mariadb-collation","severity":"warning","message":"The defaults of the character set and the collation differ: MySQL 8.0 uses utf8mb4 and utf8mb4_0900_ai_ci, MariaDB 10.11 uses latin1 or utf8 and latin1_swedish_ci or utf8_general_ci, and MariaDB names utf8mb4_uca1400_ai_ci as the counterpart default only from 11.4. Not all character sets and collations exist in both products, and the pages read do not list utf8mb4_0900_ai_ci as a MariaDB 10.11 collation: check every collation the schema, the dump and the queries name with SHOW COLLATION on the target, and set the character set of every database explicitly.","evidence":["https://mariadb.com/docs/release-notes/community-server/about/compatibility-and-differences/incompatibilities-and-feature-differences-between-mariadb-10-11-and-mysql-8","https://mariadb.com/docs/release-notes/community-server/about/compatibility-and-differences/system-variable-differences-between-mariadb-and-mysql/system-variable-differences-between-mariadb-10-11-and-mysql-8-0","https://mariadb.com/docs/server/server-management/install-and-upgrade-mariadb/migrating-to-mariadb/moving-from-mysql/mysql-to-mariadb-compatibility-matrix"]},{"check_id":"aurora-mysql-mariadb-sql-mode","severity":"warning","message":"The default sql_mode differs: MySQL 8.0 sets ONLY_FULL_GROUP_BY, STRICT_TRANS_TABLES, NO_ZERO_IN_DATE, NO_ZERO_DATE, ERROR_FOR_DIVISION_BY_ZERO and NO_ENGINE_SUBSTITUTION; MariaDB 10.11 sets STRICT_TRANS_TABLES, ERROR_FOR_DIVISION_BY_ZERO, NO_AUTO_CREATE_USER and NO_ENGINE_SUBSTITUTION. Without ONLY_FULL_GROUP_BY the GROUP BY semantics the queries rely on are not enforced the way MySQL enforces them, and zero dates and zero parts in dates are no longer refused by default. A parameter group of the source may set sql_mode itself, and whether the STACKIT instance lets sql_mode be set is not established here: test the queries and the inserts against the target.","evidence":["https://mariadb.com/docs/release-notes/community-server/about/compatibility-and-differences/system-variable-differences-between-mariadb-and-mysql/system-variable-differences-between-mariadb-10-11-and-mysql-8-0"]},{"check_id":"aurora-mysql-mariadb-queries","severity":"info","message":"Common table expressions (non-recursive and recursive) and window functions are supported by both products (window functions since MariaDB 10.2, per MariaDB's compatibility matrix), so no incompatibility is documented for them; the queries are tested anyway. Documented differences in queries: MariaDB 10.11 does not support lateral derived tables (MDEV-19078) or the MAX_EXECUTION_TIME optimizer hint, and the function VALUES() is called VALUE(); INFORMATION_SCHEMA.COLUMNS has slightly different fields and the role views differ; the performance schema is off by default in MariaDB 10.11 and on in MySQL. Generated columns are compatible: tables created with MySQL 5.7 or later that hold generated columns import into MariaDB, and STORED is an alias of PERSISTENT.","evidence":["https://mariadb.com/docs/release-notes/community-server/about/compatibility-and-differences/incompatibilities-and-feature-differences-between-mariadb-10-11-and-mysql-8","https://mariadb.com/docs/server/server-management/install-and-upgrade-mariadb/migrating-to-mariadb/moving-from-mysql/mysql-to-mariadb-compatibility-matrix","https://mariadb.com/docs/server/reference/sql-statements/data-definition/create/generated-columns"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.rds_cluster","expected":113,"observed":24,"accounted":24,"unaccounted":0,"critical_unaccounted":[],"critical_open":["admin-password","admin-username-not-carried","backup-retention","db-network-placement","engine","engine-version","final-snapshot","member-engine","member-settings","parameter-and-option-groups","security-groups","storage-encryption","tc-database-name","tcf-rds-cluster-instance--identifier","tcfp-rds-cluster-instance--engine","tcfp-rds-cluster-instance--engine-version","tcp-backup-retention-period","tcp-db-cluster-parameter-group-name","tcp-db-subnet-group-name","tcp-vpc-security-group-ids"],"items":[{"id":"serverless-scaling-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"idle-auto-termination","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"engine","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-mysql"},{"id":"engine-version","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-mysql"},{"id":"backup-retention","critical":true,"observed":"yes","disposition":"LEDGER","by":"ledger:backup retention"},{"id":"high-availability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"network-exposure","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-target-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-policy-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"scheduled-scaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"customer-managed-key-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"storage-encryption","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:aurora-storage-encrypted-mariadb"},{"id":"storage-encryption-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tls-enforcement","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-authentication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-authentication-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-protection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-protection-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-protection-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-authentication-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-exports-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"global-replication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"activity-stream","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"serverless-scaling","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"log-exports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-exports-none","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:aurora-mysql"},{"id":"directory-authentication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"directory-authentication-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"multiaz-high-availability","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:aurora-mysql"},{"id":"multiaz-network-exposure","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:aurora-mysql"},{"id":"readable-standbys","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:aurora-mysql"},{"id":"db-network-placement","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:aurora-mysql"},{"id":"admin-username","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"admin-username-not-carried","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-mysql"},{"id":"admin-password","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:aurora-mysql"},{"id":"admin-username-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"master-secret-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"master-secret-rotation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"security-groups","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:aurora-mysql"},{"id":"parameter-and-option-groups","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:aurora-mysql"},{"id":"final-snapshot","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-mysql"},{"id":"performance-insights-key-none","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"performance-insights-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"aurora-extras","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"restore-and-replication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"member-engine","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-mysql"},{"id":"member-settings","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:aurora-mysql"},{"id":"log-subscription-filters","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"log-subscription-filter-pattern","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-subscription-filter-destination","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-subscription-filter-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-subscription-filter-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-subscription-filter-distribution","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ca-certificate-identifier","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-db-instance-parameter-group-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-domain-iam-role-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-master-password-wo","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-restore-to-point-in-time--restore-to-time","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-restore-to-point-in-time--restore-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-restore-to-point-in-time--source-cluster-identifier","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-restore-to-point-in-time--use-latest-restorable-time","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-s3-import--bucket-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-s3-import--bucket-prefix","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-s3-import--ingestion-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-s3-import--source-engine","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-s3-import--source-engine-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-rds-cluster-instance--custom-iam-instance-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-rds-cluster-instance--force-destroy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--external-secret-rotation-metadata--key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--external-secret-rotation-metadata--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--rotation-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-restore-to-point-in-time--source-cluster-resource-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfr-secretsmanager-secret-rotation--external-secret-rotation-role-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-availability-zones","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-backup-retention-period","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-mysql","withdrawn_by":["backup-retention"]},{"id":"tcp-db-cluster-parameter-group-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-mysql","withdrawn_by":["parameter-and-option-groups"]},{"id":"tcp-db-subnet-group-name","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:aurora-mysql","withdrawn_by":["db-network-placement"]},{"id":"tcp-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-final-snapshot-identifier","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-iam-roles","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-network-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-rds-cluster-instance--engine","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-mysql","withdrawn_by":["member-engine"]},{"id":"tcfp-rds-cluster-instance--engine-version","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-mysql","withdrawn_by":["member-engine"]},{"id":"tcp-vpc-security-group-ids","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-mysql","withdrawn_by":["security-groups"]},{"id":"tc-database-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-mysql"},{"id":"tcf-rds-cluster-instance--identifier","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-mysql"},{"id":"tcfp-secretsmanager-secret-rotation--external-secret-rotation-metadata--key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--external-secret-rotation-metadata--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--rotation-rules--automatically-after-days","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--rotation-rules--schedule-expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-rds-cluster-endpoint--cluster-endpoint-identifier","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-cluster-snapshot","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-event-subscription","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rds-cluster-role-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-rds-cluster-role-association--feature-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-rds-cluster-role-association--role-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-rds-cluster-role-association--region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-rds-cluster-role-association--id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rds-global-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rds-integration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rds-shard-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-cluster-snapshot","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-awscc-rds-cluster-snapshot-db-cluster-snapshot-identifier","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-shard-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-awscc-rds-db-shard-group-compute-redundancy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-awscc-rds-db-shard-group-db-shard-group-identifier","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-awscc-rds-db-shard-group-max-acu","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-awscc-rds-db-shard-group-min-acu","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-awscc-rds-db-shard-group-publicly-accessible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REPLATFORM","change_types":["CONFIG","DATA"],"blocker_categories":["FEATURE","COMPLIANCE","UNKNOWN"],"target_platform":"STACKIT MariaDB","confidence":"LOW"}},"property_accounting":{"set":34,"excluded":8,"meaningful":26,"by_status":{"CONSUMED":3,"CONTRACT":7,"NOT_CARRIED":16,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"allow_major_version_upgrade"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"backup_retention_period"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"database_name"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"db_cluster_parameter_group_name"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"db_subnet_group_name"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"master_password"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"master_username"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"port"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"preferred_backup_window"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"preferred_maintenance_window"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"skip_final_snapshot"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","attribute":"db_parameter_group_name"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","attribute":"db_subnet_group_name"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","attribute":"identifier"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","attribute":"monitoring_role_arn"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","attribute":"preferred_maintenance_window"}],"class_counts":{"CRITICAL":16,"NON_CRITICAL":10},"critical":[{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"backup_retention_period","class":"CRITICAL","category":"backup-retention","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster.this): backup_retention_period = 7, preferred_backup_window = 02:00-03:00 — stackit_mariadb_instance has no backup setting (pinned provider). (contract aws.rds_cluster/backup-retention:LEDGER)"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"database_name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster.this): database_name = catalog — stackit_mariadb_instance has no database attribute (pinned provider): create the database after connecting. (contract aws.rds_cluster/tc-database-name:REVIEW)"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"db_cluster_parameter_group_name","class":"CRITICAL","category":"encryption","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster.this): preferred_maintenance_window = sun:05:00-sun:06:00, allow_major_version_upgrade = true, db_cluster_parameter_group_name — stackit_mariadb_instance has no maintenance window, version-upgrade policy, extended-support, CA-certificate, option-group or parameter-group attribute (pinned provider). (contract aws.rds_cluster/parameter-and-option-groups:REVIEW)"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"db_subnet_group_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster.this): db_subnet_group_name — stackit_mariadb_instance has no subnet, availability-zone or IP-family attribute (pinned provider): clients reach the instance at the endpoint STACKIT assigns. (contract aws.rds_cluster/db-network-placement:REVIEW)"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"engine","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.rds_cluster/engine:REVIEW"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"engine_version","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.rds_cluster/engine-version:REVIEW"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"master_password","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster.this): master_password — the source password is not copied: stackit_mariadb_credential has no password input, STACKIT generates it (the password is computed and sensitive, pinned provider) — hand the new one to the application. (contract aws.rds_cluster/admin-password:REVIEW)"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"master_username","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster.this): master_username = root — stackit_mariadb_credential takes no username: the username and the password are computed by STACKIT (pinned provider) — clients get new credentials. (contract aws.rds_cluster/admin-username-not-carried:REVIEW)"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"skip_final_snapshot","class":"CRITICAL","category":"backup-retention","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster.this): skip_final_snapshot = true — stackit_mariadb_instance has no final-snapshot or delete-time backup-retention setting (pinned provider): the instance is deleted immediately (and its automated backups may be removed immediately) when Terraform destroys the resource — export the data first if it must survive the cut-over. (contract aws.rds_cluster/final-snapshot:REVIEW)"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"storage_encrypted","class":"CRITICAL","category":"encryption","closure":"CLOSED:REVIEW","by":"aws.rds_cluster/storage-encryption:REVIEW"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"vpc_security_group_ids","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.rds_cluster/security-groups:REVIEW"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","attribute":"db_parameter_group_name","class":"CRITICAL","category":"encryption","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this): identifier = (reads a variable; its default is not printed), db_subnet_group_name, preferred_maintenance_window = sun:05:00-sun:06:00, db_parameter_group_name — cluster members are not separate STACKIT resources — the plan (plan_name) defines the nodes (pinned provider): member names, failover priority, zone, subnet, windows, upgrade policy, parameter group, CA certificate and instance profile have no attribute. (contract aws.rds_cluster/member-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","attribute":"db_subnet_group_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this): identifier = (reads a variable; its default is not printed), db_subnet_group_name, preferred_maintenance_window = sun:05:00-sun:06:00, db_parameter_group_name — cluster members are not separate STACKIT resources — the plan (plan_name) defines the nodes (pinned provider): member names, failover priority, zone, subnet, windows, upgrade policy, parameter group, CA certificate and instance profile have no attribute. (contract aws.rds_cluster/member-settings:REVIEW)"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","attribute":"engine","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.rds_cluster/member-engine:REVIEW"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","attribute":"engine_version","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.rds_cluster/member-engine:REVIEW"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","attribute":"identifier","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this): identifier = (reads a variable; its default is not printed), db_subnet_group_name, preferred_maintenance_window = sun:05:00-sun:06:00, db_parameter_group_name — cluster members are not separate STACKIT resources — the plan (plan_name) defines the nodes (pinned provider): member names, failover priority, zone, subnet, windows, upgrade policy, parameter group, CA certificate and instance profile have no attribute. (contract aws.rds_cluster/tcf-rds-cluster-instance--identifier:REVIEW)"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_rds_cluster","attribute":"backup_retention_period","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster","attribute":"database_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster","attribute":"db_cluster_parameter_group_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster","attribute":"db_subnet_group_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster","attribute":"master_password","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster","attribute":"master_username","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster","attribute":"skip_final_snapshot","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster_instance","attribute":"db_parameter_group_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster_instance","attribute":"db_subnet_group_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster_instance","attribute":"identifier","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster","attribute":"engine","closure":"CLOSED:REVIEW"},{"source_type":"aws_rds_cluster","attribute":"engine_version","closure":"CLOSED:REVIEW"},{"source_type":"aws_rds_cluster","attribute":"storage_encrypted","closure":"CLOSED:REVIEW"},{"source_type":"aws_rds_cluster","attribute":"vpc_security_group_ids","closure":"CLOSED:REVIEW"},{"source_type":"aws_rds_cluster_instance","attribute":"engine","closure":"CLOSED:REVIEW"},{"source_type":"aws_rds_cluster_instance","attribute":"engine_version","closure":"CLOSED:REVIEW"},{"source_type":"aws_rds_cluster","semantic":"convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:data:DATA_MOVEMENT","closure":"CONVERT:open-decision"},{"source_type":"aws_rds_cluster","semantic":"convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED","closure":"CONVERT:open-decision"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","source_type":"aws_elasticache_replication_group","category":"data","kind":"in_memory_cache","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.dependencies.module.checkout_elasticache_redis","open_dependencies":["module.vpc.module.vpc.aws_subnet.private"],"configuration_completeness":"COMPLETE","depends_on":["module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","module.vpc.module.vpc.aws_subnet.private"],"wave":4,"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf","line":115,"end_line":164},"result":{"rule_id":"aws.elasticache","case_id":"redis-valkey","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Key Value Store (Valkey)","resources":["stackit_valkey_instance","stackit_valkey_credential"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): keyvalue lists 18 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): keyvalue lists 18 offerings"}]},"reason":"Redis/Valkey caches move to STACKIT Key Value Store (Valkey, Redis-protocol compatible, GA since August 2026). Do not target stackit_redis_instance: it is deprecated and removed after August 2027.","evidence":["https://docs.stackit.cloud/products/databases/key-value-store/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/valkey_instance","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/elasticache_serverless_cache"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_redis_instance deprecated: removed after August 2027; use stackit_valkey_instance)","findings":[{"check_id":"redis-transit-encryption-off","severity":"warning","message":"The source cache runs without TLS (transit_encryption_enabled = false). STACKIT Key Value Store accepts TLS only: a test on a STACKIT project (Valkey 8, single plan, eu01, 2026-09-24) found a plaintext connection closed by the server, TLS 1.2 and 1.3 accepted, and the how-to connects with rediss:// and valkey-cli --tls. Every client of the cache changes: the scheme redis:// becomes rediss://, the driver's TLS option is switched on and the instance's CA certificate is trusted, before the cutover.","evidence":["https://docs.stackit.cloud/products/databases/key-value-store/how-tos/connect-to-your-instance/","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/elasticache_replication_group#transit_encryption_enabled-1","docs/benchmark/probes/2026-09-24_probe1_kvs-mariadb/README.md"]},{"check_id":"redis-engine-version","severity":"info","message":"The engine version becomes the Valkey version offered by STACKIT (version attribute); check client compatibility with that version.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/valkey_instance"]},{"check_id":"redis-parameter-group","severity":"info","message":"Not verifiable statically (parameter_group_name not visible): A custom parameter group is attached; map each changed parameter to the Valkey parameters block (maxmemory_policy, notify_keyspace_events, …).","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/valkey_instance"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"engine-version-upgrade","severity":"warning","message":"Engine version UPGRADE: the source runs Valkey 4.0.10 (engine_version); STACKIT Valkey in eu01 offers 8 (service catalogue of eu01, read 2026-10-18), none of them the source's version. Moving the data upgrades the engine: test the application and the data against the version you choose before the cutover; the draft does not choose it.","evidence":["kb/stackit/eu01.json","https://docs.stackit.cloud/products/databases/redis/release-notes/"],"blocker_category":"FEATURE"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.elasticache","expected":68,"observed":12,"accounted":12,"unaccounted":0,"critical_unaccounted":[],"critical_open":["parameter-group","parameter-group-default","failover-off","snapshots-off","at-rest-encryption-off","network-placement","seed-snapshot","tcp-elasticache-replication-group-at-rest-encryption-enabled","tcp-elasticache-replication-group-num-cache-clusters","tcp-elasticache-replication-group-transit-encryption-enabled","tc-elasticache-replication-group-replication-group-id"],"items":[{"id":"engine","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"engine-version","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"check:redis-engine-version"},{"id":"autoscaling-target-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-policy-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"scheduled-scaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"auth-token","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"acl-users","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"transit-encryption","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"transit-encryption-preferred","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"at-rest-encryption","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"failover-replicas","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"snapshot-retention","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"global-replication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"parameter-group","critical":true,"observed":"unknown","disposition":"REVIEW","by":"unverified-check:redis-parameter-group"},{"id":"parameter-group-default","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:redis-valkey"},{"id":"log-delivery","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-mode-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-mode-disabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cache-node-count","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"failover-off","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:redis-valkey"},{"id":"snapshots-off","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:redis-valkey"},{"id":"at-rest-encryption-off","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:redis-valkey"},{"id":"network-placement","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:redis-valkey"},{"id":"seed-snapshot","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:redis-valkey"},{"id":"auth-token-rotation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"serverless-engine","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"serverless-engine-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"serverless-snapshot-retention","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"serverless-acl-users","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"serverless-seed-snapshot","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-cluster-availability-zone","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-cluster-az-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-cluster-final-snapshot-identifier","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-cluster-ip-discovery","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-cluster-outpost-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-cluster-preferred-availability-zones","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-replication-group-durability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-replication-group-final-snapshot-identifier","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-replication-group-ip-discovery","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-replication-group-node-group-configuration--primary-availability-zone","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-replication-group-node-group-configuration--replica-availability-zones","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-replication-group-node-group-configuration--replica-count","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-elasticache-cluster-preferred-outpost-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-elasticache-replication-group-node-group-configuration--primary-outpost-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-elasticache-replication-group-node-group-configuration--replica-outpost-arns","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-elasticache-replication-group-at-rest-encryption-enabled","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:redis-valkey","withdrawn_by":["at-rest-encryption-off"]},{"id":"tcp-elasticache-replication-group-transit-encryption-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-elasticache-cluster-transit-encryption-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-elasticache-replication-group-num-cache-clusters","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:redis-valkey","withdrawn_by":["failover-off"]},{"id":"tcp-elasticache-replication-group-num-node-groups","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-elasticache-replication-group-replicas-per-node-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-elasticache-replication-group-transit-encryption-enabled","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:redis-valkey"},{"id":"tcp-elasticache-serverless-cache-engine","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-elasticache-serverless-cache-network-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-elasticache-serverless-cache-snapshot-arns-to-restore","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-elasticache-replication-group-user-group-ids","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-elasticache-serverless-cache-security-group-ids","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-elasticache-serverless-cache-subnet-ids","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-serverless-cache-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-cluster-cluster-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-cluster-replication-group-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-elasticache-replication-group-replication-group-id","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:redis-valkey"},{"id":"nbr-aws-elasticache-global-replication-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticache-serverless-cache-snapshot","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfr-awscc-elasticache-serverless-cache-snapshot-kms-key-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-awscc-elasticache-serverless-cache-snapshot-serverless-cache-snapshot-name","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT Key Value Store (Valkey)","confidence":"MEDIUM"}},"property_accounting":{"set":21,"excluded":3,"meaningful":18,"by_status":{"CONSUMED":1,"CONTRACT":7,"NOT_CARRIED":10,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"data_tiering_enabled"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"maintenance_window"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"notification_topic_arn"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"num_cache_clusters"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"parameter_group_name"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"port"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"security_group_ids"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"snapshot_arns"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"snapshot_window"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"subnet_group_name"}],"class_counts":{"CRITICAL":12,"NON_CRITICAL":6},"critical":[{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"at_rest_encryption_enabled","class":"CRITICAL","category":"encryption","closure":"CLOSED:REVIEW","by":"aws.elasticache/at-rest-encryption-off:REVIEW"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"automatic_failover_enabled","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.elasticache/failover-off:REVIEW"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"multi_az_enabled","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.elasticache/failover-off:REVIEW"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"num_cache_clusters","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default): num_cache_clusters = 1 — the plan (plan_name) defines the nodes and replicas of a STACKIT Valkey instance (pinned provider). (contract aws.elasticache/failover-off:REVIEW)"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"parameter_group_name","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default): parameter_group_name — the parameter group is not translated: stackit_valkey_instance takes selected settings under parameters (maxmemory_policy, maxclients, notify_keyspace_events, …; pinned provider) — map the ones the application needs. (contract aws.elasticache/parameter-group:REVIEW)"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"replication_group_id","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"aws.elasticache/tc-elasticache-replication-group-replication-group-id:REVIEW"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"security_group_ids","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default): subnet_group_name, security_group_ids — stackit_valkey_instance has no subnet, security-group, zone or IP-family attribute (pinned provider); the draft limits access with parameters.sgw_acl (CIDRs) from a variable without a default — list the clients. (contract aws.elasticache/network-placement:REVIEW)"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"snapshot_arns","class":"CRITICAL","category":"backup-retention","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default): snapshot_arns — the instance is created empty: seeding it from an ElastiCache snapshot is not generated — migrate the data (e.g. RDB export and import, or replication). (contract aws.elasticache/seed-snapshot:REVIEW)"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"snapshot_retention_limit","class":"CRITICAL","category":"backup-retention","closure":"CLOSED:REVIEW","by":"aws.elasticache/snapshots-off:REVIEW"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"subnet_group_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default): subnet_group_name, security_group_ids — stackit_valkey_instance has no subnet, security-group, zone or IP-family attribute (pinned provider); the draft limits access with parameters.sgw_acl (CIDRs) from a variable without a default — list the clients. (contract aws.elasticache/network-placement:REVIEW)"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"transit_encryption_enabled","class":"CRITICAL","category":"encryption","closure":"CLOSED:REVIEW","by":"aws.elasticache/tcp-elasticache-replication-group-transit-encryption-enabled:REVIEW"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_elasticache_replication_group","attribute":"num_cache_clusters","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_elasticache_replication_group","attribute":"parameter_group_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_elasticache_replication_group","attribute":"security_group_ids","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_elasticache_replication_group","attribute":"snapshot_arns","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_elasticache_replication_group","attribute":"subnet_group_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_elasticache_replication_group","attribute":"at_rest_encryption_enabled","closure":"CLOSED:REVIEW"},{"source_type":"aws_elasticache_replication_group","attribute":"automatic_failover_enabled","closure":"CLOSED:REVIEW"},{"source_type":"aws_elasticache_replication_group","attribute":"multi_az_enabled","closure":"CLOSED:REVIEW"},{"source_type":"aws_elasticache_replication_group","attribute":"replication_group_id","closure":"CLOSED:REVIEW"},{"source_type":"aws_elasticache_replication_group","attribute":"snapshot_retention_limit","closure":"CLOSED:REVIEW"},{"source_type":"aws_elasticache_replication_group","attribute":"transit_encryption_enabled","closure":"CLOSED:REVIEW"},{"source_type":"aws_elasticache_replication_group","semantic":"convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:data:DATA_MOVEMENT","closure":"CONVERT:open-decision"},{"source_type":"aws_elasticache_replication_group","semantic":"convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:dependencies_checkout_elasticache_redis_default_plan_name:SIZE_FROM_SOURCE","closure":"CONVERT:open-decision"},{"source_type":"aws_elasticache_replication_group","semantic":"convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:exposure:EXPOSURE_WIDENED","closure":"CONVERT:open-decision"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.dependencies.module.orders_rds.aws_rds_cluster.this","source_type":"aws_rds_cluster","category":"data","kind":"relational_database_cluster","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.dependencies.module.orders_rds","open_dependencies":["module.vpc.module.vpc.aws_subnet.private"],"facets":["module.dependencies.module.orders_rds.aws_rds_cluster_instance.this"],"configuration_completeness":"COMPLETE","depends_on":["module.dependencies.module.orders_rds.aws_security_group.this","module.vpc.module.vpc.aws_subnet.private"],"wave":4,"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":61,"end_line":169},"result":{"rule_id":"aws.rds_cluster","case_id":"aurora-postgres","class":"REPLATFORM","confidence":"MEDIUM","target":{"service":"STACKIT PostgreSQL Flex","resources":["stackit_postgresflex_instance"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): postgresflex lists 23 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): postgresflex lists 9 offerings"}]},"reason":"Aurora PostgreSQL is wire-compatible PostgreSQL; it lands on PostgreSQL Flex. Aurora-only features (storage auto-scaling up to 256 TiB, fast clones, global databases, serverless v2 scaling) have no equivalent. (Whether deps[0] (the value of db_subnet_group_name of module.dependencies.module.orders_rds.aws_rds_cluster.this may be null (a condition not known statically); the same cause covers 1 more relationship(s)) exist was evaluated for each possibility; the mapping decides the same either way.)","evidence":["https://docs.stackit.cloud/products/databases/postgresql-flex/","https://docs.stackit.cloud/products/databases/mariadb/"],"validated_against":"terraform-provider-stackit@0.116.0; docs postgresql-flex/mariadb 2026-09-25; aurora-replica and aurora-replica-cross-region review lines re-checked 2026-10-31 against the provider schema 0.119.0 (postgresflex_instance, mariadb_instance: no read replica of another instance), the postgres-flex v3 / mariadb v2 API specs, the PostgreSQL Flex architecture page and the STACKIT regions page; aurora-deletion-protection re-checked 2026-10-07 against provider schema 0.117.0 (stackit_postgresflex_instance: no protection attribute), the postgres-flex v3 API spec (POST .../protections isDeletable) and the PostgreSQL Flex instance-protection docs","findings":[{"check_id":"aurora-pg-version-supported","severity":"info","message":"The PostgreSQL major version is one PostgreSQL Flex offers (14–18).","evidence":["https://docs.stackit.cloud/products/databases/postgresql-flex/"]},{"check_id":"aurora-storage-encrypted","severity":"warning","message":"Storage is encrypted at rest with an AWS-managed key; the PostgreSQL Flex encryption block covers customer keys only (the pinned STACKIT provider) and STACKIT does not state the default without it: no STACKIT fact is documented, so at-rest encryption is UNKNOWN until the PostgreSQL Flex product pages or a test on a STACKIT project state it.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/postgresflex_instance"],"blocker_category":"COMPLIANCE"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.rds_cluster","expected":113,"observed":25,"accounted":25,"unaccounted":0,"critical_unaccounted":[],"critical_open":["storage-encryption","db-network-placement","admin-username-not-carried","admin-password","security-groups","parameter-and-option-groups","final-snapshot","member-settings","tcp-backup-retention-period","tcp-db-cluster-parameter-group-name","tcp-db-subnet-group-name","tcfp-rds-cluster-instance--engine","tcfp-rds-cluster-instance--engine-version","tcp-vpc-security-group-ids","tc-database-name","tcf-rds-cluster-instance--identifier"],"items":[{"id":"serverless-scaling-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"idle-auto-termination","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"engine","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:aurora-postgres"},{"id":"engine-version","critical":true,"observed":"yes","disposition":"PRESERVED","by":"check:aurora-pg-version-supported"},{"id":"backup-retention","critical":true,"observed":"yes","disposition":"LEDGER","by":"ledger:backup retention"},{"id":"high-availability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"network-exposure","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-target-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-policy-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"scheduled-scaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"customer-managed-key-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"storage-encryption","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:aurora-storage-encrypted"},{"id":"storage-encryption-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tls-enforcement","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-authentication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-authentication-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-protection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-protection-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-protection-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-authentication-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-exports-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"global-replication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"activity-stream","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"serverless-scaling","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"log-exports","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-exports-none","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:aurora-postgres"},{"id":"directory-authentication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"directory-authentication-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"multiaz-high-availability","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:aurora-postgres"},{"id":"multiaz-network-exposure","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:aurora-postgres"},{"id":"readable-standbys","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:aurora-postgres"},{"id":"db-network-placement","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:aurora-postgres"},{"id":"admin-username","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"admin-username-not-carried","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-postgres"},{"id":"admin-password","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:aurora-postgres"},{"id":"admin-username-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"master-secret-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"master-secret-rotation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"security-groups","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:aurora-postgres"},{"id":"parameter-and-option-groups","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:aurora-postgres"},{"id":"final-snapshot","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-postgres"},{"id":"performance-insights-key-none","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"performance-insights-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"aurora-extras","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:aurora-postgres"},{"id":"restore-and-replication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"member-engine","critical":true,"observed":"yes","disposition":"PRESERVED","by":"check:aurora-pg-version-supported"},{"id":"member-settings","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:aurora-postgres"},{"id":"log-subscription-filters","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"log-subscription-filter-pattern","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-subscription-filter-destination","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-subscription-filter-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-subscription-filter-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-subscription-filter-distribution","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ca-certificate-identifier","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-db-instance-parameter-group-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-domain-iam-role-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-master-password-wo","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-restore-to-point-in-time--restore-to-time","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-restore-to-point-in-time--restore-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-restore-to-point-in-time--source-cluster-identifier","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-restore-to-point-in-time--use-latest-restorable-time","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-s3-import--bucket-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-s3-import--bucket-prefix","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-s3-import--ingestion-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-s3-import--source-engine","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-s3-import--source-engine-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-rds-cluster-instance--custom-iam-instance-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-rds-cluster-instance--force-destroy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--external-secret-rotation-metadata--key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--external-secret-rotation-metadata--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--rotation-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-restore-to-point-in-time--source-cluster-resource-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfr-secretsmanager-secret-rotation--external-secret-rotation-role-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-availability-zones","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-backup-retention-period","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-postgres","withdrawn_by":["backup-retention"]},{"id":"tcp-db-cluster-parameter-group-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-postgres","withdrawn_by":["parameter-and-option-groups"]},{"id":"tcp-db-subnet-group-name","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:aurora-postgres","withdrawn_by":["db-network-placement"]},{"id":"tcp-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-final-snapshot-identifier","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-iam-roles","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-network-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-rds-cluster-instance--engine","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-postgres","withdrawn_by":["member-engine"]},{"id":"tcfp-rds-cluster-instance--engine-version","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-postgres","withdrawn_by":["member-engine"]},{"id":"tcp-vpc-security-group-ids","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-postgres","withdrawn_by":["security-groups"]},{"id":"tc-database-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-postgres"},{"id":"tcf-rds-cluster-instance--identifier","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:aurora-postgres"},{"id":"tcfp-secretsmanager-secret-rotation--external-secret-rotation-metadata--key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--external-secret-rotation-metadata--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--rotation-rules--automatically-after-days","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--rotation-rules--schedule-expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-rds-cluster-endpoint--cluster-endpoint-identifier","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-cluster-snapshot","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-event-subscription","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rds-cluster-role-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-rds-cluster-role-association--feature-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-rds-cluster-role-association--role-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-rds-cluster-role-association--region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-rds-cluster-role-association--id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rds-global-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rds-integration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rds-shard-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-cluster-snapshot","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-awscc-rds-cluster-snapshot-db-cluster-snapshot-identifier","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rds-db-shard-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-awscc-rds-db-shard-group-compute-redundancy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-awscc-rds-db-shard-group-db-shard-group-identifier","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-awscc-rds-db-shard-group-max-acu","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-awscc-rds-db-shard-group-min-acu","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-awscc-rds-db-shard-group-publicly-accessible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REPLATFORM","change_types":["CONFIG","DATA"],"blocker_categories":["FEATURE","COMPLIANCE","UNKNOWN"],"target_platform":"STACKIT PostgreSQL Flex","confidence":"MEDIUM"}},"property_accounting":{"set":35,"excluded":8,"meaningful":27,"by_status":{"CONSUMED":4,"CONTRACT":11,"NOT_CARRIED":12,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"allow_major_version_upgrade"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"db_cluster_parameter_group_name"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"db_subnet_group_name"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"master_password"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"port"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"preferred_maintenance_window"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"skip_final_snapshot"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","attribute":"db_parameter_group_name"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","attribute":"db_subnet_group_name"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","attribute":"identifier"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","attribute":"monitoring_role_arn"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","attribute":"preferred_maintenance_window"}],"class_counts":{"CRITICAL":17,"NON_CRITICAL":10},"critical":[{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"database_name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"aws.rds_cluster/tc-database-name:REVIEW"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"db_cluster_parameter_group_name","class":"CRITICAL","category":"encryption","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster.this): preferred_maintenance_window = sun:05:00-sun:06:00, allow_major_version_upgrade = false, db_cluster_parameter_group_name — stackit_postgresflex_instance has no maintenance window, version-upgrade policy, extended-support, CA-certificate, option-group or parameter-group attribute (pinned provider). (contract aws.rds_cluster/parameter-and-option-groups:REVIEW)"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"db_subnet_group_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster.this): db_subnet_group_name — stackit_postgresflex_instance has no subnet, availability-zone or IP-family attribute (pinned provider): clients reach the instance at the endpoint STACKIT assigns. (contract aws.rds_cluster/db-network-placement:REVIEW)"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"master_password","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster.this): master_password — the source password is not copied: stackit_postgresflex_user has no password input, STACKIT generates it (the password is computed and sensitive, pinned provider) — hand the new one to the application. (contract aws.rds_cluster/admin-password:REVIEW)"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"master_username","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.rds_cluster/admin-username-not-carried:REVIEW"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"skip_final_snapshot","class":"CRITICAL","category":"backup-retention","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster.this): skip_final_snapshot = true — stackit_postgresflex_instance has no final-snapshot or delete-time backup-retention setting (pinned provider): the instance is deleted immediately (and its automated backups may be removed immediately) when Terraform destroys the resource — export the data first if it must survive the cut-over. (contract aws.rds_cluster/final-snapshot:REVIEW)"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"storage_encrypted","class":"CRITICAL","category":"encryption","closure":"CLOSED:REVIEW","by":"aws.rds_cluster/storage-encryption:REVIEW"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"vpc_security_group_ids","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.rds_cluster/security-groups:REVIEW"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","attribute":"db_parameter_group_name","class":"CRITICAL","category":"encryption","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster_instance.this): identifier = (reads a variable; its default is not printed), db_subnet_group_name, preferred_maintenance_window = sun:05:00-sun:06:00, db_parameter_group_name — cluster members are not separate STACKIT resources — the flavor (flavor_id: single or replica) defines the nodes (pinned provider): member names, failover priority, zone, subnet, windows, upgrade policy, parameter group, CA certificate and instance profile have no attribute. (contract aws.rds_cluster/member-settings:REVIEW)"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","attribute":"db_subnet_group_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster_instance.this): identifier = (reads a variable; its default is not printed), db_subnet_group_name, preferred_maintenance_window = sun:05:00-sun:06:00, db_parameter_group_name — cluster members are not separate STACKIT resources — the flavor (flavor_id: single or replica) defines the nodes (pinned provider): member names, failover priority, zone, subnet, windows, upgrade policy, parameter group, CA certificate and instance profile have no attribute. (contract aws.rds_cluster/member-settings:REVIEW)"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","attribute":"identifier","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster_instance.this): identifier = (reads a variable; its default is not printed), db_subnet_group_name, preferred_maintenance_window = sun:05:00-sun:06:00, db_parameter_group_name — cluster members are not separate STACKIT resources — the flavor (flavor_id: single or replica) defines the nodes (pinned provider): member names, failover priority, zone, subnet, windows, upgrade policy, parameter group, CA certificate and instance profile have no attribute. (contract aws.rds_cluster/tcf-rds-cluster-instance--identifier:REVIEW)"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_rds_cluster","attribute":"db_cluster_parameter_group_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster","attribute":"db_subnet_group_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster","attribute":"master_password","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster","attribute":"skip_final_snapshot","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster_instance","attribute":"db_parameter_group_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster_instance","attribute":"db_subnet_group_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster_instance","attribute":"identifier","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_rds_cluster","attribute":"database_name","closure":"CLOSED:REVIEW"},{"source_type":"aws_rds_cluster","attribute":"master_username","closure":"CLOSED:REVIEW"},{"source_type":"aws_rds_cluster","attribute":"storage_encrypted","closure":"CLOSED:REVIEW"},{"source_type":"aws_rds_cluster","attribute":"vpc_security_group_ids","closure":"CLOSED:REVIEW"},{"source_type":"aws_rds_cluster","semantic":"convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:data:DATA_MOVEMENT","closure":"CONVERT:open-decision"},{"source_type":"aws_rds_cluster","semantic":"convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:dependencies_orders_rds_this_flavor_id:SIZE_FROM_SOURCE","closure":"CONVERT:open-decision"},{"source_type":"aws_rds_cluster","semantic":"convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED","closure":"CONVERT:open-decision"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","source_type":"aws_secretsmanager_secret","category":"identity","kind":"secret","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs","facets":["module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db"],"configuration_completeness":"COMPLETE","depends_on":["module.dependencies.module.catalog_rds.aws_rds_cluster.this","module.retail_app_ecs.aws_kms_key.cmk"],"wave":5,"provenance":{"file":"../../lib/ecs/catalog.tf","line":65,"end_line":68},"result":{"rule_id":"aws.secretsmanager_secret","case_id":"secret","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Secrets Manager","resources":["stackit_secretsmanager_instance","stackit_secretsmanager_user"],"maturity":"ga","lifecycle":"active"},"reason":"Secrets move to STACKIT Secrets Manager (a Vault-compatible KV store). Applications switch from the AWS SDK to a Vault client or to injection via the platform (e.g. External Secrets Operator on SKE).","evidence":["https://docs.stackit.cloud/products/security/secrets-manager/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/secretsmanager_instance"],"validated_against":"terraform-provider-stackit@0.116.0; docs security/secrets-manager 2026-09-23","findings":[{"check_id":"secret-cmk","severity":"info","message":"The secret is encrypted with a customer-managed KMS key. STACKIT Secrets Manager can encrypt with a customer-chosen key too, but the AWS key does not move: the instance's kms_key block (stackit_secretsmanager_instance: key_id, key_ring_id, key_version, service_account_email) names a STACKIT KMS key, one key for all secret values of the instance. The draft sets that block only when every source of the shared instance is an AWS secret that references the same drafted key; otherwise it does not set it and names the key NOT CARRIED with the reason. Decide whether to create the key (stackit_kms_keyring, stackit_kms_key) and a service account with at least the Secrets Manager Reader role in the same project and region, put the kms_key block on the instance, and which secrets share an instance when they used different keys (one key per instance, not per secret). Without the block the instance uses STACKIT's default encryption.","evidence":["https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/secretsmanager_instance","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/secrets-manager/v1/secrets-manager.json"],"blocker_category":"COMPLIANCE"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.secretsmanager_secret","expected":34,"observed":3,"accounted":3,"unaccounted":0,"critical_unaccounted":[],"critical_open":["secret-value","customer-managed-key","tc-secretsmanager-secret-name"],"items":[{"id":"secret-value","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:secret"},{"id":"plain-parameter","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"plain-parameter-kind","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"plain-parameter-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rotation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"replication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"customer-managed-key","critical":true,"observed":"unknown","disposition":"REVIEW","by":"check:secret-cmk"},{"id":"default-key-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"recovery-window","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-secretsmanager-secret-force-overwrite-replica-secret","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ssm-parameter-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ssm-parameter-value-wo","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-policy--block-public-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--external-secret-rotation-metadata--key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--external-secret-rotation-metadata--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--rotation-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-version--secret-string-wo","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-version--version-stages","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-secretsmanager-secret-replica--region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-secretsmanager-secret-replica--kms-key-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfr-secretsmanager-secret-rotation--external-secret-rotation-role-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-secretsmanager-secret-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:secret"},{"id":"tc-ssm-parameter-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--external-secret-rotation-metadata--key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--external-secret-rotation-metadata--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--rotation-rules--automatically-after-days","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--rotation-rules--schedule-expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dx-macsec-key-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-distribution-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-secretsmanager-tag","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-job-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["COMPLIANCE","IDENTITY","UNKNOWN"],"target_platform":"STACKIT Secrets Manager","confidence":"MEDIUM"}},"property_accounting":{"set":4,"excluded":1,"meaningful":3,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":3,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","attribute":"kms_key_id"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","attribute":"name"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db","attribute":"secret_string"}],"class_counts":{"CRITICAL":3},"critical":[{"node":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","attribute":"kms_key_id","class":"CRITICAL","category":"encryption","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.catalog_db): kms_key_id — the source encrypts with a customer-managed key that the draft does not set on the Secrets Manager instance: the instance also holds module.retail_app_ecs.aws_secretsmanager_secret.mq, which states no customer-managed key (the default key encrypts it), and it would be encrypted with the key too. The instance takes one STACKIT KMS key for all its secret values (kms_key); set it once the keys of the sources are decided. (contract aws.secretsmanager_secret/customer-managed-key:REVIEW)"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","attribute":"name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.catalog_db): name — the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. (contract aws.secretsmanager_secret/tc-secretsmanager-secret-name:REVIEW)"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db","attribute":"secret_string","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db): secret_id, secret_string — a setting of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db: the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. (contract aws.secretsmanager_secret/secret-value:REVIEW)"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_secretsmanager_secret","attribute":"kms_key_id","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_secretsmanager_secret","attribute":"name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_secretsmanager_secret_version","attribute":"secret_string","closure":"CLOSED:NC+REVIEW"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.retail_app_ecs.aws_secretsmanager_secret.mq","source_type":"aws_secretsmanager_secret","category":"identity","kind":"secret","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs","facets":["module.retail_app_ecs.aws_secretsmanager_secret_version.mq"],"configuration_completeness":"COMPLETE","depends_on":["module.dependencies.aws_mq_broker.mq"],"wave":5,"provenance":{"file":"../../lib/ecs/common.tf","line":11,"end_line":13},"result":{"rule_id":"aws.secretsmanager_secret","case_id":"secret","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Secrets Manager","resources":["stackit_secretsmanager_instance","stackit_secretsmanager_user"],"maturity":"ga","lifecycle":"active"},"reason":"Secrets move to STACKIT Secrets Manager (a Vault-compatible KV store). Applications switch from the AWS SDK to a Vault client or to injection via the platform (e.g. External Secrets Operator on SKE).","evidence":["https://docs.stackit.cloud/products/security/secrets-manager/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/secretsmanager_instance"],"validated_against":"terraform-provider-stackit@0.116.0; docs security/secrets-manager 2026-09-23","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.secretsmanager_secret","expected":34,"observed":2,"accounted":2,"unaccounted":0,"critical_unaccounted":[],"critical_open":["secret-value","tc-secretsmanager-secret-name"],"items":[{"id":"secret-value","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:secret"},{"id":"plain-parameter","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"plain-parameter-kind","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"plain-parameter-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rotation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"replication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"default-key-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"recovery-window","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-secretsmanager-secret-force-overwrite-replica-secret","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ssm-parameter-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ssm-parameter-value-wo","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-policy--block-public-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--external-secret-rotation-metadata--key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--external-secret-rotation-metadata--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--rotation-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-version--secret-string-wo","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-version--version-stages","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-secretsmanager-secret-replica--region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-secretsmanager-secret-replica--kms-key-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfr-secretsmanager-secret-rotation--external-secret-rotation-role-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-secretsmanager-secret-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:secret"},{"id":"tc-ssm-parameter-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--external-secret-rotation-metadata--key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--external-secret-rotation-metadata--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--rotation-rules--automatically-after-days","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--rotation-rules--schedule-expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dx-macsec-key-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-distribution-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-secretsmanager-tag","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-job-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT Secrets Manager","confidence":"MEDIUM"}},"property_accounting":{"set":3,"excluded":1,"meaningful":2,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.aws_secretsmanager_secret.mq","attribute":"name"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret_version.mq","attribute":"secret_string"}],"class_counts":{"CRITICAL":2},"critical":[{"node":"module.retail_app_ecs.aws_secretsmanager_secret.mq","attribute":"name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.mq): name — the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. (contract aws.secretsmanager_secret/tc-secretsmanager-secret-name:REVIEW)"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret_version.mq","attribute":"secret_string","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.mq): secret_id, secret_string — a setting of module.retail_app_ecs.aws_secretsmanager_secret.mq: the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. (contract aws.secretsmanager_secret/secret-value:REVIEW)"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_secretsmanager_secret","attribute":"name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_secretsmanager_secret_version","attribute":"secret_string","closure":"CLOSED:NC+REVIEW"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","source_type":"aws_secretsmanager_secret","category":"identity","kind":"secret","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs","facets":["module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db"],"configuration_completeness":"COMPLETE","depends_on":["module.dependencies.module.orders_rds.aws_rds_cluster.this"],"wave":5,"provenance":{"file":"../../lib/ecs/orders.tf","line":68,"end_line":70},"result":{"rule_id":"aws.secretsmanager_secret","case_id":"secret","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Secrets Manager","resources":["stackit_secretsmanager_instance","stackit_secretsmanager_user"],"maturity":"ga","lifecycle":"active"},"reason":"Secrets move to STACKIT Secrets Manager (a Vault-compatible KV store). Applications switch from the AWS SDK to a Vault client or to injection via the platform (e.g. External Secrets Operator on SKE).","evidence":["https://docs.stackit.cloud/products/security/secrets-manager/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/secretsmanager_instance"],"validated_against":"terraform-provider-stackit@0.116.0; docs security/secrets-manager 2026-09-23","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.secretsmanager_secret","expected":34,"observed":2,"accounted":2,"unaccounted":0,"critical_unaccounted":[],"critical_open":["secret-value","tc-secretsmanager-secret-name"],"items":[{"id":"secret-value","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:secret"},{"id":"plain-parameter","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"plain-parameter-kind","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"plain-parameter-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rotation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"replication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"default-key-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"recovery-window","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-secretsmanager-secret-force-overwrite-replica-secret","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ssm-parameter-value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ssm-parameter-value-wo","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-policy--block-public-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--external-secret-rotation-metadata--key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--external-secret-rotation-metadata--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-rotation--rotation-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-version--secret-string-wo","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secretsmanager-secret-version--version-stages","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-secretsmanager-secret-replica--region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-secretsmanager-secret-replica--kms-key-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfr-secretsmanager-secret-rotation--external-secret-rotation-role-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-secretsmanager-secret-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:secret"},{"id":"tc-ssm-parameter-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--external-secret-rotation-metadata--key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--external-secret-rotation-metadata--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--rotation-rules--automatically-after-days","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-secretsmanager-secret-rotation--rotation-rules--schedule-expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dx-macsec-key-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-distribution-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-secretsmanager-tag","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-job-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT Secrets Manager","confidence":"MEDIUM"}},"property_accounting":{"set":3,"excluded":1,"meaningful":2,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","attribute":"name"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db","attribute":"secret_string"}],"class_counts":{"CRITICAL":2},"critical":[{"node":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","attribute":"name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.orders_db): name — the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. (contract aws.secretsmanager_secret/tc-secretsmanager-secret-name:REVIEW)"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db","attribute":"secret_string","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db): secret_id, secret_string — a setting of module.retail_app_ecs.aws_secretsmanager_secret.orders_db: the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. (contract aws.secretsmanager_secret/secret-value:REVIEW)"}],"automation_eligible":false,"gate_blockers":[{"source_type":"aws_secretsmanager_secret","attribute":"name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_secretsmanager_secret_version","attribute":"secret_string","closure":"CLOSED:NC+REVIEW"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"}]}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","source_type":"aws_iam_role","category":"identity","kind":"iam_role","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.catalog_service","facets":["module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_additional","module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_policy"],"configuration_completeness":"COMPLETE","depends_on":["module.retail_app_ecs.aws_kms_key.cmk","module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch"],"wave":6,"provenance":{"file":"../../lib/ecs/service/iam.tf","line":14,"end_line":18},"result":{"rule_id":"aws.iam_role","case_id":"role-workload-execution","class":"RECONFIGURE","confidence":"LOW","target":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"Execution role of an application (Lambda function or ECS task). The application keeps needing these permissions on STACKIT: it gets a service account (or data-service credentials such as database users and object-storage keys) with equivalent grants.","review":["List what the attached policies allow (tables, buckets, queues) and grant the same on the STACKIT targets."],"evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam); SKE workload identity docs 2026-09-15; IAM checks of 2026-10-06: provider 0.117.0 schema, docs.stackit.cloud access-and-identity 2026-10-06; IAM notes wording (Act-As, S3 bucket policy carrier, Container Registry has no resource): provider 0.119.0 schema and the docs.stackit.cloud pages cited in the checks, checked 2026-10-11; iam-managed-ssm-instance wording: provider 0.119.0 schema (stackit_server agent), docs.stackit.cloud server-agent, run-command and server pages and the AWS AmazonSSMManagedInstanceCore and Systems Manager instance-permission pages, fetched 2026-10-12; role-ec2-no-profile: provider 0.119.0 docs stackit_server_service_account_attach and stackit_service_account, read 2026-11-01; role-ec2-no-profile skips a role an awscc_iam_instance_profile names: awscc 1.103.0 docs/resources/iam_instance_profile.md (roles), read 2026-11-01; role-instance-profile of an awscc_iam_instance_profile that holds the role exactly (2026-11-01): awscc 1.103.0 docs/resources/iam_instance_profile.md (roles: a Set of String, one role per EC2 instance) and the awscc provider source of the instance profile resource, instance_profile_resource_gen.go:114 (knowledge-base evidence, not in this folder: the primary identifier is the name), read 2026-11-01","findings":[{"check_id":"iam-trust-service-workload","severity":"info","message":"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. On STACKIT the workload runs as a service account (stackit_service_account) and nothing assumes it: it authenticates with a service account key (stackit_service_account_key, key flow) or, on SKE, by Workload Identity Federation (a federated identity provider on the account). What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","evidence":["https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","https://docs.stackit.cloud/platform/access-and-identity/service-accounts/authentication-flows/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_key","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_federated_identity_provider"]},{"check_id":"iam-managed-ecs","severity":"info","message":"Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). STACKIT has no ECS: image pull is a registry credential (Container Registry roles, Guest is read-only) and log shipping a platform or credential setting (stackit_logs_access_token); no STACKIT role replaces these grants. Container Registry: STACKIT offers this service. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed. (schema checked 2026-10-11: none of the 115 resource types of the pinned STACKIT provider), so the pull credential is not drafted (project roles: docs.stackit.cloud, updated Jul 2, 2026). What to decide: the registry pull credential and the log destination of the replacing workload.","evidence":["https://docs.stackit.cloud/products/developer-platform/container-registry/how-tos/securing-access-with-role-based-access-control-_rbac_/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/logs_access_token","https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSTaskExecutionRolePolicy.html","https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2ContainerServiceforEC2Role.html","data/stackit/provider-schema-0.119.0.json"]},{"check_id":"iam-inline-kms","severity":"info","message":"A policy of this role grants KMS actions. STACKIT KMS access comes from role assignments on an organisation, folder, project or service account, not on a key ring or key (stackit_kms_key has no policy or grant attribute in the pinned STACKIT provider), so a per-key permission widens to every key of the project. What to decide: which identities may use and which may administer keys, and whether keys that need different access move to their own project.","evidence":["https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/kms_key","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_role_assignment"]},{"check_id":"iam-inline-secrets","severity":"info","message":"A policy of this role reads or writes secrets or parameters. STACKIT Secrets Manager grants access with role bindings on the instance and on secret groups (stackit_secretsmanager_instance_role_binding_v1, stackit_secretsmanager_secret_group_role_binding_v1; documented roles Secrets Manager Reader and Admin) and with users that carry credentials. What to decide: per secret group, which identity reads and which writes. One more limit exists per instance: a source-address list (stackit_secretsmanager_instance acls, IP addresses or CIDR ranges that may reach the instance), the nearest thing to an aws:SourceIp condition; there is no per-identity or per-secret condition.","evidence":["https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/secretsmanager_instance_role_binding_v1","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/secretsmanager_instance"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it against a shared instance or a note) and the draft does not create it), and the semantic contract of aws_iam_role does not read aws_secretsmanager_secret, so what the reference becomes is not assessed."},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it against a shared instance or a note) and the draft does not create it), and the semantic contract of aws_iam_role does not read aws_secretsmanager_secret, so what the reference becomes is not assessed."}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.iam_role","expected":103,"observed":6,"accounted":6,"unaccounted":0,"critical_unaccounted":[],"critical_open":["iam-managed-ecs","iam-trust-service-workload","linked-dependency:aws_secretsmanager_secret","permissions","tcfp-iam-role-policy-attachment--policy-arn","trust"],"items":[{"id":"trust","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"permissions","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"facet-link-role","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:role-workload-execution"},{"id":"permissions-boundary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tag-conditioned-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-policy-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"instance-profile-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"force-detach","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"session-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-iam-role-policy-attachment-policy-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy-attachment--policy-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution","withdrawn_by":["iam-managed-ecs","permissions"]},{"id":"iam-trust-aws-principal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-cognito","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-conditions","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-oidc","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-saml","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-workload","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-trust-service-workload"},{"id":"iam-trust-service-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-principal-partly-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-customer-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-administrator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-poweruser","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-readonly","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ssm-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-cloudwatch-agent","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-registry-read","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-eks-internal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-sqs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ecs","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-managed-ecs"},{"id":"iam-managed-rds-monitoring","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-xray","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-application-insights","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-support","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-backup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-condition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-assume-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-wildcard-admin","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-not-action","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-kms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-secrets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-logs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ebs-snapshot-import","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-microvm","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-spot-fleet-request","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-auth-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-job-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-direct-connect-gateway-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-private-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-public-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-transit-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-dlm-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-enclave-certificate-iam-role-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-flow-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-spot-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-addon","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-fargate-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-pod-identity-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticbeanstalk-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-iam-managed-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-microvm-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-proton-environment-account-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"linked-dependency:aws_secretsmanager_secret","critical":true,"observed":"yes","disposition":"REVIEW","by":"linked-dependency:aws_secretsmanager_secret"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT service account for the workload","confidence":"LOW"}},"property_accounting":{"set":7,"excluded":3,"meaningful":4,"by_status":{"CONSUMED":0,"CONTRACT":2,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","attribute":"assume_role_policy"},{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","attribute":"name"}],"class_counts":{"CRITICAL":3,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","attribute":"assume_role_policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated. (contract aws.iam_role/iam-trust-service-workload:REVIEW)"},{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_additional","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/permissions:REVIEW"},{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_policy","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-ecs:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["linked-dependency:aws_secretsmanager_secret"],"gate_blockers":[{"source_type":"aws_iam_role","attribute":"assume_role_policy","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_iam_role_policy_attachment","attribute":"policy_arn","closure":"CLOSED:REVIEW"},{"target":"type:stackit_authorization_project_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"linked-dependency:aws_secretsmanager_secret","closure":"open-critical-without-read-set"}]}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","source_type":"aws_iam_role","category":"identity","kind":"iam_role","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.orders_service","facets":["module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_additional","module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_policy"],"configuration_completeness":"COMPLETE","depends_on":["module.retail_app_ecs.aws_kms_key.cmk","module.retail_app_ecs.aws_secretsmanager_secret.mq","module.retail_app_ecs.aws_secretsmanager_secret.orders_db"],"wave":6,"provenance":{"file":"../../lib/ecs/service/iam.tf","line":14,"end_line":18},"result":{"rule_id":"aws.iam_role","case_id":"role-workload-execution","class":"RECONFIGURE","confidence":"LOW","target":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"Execution role of an application (Lambda function or ECS task). The application keeps needing these permissions on STACKIT: it gets a service account (or data-service credentials such as database users and object-storage keys) with equivalent grants.","review":["List what the attached policies allow (tables, buckets, queues) and grant the same on the STACKIT targets."],"evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam); SKE workload identity docs 2026-09-15; IAM checks of 2026-10-06: provider 0.117.0 schema, docs.stackit.cloud access-and-identity 2026-10-06; IAM notes wording (Act-As, S3 bucket policy carrier, Container Registry has no resource): provider 0.119.0 schema and the docs.stackit.cloud pages cited in the checks, checked 2026-10-11; iam-managed-ssm-instance wording: provider 0.119.0 schema (stackit_server agent), docs.stackit.cloud server-agent, run-command and server pages and the AWS AmazonSSMManagedInstanceCore and Systems Manager instance-permission pages, fetched 2026-10-12; role-ec2-no-profile: provider 0.119.0 docs stackit_server_service_account_attach and stackit_service_account, read 2026-11-01; role-ec2-no-profile skips a role an awscc_iam_instance_profile names: awscc 1.103.0 docs/resources/iam_instance_profile.md (roles), read 2026-11-01; role-instance-profile of an awscc_iam_instance_profile that holds the role exactly (2026-11-01): awscc 1.103.0 docs/resources/iam_instance_profile.md (roles: a Set of String, one role per EC2 instance) and the awscc provider source of the instance profile resource, instance_profile_resource_gen.go:114 (knowledge-base evidence, not in this folder: the primary identifier is the name), read 2026-11-01","findings":[{"check_id":"iam-trust-service-workload","severity":"info","message":"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. On STACKIT the workload runs as a service account (stackit_service_account) and nothing assumes it: it authenticates with a service account key (stackit_service_account_key, key flow) or, on SKE, by Workload Identity Federation (a federated identity provider on the account). What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","evidence":["https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","https://docs.stackit.cloud/platform/access-and-identity/service-accounts/authentication-flows/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_key","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_federated_identity_provider"]},{"check_id":"iam-managed-ecs","severity":"info","message":"Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). STACKIT has no ECS: image pull is a registry credential (Container Registry roles, Guest is read-only) and log shipping a platform or credential setting (stackit_logs_access_token); no STACKIT role replaces these grants. Container Registry: STACKIT offers this service. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed. (schema checked 2026-10-11: none of the 115 resource types of the pinned STACKIT provider), so the pull credential is not drafted (project roles: docs.stackit.cloud, updated Jul 2, 2026). What to decide: the registry pull credential and the log destination of the replacing workload.","evidence":["https://docs.stackit.cloud/products/developer-platform/container-registry/how-tos/securing-access-with-role-based-access-control-_rbac_/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/logs_access_token","https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSTaskExecutionRolePolicy.html","https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2ContainerServiceforEC2Role.html","data/stackit/provider-schema-0.119.0.json"]},{"check_id":"iam-inline-kms","severity":"info","message":"A policy of this role grants KMS actions. STACKIT KMS access comes from role assignments on an organisation, folder, project or service account, not on a key ring or key (stackit_kms_key has no policy or grant attribute in the pinned STACKIT provider), so a per-key permission widens to every key of the project. What to decide: which identities may use and which may administer keys, and whether keys that need different access move to their own project.","evidence":["https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/kms_key","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_role_assignment"]},{"check_id":"iam-inline-secrets","severity":"info","message":"A policy of this role reads or writes secrets or parameters. STACKIT Secrets Manager grants access with role bindings on the instance and on secret groups (stackit_secretsmanager_instance_role_binding_v1, stackit_secretsmanager_secret_group_role_binding_v1; documented roles Secrets Manager Reader and Admin) and with users that carry credentials. What to decide: per secret group, which identity reads and which writes. One more limit exists per instance: a source-address list (stackit_secretsmanager_instance acls, IP addresses or CIDR ranges that may reach the instance), the nearest thing to an aws:SourceIp condition; there is no per-identity or per-secret condition.","evidence":["https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/secretsmanager_instance_role_binding_v1","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/secretsmanager_instance"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it against a shared instance or a note) and the draft does not create it), and the semantic contract of aws_iam_role does not read aws_secretsmanager_secret, so what the reference becomes is not assessed."},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it against a shared instance or a note) and the draft does not create it), and the semantic contract of aws_iam_role does not read aws_secretsmanager_secret, so what the reference becomes is not assessed."}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.iam_role","expected":103,"observed":6,"accounted":6,"unaccounted":0,"critical_unaccounted":[],"critical_open":["iam-managed-ecs","iam-trust-service-workload","linked-dependency:aws_secretsmanager_secret","permissions","tcfp-iam-role-policy-attachment--policy-arn","trust"],"items":[{"id":"trust","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"permissions","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution"},{"id":"facet-link-role","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:role-workload-execution"},{"id":"permissions-boundary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tag-conditioned-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-policy-reference","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"instance-profile-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"force-detach","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"session-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"path-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-iam-role-policy-attachment-policy-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-iam-role-policy-attachment--policy-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:role-workload-execution","withdrawn_by":["iam-managed-ecs","permissions"]},{"id":"iam-trust-aws-principal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-cognito","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-conditions","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-oidc","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-federated-saml","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-workload","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-trust-service-workload"},{"id":"iam-trust-service-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-service-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-principal-partly-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-trust-not-visible","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-customer-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-administrator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-poweruser","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-readonly","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ssm-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-cloudwatch-agent","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-registry-read","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-eks-internal","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-lambda-sqs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-ecs","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:iam-managed-ecs"},{"id":"iam-managed-rds-monitoring","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-xray","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-application-insights","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-support","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-managed-backup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-effect-unknown","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-deny","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-condition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-assume-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-wildcard-admin","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-not-action","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-s3","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-kms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-secrets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-logs","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-ec2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-inline-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ebs-snapshot-import","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdamicrovms-microvm","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-spot-fleet-request","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-auth-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-job-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-direct-connect-gateway-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-private-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-public-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-directconnect-transit-virtual-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-dlm-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-enclave-certificate-iam-role-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-flow-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-spot-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-through-cache-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-pull-time-update-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecr-repository-creation-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-addon","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-capability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-fargate-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-pod-identity-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticbeanstalk-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-iam-managed-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-image-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-lifecycle-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-microvm-image","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-proton-environment-account-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-rolesanywhere-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"linked-dependency:aws_secretsmanager_secret","critical":true,"observed":"yes","disposition":"REVIEW","by":"linked-dependency:aws_secretsmanager_secret"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT service account for the workload","confidence":"LOW"}},"property_accounting":{"set":7,"excluded":3,"meaningful":4,"by_status":{"CONSUMED":0,"CONTRACT":2,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","attribute":"assume_role_policy"},{"node":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","attribute":"name"}],"class_counts":{"CRITICAL":3,"NON_CRITICAL":1},"critical":[{"node":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","attribute":"assume_role_policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated. (contract aws.iam_role/iam-trust-service-workload:REVIEW)"},{"node":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_additional","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/permissions:REVIEW"},{"node":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_policy","attribute":"policy_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.iam_role/iam-managed-ecs:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["linked-dependency:aws_secretsmanager_secret"],"gate_blockers":[{"source_type":"aws_iam_role","attribute":"assume_role_policy","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_iam_role_policy_attachment","attribute":"policy_arn","closure":"CLOSED:REVIEW"},{"target":"type:stackit_authorization_project_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"linked-dependency:aws_secretsmanager_secret","closure":"open-critical-without-read-set"}]}},{"id":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","source_type":"aws_ecs_service","category":"compute","kind":"container_service","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.catalog_service","open_dependencies":["module.vpc.module.vpc.aws_subnet.private"],"facets":["module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this"],"configuration_completeness":"COMPLETE","depends_on":["module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","module.retail_app_ecs.aws_ecs_cluster.cluster","module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","module.retail_app_ecs.module.catalog_service.aws_security_group.this","module.vpc.module.vpc.aws_subnet.private","module.vpc.module.vpc.aws_vpc.this"],"wave":7,"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":136,"end_line":175},"result":{"rule_id":"aws.ecs","case_id":"ecs-to-ske","class":"REPLATFORM","confidence":"LOW","target":{"service":"STACKIT Kubernetes Engine (SKE)","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): ske lists 161 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): ske lists 77 offerings"}]},"reason":"Containers already exist; ECS task definitions and services are rewritten as Kubernetes Deployments/Services on SKE (or pushed to Cloud Foundry for simple web apps).","review":["Translate task definitions (CPU/memory, env, secrets, health checks) into Kubernetes manifests."],"evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/ske_cluster"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"ecs-service-discovery","severity":"warning","message":"Services find each other through Cloud Map / Service Connect; on SKE this becomes Kubernetes Services and DNS.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/ske_cluster"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db (aws_secretsmanager_secret_version), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it against a shared instance or a note) and the draft does not create it), and the semantic contract of aws_ecs_service does not read aws_secretsmanager_secret_version, so what the reference becomes is not assessed."},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch (aws_secretsmanager_secret_version), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it against a shared instance or a note) and the draft does not create it), and the semantic contract of aws_ecs_service does not read aws_secretsmanager_secret_version, so what the reference becomes is not assessed."}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.ecs","expected":122,"observed":15,"accounted":15,"unaccounted":0,"critical_unaccounted":[],"critical_open":["linked-dependency:aws_secretsmanager_secret_version","service-connect-values","service-desired-count","service-discovery","service-execute-command","service-network-placement","service-public-ip-setting","service-task-definition","task-definition","td-container-definitions","td-container-image-registry","td-container-plaintext-secret-env","td-container-secret-references","td-execution-role-arn","td-network-mode","td-task-role-arn"],"items":[{"id":"nbr-aws-networkfirewall-container-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-events-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkfirewall-container-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-scheduler-schedule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-stepfunctions-state-machine","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-platform-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-timeouts","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-capacity-provider-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-access-log-format","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"capacity-providers","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-capacity-providers-legacy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"scheduled-scaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-target-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-policy-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-discovery","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:ecs-service-discovery"},{"id":"public-ip","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"task-definition","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-task-definition","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-desired-count","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-scheduling-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-limits","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-controller","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-circuit-breaker","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-alarms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-execute-command","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-health-check-grace","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-az-rebalancing","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-iam-role-and-delete","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-load-balancer-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-network-placement","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-public-ip-setting","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-registry-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-values","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-volume-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-size","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-file-system-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-iops","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-throughput","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-initialization-rate","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tag-propagate","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tag-resource-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-vpc-lattice","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-execute-command","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-managed-storage","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-service-connect-defaults","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-container-definitions","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-secret-references","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-plaintext-secret-env","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-image-registry","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-execution-role-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-network-mode","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-skip-destroy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-task-role-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-volume-host-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-configure-at-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-configure-at-launch-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-file-system-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-access-point-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-iam-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-transit-encryption","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-transit-encryption-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-placement-constraints-expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-placement-constraints-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-ipc-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-pid-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-proxy-configuration-properties","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-proxy-configuration-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-driver","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-scratch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-driver-opts","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-scope","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-defaults","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-authorization-config-credentials-parameter","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-authorization-config-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-file-system-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-access-point-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-file-system-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-enable-fault-injection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ecs-cluster-configuration--execute-command-configuration--log-configuration--s3-key-prefix","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ecs-service-service-connect-configuration--log-configuration--secret-option--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ak181-facets-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-traffic-shift-and-bake","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-pause-hook-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-external-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-force-delete","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-launch-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-platform-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-wait-until-stable","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-wait-until-stable-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--base","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--weight","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--container-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--container-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--load-balancer-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--target-group-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--assign-public-ip","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--security-groups","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--subnets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-scale--unit","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-scale--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--container-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--container-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--registry-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scaling-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"linked-dependency:aws_secretsmanager_secret_version","critical":true,"observed":"yes","disposition":"REVIEW","by":"linked-dependency:aws_secretsmanager_secret_version"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REPLATFORM","change_types":["CONFIG"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT Kubernetes Engine (SKE)","confidence":"LOW"}},"property_accounting":{"set":25,"excluded":1,"meaningful":24,"by_status":{"CONSUMED":2,"CONTRACT":8,"NOT_CARRIED":14,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"enable_execute_command"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"launch_type"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"network_configuration.assign_public_ip"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"network_configuration.security_groups"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"network_configuration.subnets"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"service_connect_configuration.enabled"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"service_connect_configuration.namespace"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.dns_name"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.port"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.discovery_name"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.port_name"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"wait_for_steady_state"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","attribute":"network_mode"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","attribute":"requires_compatibilities"}],"class_counts":{"CRITICAL":16,"NON_CRITICAL":8},"critical":[{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"desired_count","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.ecs/service-desired-count:REVIEW"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"enable_execute_command","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): enable_execute_command = true, tags, wait_for_steady_state = true — a service setting with no counterpart in the draft manifests: Kubernetes has its own rollout (maxSurge, maxUnavailable), health, scheduling and exec behaviour, and tags are not labels here. (contract aws.ecs/service-execute-command:REVIEW)"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"network_configuration.assign_public_ip","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-public-ip-setting:REVIEW)"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"network_configuration.security_groups","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-network-placement:REVIEW)"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"network_configuration.subnets","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-network-placement:REVIEW)"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"service_connect_configuration.enabled","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: catalog:80 → container port 8080 (the Service Connect alias catalog:80 of port catalog-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"service_connect_configuration.namespace","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: catalog:80 → container port 8080 (the Service Connect alias catalog:80 of port catalog-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.dns_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: catalog:80 → container port 8080 (the Service Connect alias catalog:80 of port catalog-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: catalog:80 → container port 8080 (the Service Connect alias catalog:80 of port catalog-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.discovery_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: catalog:80 → container port 8080 (the Service Connect alias catalog:80 of port catalog-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.port_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: catalog:80 → container port 8080 (the Service Connect alias catalog:80 of port catalog-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","attribute":"task_definition","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/service-task-definition:REVIEW"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","attribute":"container_definitions","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:REVIEW","by":"aws.ecs/td-container-definitions:REVIEW"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","attribute":"execution_role_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/td-execution-role-arn:REVIEW"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","attribute":"network_mode","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this): network_mode = awsvpc, requires_compatibilities — Fargate platform specifics and awsvpc network interface semantics have no Kubernetes counterpart: the pods run on the SKE node pool network and the platform's task sizing steps do not exist. (contract aws.ecs/td-network-mode:REVIEW)"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","attribute":"task_role_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/td-task-role-arn:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["linked-dependency:aws_secretsmanager_secret_version","service-discovery"],"gate_blockers":[{"source_type":"aws_ecs_service","attribute":"enable_execute_command","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.assign_public_ip","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.security_groups","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.subnets","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.enabled","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.namespace","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.client_alias.dns_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.client_alias.port","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.discovery_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.port_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"network_mode","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"desired_count","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_service","attribute":"task_definition","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"container_definitions","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"execution_role_arn","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"task_role_arn","closure":"CLOSED:REVIEW"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"linked-dependency:aws_secretsmanager_secret_version","closure":"open-critical-without-read-set"},{"semantic":"service-discovery","closure":"open-critical-without-read-set"}]}},{"id":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","source_type":"aws_ecs_service","category":"compute","kind":"container_service","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.orders_service","open_dependencies":["module.vpc.module.vpc.aws_subnet.private"],"facets":["module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this"],"configuration_completeness":"COMPLETE","depends_on":["module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","module.retail_app_ecs.aws_ecs_cluster.cluster","module.retail_app_ecs.aws_secretsmanager_secret.mq","module.retail_app_ecs.aws_secretsmanager_secret.orders_db","module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","module.retail_app_ecs.module.orders_service.aws_security_group.this","module.vpc.module.vpc.aws_subnet.private","module.vpc.module.vpc.aws_vpc.this"],"wave":7,"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":136,"end_line":175},"result":{"rule_id":"aws.ecs","case_id":"ecs-to-ske","class":"REPLATFORM","confidence":"LOW","target":{"service":"STACKIT Kubernetes Engine (SKE)","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): ske lists 161 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): ske lists 77 offerings"}]},"reason":"Containers already exist; ECS task definitions and services are rewritten as Kubernetes Deployments/Services on SKE (or pushed to Cloud Foundry for simple web apps).","review":["Translate task definitions (CPU/memory, env, secrets, health checks) into Kubernetes manifests."],"evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/ske_cluster"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"ecs-service-discovery","severity":"warning","message":"Services find each other through Cloud Map / Service Connect; on SKE this becomes Kubernetes Services and DNS.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/ske_cluster"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names module.retail_app_ecs.aws_secretsmanager_secret_version.mq (aws_secretsmanager_secret_version), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it against a shared instance or a note) and the draft does not create it), and the semantic contract of aws_ecs_service does not read aws_secretsmanager_secret_version, so what the reference becomes is not assessed."},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db (aws_secretsmanager_secret_version), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it against a shared instance or a note) and the draft does not create it), and the semantic contract of aws_ecs_service does not read aws_secretsmanager_secret_version, so what the reference becomes is not assessed."}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.ecs","expected":122,"observed":15,"accounted":15,"unaccounted":0,"critical_unaccounted":[],"critical_open":["linked-dependency:aws_secretsmanager_secret_version","service-connect-values","service-desired-count","service-discovery","service-execute-command","service-network-placement","service-public-ip-setting","service-task-definition","task-definition","td-container-definitions","td-container-image-registry","td-container-plaintext-secret-env","td-container-secret-references","td-execution-role-arn","td-network-mode","td-task-role-arn"],"items":[{"id":"nbr-aws-networkfirewall-container-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-events-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkfirewall-container-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-scheduler-schedule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-stepfunctions-state-machine","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-platform-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-timeouts","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-capacity-provider-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-access-log-format","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"capacity-providers","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-capacity-providers-legacy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"scheduled-scaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-target-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-policy-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-discovery","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:ecs-service-discovery"},{"id":"public-ip","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"task-definition","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-task-definition","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-desired-count","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-scheduling-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-limits","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-controller","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-circuit-breaker","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-alarms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-execute-command","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-health-check-grace","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-az-rebalancing","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-iam-role-and-delete","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-load-balancer-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-network-placement","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-public-ip-setting","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-registry-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-values","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-volume-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-size","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-file-system-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-iops","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-throughput","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-initialization-rate","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tag-propagate","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tag-resource-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-vpc-lattice","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-execute-command","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-managed-storage","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-service-connect-defaults","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-container-definitions","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-secret-references","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-plaintext-secret-env","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-image-registry","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-execution-role-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-network-mode","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-skip-destroy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-task-role-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-volume-host-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-configure-at-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-configure-at-launch-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-file-system-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-access-point-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-iam-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-transit-encryption","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-transit-encryption-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-placement-constraints-expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-placement-constraints-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-ipc-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-pid-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-proxy-configuration-properties","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-proxy-configuration-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-driver","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-scratch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-driver-opts","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-scope","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-defaults","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-authorization-config-credentials-parameter","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-authorization-config-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-file-system-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-access-point-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-file-system-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-enable-fault-injection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ecs-cluster-configuration--execute-command-configuration--log-configuration--s3-key-prefix","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ecs-service-service-connect-configuration--log-configuration--secret-option--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ak181-facets-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-traffic-shift-and-bake","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-pause-hook-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-external-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-force-delete","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-launch-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-platform-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-wait-until-stable","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-wait-until-stable-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--base","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--weight","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--container-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--container-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--load-balancer-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--target-group-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--assign-public-ip","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--security-groups","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--subnets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-scale--unit","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-scale--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--container-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--container-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--registry-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scaling-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"linked-dependency:aws_secretsmanager_secret_version","critical":true,"observed":"yes","disposition":"REVIEW","by":"linked-dependency:aws_secretsmanager_secret_version"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REPLATFORM","change_types":["CONFIG"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT Kubernetes Engine (SKE)","confidence":"LOW"}},"property_accounting":{"set":25,"excluded":1,"meaningful":24,"by_status":{"CONSUMED":2,"CONTRACT":8,"NOT_CARRIED":14,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"enable_execute_command"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"launch_type"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"network_configuration.assign_public_ip"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"network_configuration.security_groups"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"network_configuration.subnets"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"service_connect_configuration.enabled"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"service_connect_configuration.namespace"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.dns_name"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.port"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.discovery_name"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.port_name"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"wait_for_steady_state"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","attribute":"network_mode"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","attribute":"requires_compatibilities"}],"class_counts":{"CRITICAL":16,"NON_CRITICAL":8},"critical":[{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"desired_count","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.ecs/service-desired-count:REVIEW"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"enable_execute_command","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): enable_execute_command = true, tags, wait_for_steady_state = true — a service setting with no counterpart in the draft manifests: Kubernetes has its own rollout (maxSurge, maxUnavailable), health, scheduling and exec behaviour, and tags are not labels here. (contract aws.ecs/service-execute-command:REVIEW)"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"network_configuration.assign_public_ip","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-public-ip-setting:REVIEW)"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"network_configuration.security_groups","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-network-placement:REVIEW)"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"network_configuration.subnets","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-network-placement:REVIEW)"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"service_connect_configuration.enabled","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: orders:80 → container port 8080 (the Service Connect alias orders:80 of port orders-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"service_connect_configuration.namespace","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: orders:80 → container port 8080 (the Service Connect alias orders:80 of port orders-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.dns_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: orders:80 → container port 8080 (the Service Connect alias orders:80 of port orders-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: orders:80 → container port 8080 (the Service Connect alias orders:80 of port orders-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.discovery_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: orders:80 → container port 8080 (the Service Connect alias orders:80 of port orders-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.port_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: orders:80 → container port 8080 (the Service Connect alias orders:80 of port orders-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","attribute":"task_definition","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/service-task-definition:REVIEW"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","attribute":"container_definitions","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:REVIEW","by":"aws.ecs/td-container-definitions:REVIEW"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","attribute":"execution_role_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/td-execution-role-arn:REVIEW"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","attribute":"network_mode","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this): network_mode = awsvpc, requires_compatibilities — Fargate platform specifics and awsvpc network interface semantics have no Kubernetes counterpart: the pods run on the SKE node pool network and the platform's task sizing steps do not exist. (contract aws.ecs/td-network-mode:REVIEW)"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","attribute":"task_role_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/td-task-role-arn:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["linked-dependency:aws_secretsmanager_secret_version","service-discovery"],"gate_blockers":[{"source_type":"aws_ecs_service","attribute":"enable_execute_command","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.assign_public_ip","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.security_groups","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.subnets","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.enabled","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.namespace","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.client_alias.dns_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.client_alias.port","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.discovery_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.port_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"network_mode","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"desired_count","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_service","attribute":"task_definition","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"container_definitions","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"execution_role_arn","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"task_role_arn","closure":"CLOSED:REVIEW"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"linked-dependency:aws_secretsmanager_secret_version","closure":"open-critical-without-read-set"},{"semantic":"service-discovery","closure":"open-critical-without-read-set"}]}},{"id":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","source_type":"aws_ecs_service","category":"compute","kind":"container_service","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.checkout_service","open_dependencies":["module.vpc.module.vpc.aws_subnet.private"],"facets":["module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this"],"configuration_completeness":"COMPLETE","depends_on":["module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","module.retail_app_ecs.aws_ecs_cluster.cluster","module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","module.retail_app_ecs.module.checkout_service.aws_security_group.this","module.retail_app_ecs.module.orders_service.aws_ecs_service.this","module.vpc.module.vpc.aws_subnet.private","module.vpc.module.vpc.aws_vpc.this"],"wave":8,"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":136,"end_line":175},"result":{"rule_id":"aws.ecs","case_id":"ecs-to-ske","class":"REPLATFORM","confidence":"MEDIUM","target":{"service":"STACKIT Kubernetes Engine (SKE)","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): ske lists 161 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): ske lists 77 offerings"}]},"reason":"Containers already exist; ECS task definitions and services are rewritten as Kubernetes Deployments/Services on SKE (or pushed to Cloud Foundry for simple web apps).","review":["Translate task definitions (CPU/memory, env, secrets, health checks) into Kubernetes manifests."],"evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/ske_cluster"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"ecs-service-discovery","severity":"warning","message":"Services find each other through Cloud Map / Service Connect; on SKE this becomes Kubernetes Services and DNS.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/ske_cluster"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.ecs","expected":122,"observed":15,"accounted":15,"unaccounted":0,"critical_unaccounted":[],"critical_open":["service-discovery","task-definition","service-task-definition","service-desired-count","service-execute-command","service-network-placement","service-public-ip-setting","service-connect-values","td-container-definitions","td-container-secret-references","td-container-plaintext-secret-env","td-container-image-registry","td-execution-role-arn","td-network-mode","td-task-role-arn"],"items":[{"id":"nbr-aws-networkfirewall-container-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-events-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkfirewall-container-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-scheduler-schedule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-stepfunctions-state-machine","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-platform-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-timeouts","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-capacity-provider-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-access-log-format","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"capacity-providers","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-capacity-providers-legacy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"scheduled-scaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-target-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-policy-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-discovery","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:ecs-service-discovery"},{"id":"public-ip","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"task-definition","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-task-definition","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-desired-count","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-scheduling-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-limits","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-controller","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-circuit-breaker","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-alarms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-execute-command","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-health-check-grace","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-az-rebalancing","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-iam-role-and-delete","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-load-balancer-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-network-placement","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-public-ip-setting","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-registry-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-values","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-volume-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-size","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-file-system-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-iops","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-throughput","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-initialization-rate","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tag-propagate","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tag-resource-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-vpc-lattice","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-execute-command","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-managed-storage","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-service-connect-defaults","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-container-definitions","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-secret-references","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-plaintext-secret-env","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-image-registry","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-execution-role-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-network-mode","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-skip-destroy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-task-role-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-volume-host-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-configure-at-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-configure-at-launch-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-file-system-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-access-point-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-iam-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-transit-encryption","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-transit-encryption-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-placement-constraints-expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-placement-constraints-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-ipc-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-pid-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-proxy-configuration-properties","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-proxy-configuration-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-driver","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-scratch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-driver-opts","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-scope","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-defaults","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-authorization-config-credentials-parameter","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-authorization-config-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-file-system-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-access-point-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-file-system-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-enable-fault-injection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ecs-cluster-configuration--execute-command-configuration--log-configuration--s3-key-prefix","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ecs-service-service-connect-configuration--log-configuration--secret-option--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ak181-facets-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-traffic-shift-and-bake","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-pause-hook-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-external-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-force-delete","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-launch-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-platform-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-wait-until-stable","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-wait-until-stable-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--base","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--weight","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--container-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--container-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--load-balancer-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--target-group-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--assign-public-ip","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--security-groups","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--subnets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-scale--unit","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-scale--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--container-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--container-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--registry-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scaling-policy","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REPLATFORM","change_types":["CONFIG"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT Kubernetes Engine (SKE)","confidence":"MEDIUM"}},"property_accounting":{"set":25,"excluded":1,"meaningful":24,"by_status":{"CONSUMED":2,"CONTRACT":8,"NOT_CARRIED":14,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"enable_execute_command"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"launch_type"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"network_configuration.assign_public_ip"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"network_configuration.security_groups"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"network_configuration.subnets"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"service_connect_configuration.enabled"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"service_connect_configuration.namespace"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.dns_name"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.port"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.discovery_name"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.port_name"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"wait_for_steady_state"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","attribute":"network_mode"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","attribute":"requires_compatibilities"}],"class_counts":{"CRITICAL":16,"NON_CRITICAL":8},"critical":[{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"desired_count","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.ecs/service-desired-count:REVIEW"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"enable_execute_command","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): enable_execute_command = true, tags, wait_for_steady_state = true — a service setting with no counterpart in the draft manifests: Kubernetes has its own rollout (maxSurge, maxUnavailable), health, scheduling and exec behaviour, and tags are not labels here. (contract aws.ecs/service-execute-command:REVIEW)"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"network_configuration.assign_public_ip","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-public-ip-setting:REVIEW)"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"network_configuration.security_groups","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-network-placement:REVIEW)"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"network_configuration.subnets","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-network-placement:REVIEW)"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"service_connect_configuration.enabled","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: checkout:80 → container port 8080 (the Service Connect alias checkout:80 of port checkout-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"service_connect_configuration.namespace","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: checkout:80 → container port 8080 (the Service Connect alias checkout:80 of port checkout-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.dns_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: checkout:80 → container port 8080 (the Service Connect alias checkout:80 of port checkout-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: checkout:80 → container port 8080 (the Service Connect alias checkout:80 of port checkout-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.discovery_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: checkout:80 → container port 8080 (the Service Connect alias checkout:80 of port checkout-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.port_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: checkout:80 → container port 8080 (the Service Connect alias checkout:80 of port checkout-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","attribute":"task_definition","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/service-task-definition:REVIEW"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","attribute":"container_definitions","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:REVIEW","by":"aws.ecs/td-container-definitions:REVIEW"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","attribute":"execution_role_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/td-execution-role-arn:REVIEW"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","attribute":"network_mode","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this): network_mode = awsvpc, requires_compatibilities — Fargate platform specifics and awsvpc network interface semantics have no Kubernetes counterpart: the pods run on the SKE node pool network and the platform's task sizing steps do not exist. (contract aws.ecs/td-network-mode:REVIEW)"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","attribute":"task_role_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/td-task-role-arn:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["service-discovery"],"gate_blockers":[{"source_type":"aws_ecs_service","attribute":"enable_execute_command","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.assign_public_ip","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.security_groups","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.subnets","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.enabled","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.namespace","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.client_alias.dns_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.client_alias.port","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.discovery_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.port_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"network_mode","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"desired_count","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_service","attribute":"task_definition","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"container_definitions","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"execution_role_arn","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"task_role_arn","closure":"CLOSED:REVIEW"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"service-discovery","closure":"open-critical-without-read-set"}]}},{"id":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","source_type":"aws_ecs_service","category":"compute","kind":"container_service","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.ui_service","open_dependencies":["module.vpc.module.vpc.aws_subnet.private"],"facets":["module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this"],"configuration_completeness":"COMPLETE","depends_on":["module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","module.retail_app_ecs.aws_ecs_cluster.cluster","module.retail_app_ecs.module.carts_service.aws_ecs_service.this","module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","module.retail_app_ecs.module.orders_service.aws_ecs_service.this","module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","module.retail_app_ecs.module.ui_service.aws_security_group.this","module.vpc.module.vpc.aws_subnet.private","module.vpc.module.vpc.aws_vpc.this"],"wave":9,"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":136,"end_line":175},"result":{"rule_id":"aws.ecs","case_id":"ecs-to-ske","class":"REPLATFORM","confidence":"MEDIUM","target":{"service":"STACKIT Kubernetes Engine (SKE)","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): ske lists 161 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): ske lists 77 offerings"}]},"reason":"Containers already exist; ECS task definitions and services are rewritten as Kubernetes Deployments/Services on SKE (or pushed to Cloud Foundry for simple web apps).","review":["Translate task definitions (CPU/memory, env, secrets, health checks) into Kubernetes manifests."],"evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/ske_cluster"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"ecs-service-discovery","severity":"warning","message":"Services find each other through Cloud Map / Service Connect; on SKE this becomes Kubernetes Services and DNS.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/ske_cluster"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"semantics":{"contract":"aws.ecs","expected":122,"observed":16,"accounted":16,"unaccounted":0,"critical_unaccounted":[],"critical_open":["service-discovery","task-definition","service-task-definition","service-desired-count","service-execute-command","service-load-balancer-target","service-network-placement","service-public-ip-setting","service-connect-values","td-container-definitions","td-container-secret-references","td-container-plaintext-secret-env","td-container-image-registry","td-execution-role-arn","td-network-mode","td-task-role-arn"],"items":[{"id":"nbr-aws-networkfirewall-container-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-events-rule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkfirewall-container-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-scheduler-schedule","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-stepfunctions-state-machine","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-platform-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-timeouts","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-capacity-provider-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-access-log-format","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"capacity-providers","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-capacity-providers-legacy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"scheduled-scaling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-target-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"autoscaling-policy-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-discovery","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:ecs-service-discovery"},{"id":"public-ip","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"task-definition","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-task-definition","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-desired-count","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-scheduling-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-limits","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-controller","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-strategy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-circuit-breaker","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-deployment-alarms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-execute-command","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-health-check-grace","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-az-rebalancing","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-iam-role-and-delete","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-load-balancer-target","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-network-placement","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-public-ip-setting","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-registry-values","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-connect-values","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"service-volume-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-size","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-file-system-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-iops","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-throughput","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-initialization-rate","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tag-propagate","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tag-resource-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-volume-tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-vpc-lattice","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-execute-command","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-managed-storage","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cluster-service-connect-defaults","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-container-definitions","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-secret-references","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-plaintext-secret-env","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-container-image-registry","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-execution-role-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-network-mode","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-skip-destroy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-task-role-arn","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:ecs-to-ske"},{"id":"td-volume-host-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-configure-at-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-configure-at-launch-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-file-system-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-access-point-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-iam","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-authorization-config-iam-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-transit-encryption","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-efs-volume-configuration-transit-encryption-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-placement-constraints-expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-placement-constraints-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-ipc-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-pid-mode","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-proxy-configuration-properties","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-proxy-configuration-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-driver","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-scratch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-driver-opts","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-scope","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-docker-volume-configuration-defaults","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-authorization-config-credentials-parameter","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-authorization-config-domain","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-file-system-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-fsx-windows-file-server-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-access-point-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-file-system-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-volume-s3files-volume-configuration-root-directory","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"td-enable-fault-injection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ecs-cluster-configuration--execute-command-configuration--log-configuration--s3-key-prefix","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-ecs-service-service-connect-configuration--log-configuration--secret-option--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ak181-facets-runtime","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-traffic-shift-and-bake","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-rollout-pause-hook-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-external-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-force-delete","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-launch-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-platform-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-task-definition","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-wait-until-stable","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-wait-until-stable-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--base","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-capacity-provider-strategy--weight","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--container-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--container-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--load-balancer-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-load-balancer--target-group-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--assign-public-ip","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--security-groups","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-network-configuration--subnets","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-scale--unit","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-scale--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--container-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--container-port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--port","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-ecs_task_set-service-registries--registry-arn","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scalable-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-applicationautoscaling-scaling-policy","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REPLATFORM","change_types":["CONFIG"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT Kubernetes Engine (SKE)","confidence":"MEDIUM"}},"property_accounting":{"set":28,"excluded":1,"meaningful":27,"by_status":{"CONSUMED":2,"CONTRACT":11,"NOT_CARRIED":14,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"enable_execute_command"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"launch_type"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"network_configuration.assign_public_ip"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"network_configuration.security_groups"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"network_configuration.subnets"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"service_connect_configuration.enabled"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"service_connect_configuration.namespace"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.dns_name"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.port"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.discovery_name"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.port_name"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"wait_for_steady_state"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","attribute":"network_mode"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","attribute":"requires_compatibilities"}],"class_counts":{"CRITICAL":19,"NON_CRITICAL":8},"critical":[{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"desired_count","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"aws.ecs/service-desired-count:REVIEW"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"enable_execute_command","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): enable_execute_command = true, tags, wait_for_steady_state = true — a service setting with no counterpart in the draft manifests: Kubernetes has its own rollout (maxSurge, maxUnavailable), health, scheduling and exec behaviour, and tags are not labels here. (contract aws.ecs/service-execute-command:REVIEW)"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"load_balancer.container_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.ecs/service-load-balancer-target:REVIEW"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"load_balancer.container_port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.ecs/service-load-balancer-target:REVIEW"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"load_balancer.target_group_arn","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.ecs/service-load-balancer-target:REVIEW"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"network_configuration.assign_public_ip","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-public-ip-setting:REVIEW)"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"network_configuration.security_groups","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-network-placement:REVIEW)"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"network_configuration.subnets","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods. (contract aws.ecs/service-network-placement:REVIEW)"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"service_connect_configuration.enabled","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: ui:80 → container port 8080 (the Service Connect alias ui:80 of port ui-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"service_connect_configuration.namespace","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: ui:80 → container port 8080 (the Service Connect alias ui:80 of port ui-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.dns_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: ui:80 → container port 8080 (the Service Connect alias ui:80 of port ui-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.client_alias.port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: ui:80 → container port 8080 (the Service Connect alias ui:80 of port ui-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.discovery_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: ui:80 → container port 8080 (the Service Connect alias ui:80 of port ui-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"service_connect_configuration.service.port_name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: ui:80 → container port 8080 (the Service Connect alias ui:80 of port ui-service). (contract aws.ecs/service-connect-values:REVIEW)"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","attribute":"task_definition","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/service-task-definition:REVIEW"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","attribute":"container_definitions","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:REVIEW","by":"aws.ecs/td-container-definitions:REVIEW"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","attribute":"execution_role_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/td-execution-role-arn:REVIEW"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","attribute":"network_mode","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this): network_mode = awsvpc, requires_compatibilities — Fargate platform specifics and awsvpc network interface semantics have no Kubernetes counterpart: the pods run on the SKE node pool network and the platform's task sizing steps do not exist. (contract aws.ecs/td-network-mode:REVIEW)"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","attribute":"task_role_arn","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"aws.ecs/td-task-role-arn:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["service-discovery"],"gate_blockers":[{"source_type":"aws_ecs_service","attribute":"enable_execute_command","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.assign_public_ip","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.security_groups","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"network_configuration.subnets","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.enabled","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.namespace","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.client_alias.dns_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.client_alias.port","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.discovery_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"service_connect_configuration.service.port_name","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"network_mode","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_ecs_service","attribute":"desired_count","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_service","attribute":"load_balancer.container_name","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_service","attribute":"load_balancer.container_port","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_service","attribute":"load_balancer.target_group_arn","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_service","attribute":"task_definition","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"container_definitions","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"execution_role_arn","closure":"CLOSED:REVIEW"},{"source_type":"aws_ecs_task_definition","attribute":"task_role_arn","closure":"CLOSED:REVIEW"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"semantic":"service-discovery","closure":"open-critical-without-read-set"}]}},{"id":"module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this","source_type":"aws_cloudwatch_log_group","category":"observability","kind":"log_group","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.dependencies.module.catalog_opensearch","disabled_by":"for_each = 0","configuration_completeness":"COMPLETE","wave":0,"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":405,"end_line":415},"result":{"rule_id":"aws.cloudwatch_log_group","case_id":"log-group","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Logs","resources":["stackit_logs_instance","stackit_logs_access_token"],"maturity":"ga","lifecycle":"active"},"reason":"Log groups become label sets in a STACKIT Logs instance (a label-based Grafana Loki store written over OTLP or the Loki API, retention in days for the whole instance). STACKIT has no log group or stream object: a group's name survives only as a label the shipper sends. Agents switch from the CloudWatch agent to a documented shipper (Grafana Alloy, OpenTelemetry Collector, Vector or Fluent Bit); log groups that keep their logs for the same number of days share one instance.","evidence":["https://docs.stackit.cloud/products/logging-and-monitoring/observability/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/logs_instance","https://docs.stackit.cloud/products/logging-and-monitoring/logs/","https://docs.stackit.cloud/products/logging-and-monitoring/logs/basics/core-features-and-use-cases-of-logs/","https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"log-group-kms","severity":"info","message":"Not verifiable statically (kms_key_id not visible): Log group encrypted with a customer key. A STACKIT Logs instance has no key or encryption setting (neither the provider resource nor the Logs API v1 schema has one), so the customer-managed key is not carried; what the platform itself does to stored logs is not stated by the pages read; no STACKIT fact is documented, so encryption at rest of stored logs is UNKNOWN until a test on a STACKIT project observes it, and a compliance requirement for it stays open.","evidence":["https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/logs_instance"],"blocker_category":"COMPLIANCE"},{"check_id":"log-group-skip-destroy","severity":"info","message":"Not verifiable statically (skip_destroy not visible): skip_destroy keeps the AWS log group (and its logs) when Terraform destroys the resource. The shared STACKIT Logs instance has no such setting (stackit_logs_instance): archive logs that must outlive it elsewhere.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/logs_instance"]},{"check_id":"log-group-retention-long","severity":"info","message":"Not verifiable statically (retention_in_days not visible): The log group keeps logs longer than 180 days. A STACKIT Logs instance keeps at most 180 days (retentionDays 1–180, Logs API v1) — archive older logs elsewhere (e.g. Object Storage) if they must be kept.","evidence":["https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/logs_instance","https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT Logs","confidence":"MEDIUM"}}},{"id":"module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_resource_policy.this","source_type":"aws_cloudwatch_log_resource_policy","category":"observability","kind":"log_resource_policy","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.dependencies.module.catalog_opensearch","disabled_by":"count = 0","configuration_completeness":"COMPLETE","wave":0,"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":450,"end_line":455},"result":{"rule_id":"aws.cloudwatch_log_resource_policy","case_id":"log-resource-policy","class":"RECONFIGURE","confidence":"LOW","target":{"service":"STACKIT Logs access tokens","resources":["stackit_logs_access_token"],"maturity":"ga","lifecycle":"active"},"reason":"The resource-policy JSON (which AWS service principal may put logs into this account/log group) has no counterpart shape in STACKIT: log ingestion is instead authenticated per producer with a stackit_logs_access_token bearer token. A person re-establishes the same write-access relationship by issuing a token to each log-shipping producer.","evidence":["https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/cloudwatch_log_resource_policy","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/logs_access_token"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT Logs access tokens","confidence":"LOW"}}},{"id":"module.dependencies.module.catalog_opensearch.aws_security_group.this","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.dependencies.module.catalog_opensearch","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.dependencies.aws_security_group.catalog_opensearch_sg","module.vpc.module.vpc.aws_subnet.private"],"wave":0,"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":472,"end_line":486},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT security groups are stateful rule sets like AWS's, including rules that reference another security group (remote_security_group_id). Rules are re-created one by one; CIDRs of AWS-internal ranges (VPC, prefix lists) must be replaced with STACKIT network prefixes.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"sg-egress-restricted","severity":"warning","message":"The source restricts egress (the AWS provider removes AWS's default allow-all egress rule; only the listed egress rules apply). Every new STACKIT security group gets two default egress rules, IPv4 and IPv6, with no ip range (any address), no protocol and no port restriction (the test of 2026-10-07, 2026-10-07: API read-back of a new group, docs concepts page), that stackit_security_group (the pinned STACKIT provider) does not manage — as generated, the draft allows all egress. After apply, delete them (stackit security-group rule list / delete --security-group-id \u003cid\u003e), or egress is wider than in the source.","evidence":["https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security group","confidence":"MEDIUM"}}},{"id":"module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this","source_type":"aws_cloudwatch_log_group","category":"observability","kind":"log_group","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.dependencies.module.catalog_rds","disabled_by":"for_each = 0","configuration_completeness":"COMPLETE","wave":0,"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":445,"end_line":453},"result":{"rule_id":"aws.cloudwatch_log_group","case_id":"log-group","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Logs","resources":["stackit_logs_instance","stackit_logs_access_token"],"maturity":"ga","lifecycle":"active"},"reason":"Log groups become label sets in a STACKIT Logs instance (a label-based Grafana Loki store written over OTLP or the Loki API, retention in days for the whole instance). STACKIT has no log group or stream object: a group's name survives only as a label the shipper sends. Agents switch from the CloudWatch agent to a documented shipper (Grafana Alloy, OpenTelemetry Collector, Vector or Fluent Bit); log groups that keep their logs for the same number of days share one instance.","evidence":["https://docs.stackit.cloud/products/logging-and-monitoring/observability/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/logs_instance","https://docs.stackit.cloud/products/logging-and-monitoring/logs/","https://docs.stackit.cloud/products/logging-and-monitoring/logs/basics/core-features-and-use-cases-of-logs/","https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT Logs","confidence":"MEDIUM"}}},{"id":"module.dependencies.module.catalog_rds.aws_iam_role.rds_enhanced_monitoring","source_type":"aws_iam_role","category":"identity","kind":"iam_role","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.dependencies.module.catalog_rds","disabled_by":"count = 0","configuration_completeness":"COMPLETE","wave":0,"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":255,"end_line":270},"result":{"rule_id":"aws.iam_role","class":"MANUAL_REVIEW","confidence":"LOW","reason":"Not decidable statically: whether dependents[0] (the value of monitoring_role_arn of module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this may be null (a condition not known statically)) exist decides it: with dependents[0] → role-aws-managed-service (RECONFIGURE); without dependents[0] → role-generic (MANUAL_REVIEW). An architect has to decide.","evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam); SKE workload identity docs 2026-09-15; IAM checks of 2026-10-06: provider 0.117.0 schema, docs.stackit.cloud access-and-identity 2026-10-06; IAM notes wording (Act-As, S3 bucket policy carrier, Container Registry has no resource): provider 0.119.0 schema and the docs.stackit.cloud pages cited in the checks, checked 2026-10-11; iam-managed-ssm-instance wording: provider 0.119.0 schema (stackit_server agent), docs.stackit.cloud server-agent, run-command and server pages and the AWS AmazonSSMManagedInstanceCore and Systems Manager instance-permission pages, fetched 2026-10-12; role-ec2-no-profile: provider 0.119.0 docs stackit_server_service_account_attach and stackit_service_account, read 2026-11-01; role-ec2-no-profile skips a role an awscc_iam_instance_profile names: awscc 1.103.0 docs/resources/iam_instance_profile.md (roles), read 2026-11-01; role-instance-profile of an awscc_iam_instance_profile that holds the role exactly (2026-11-01): awscc 1.103.0 docs/resources/iam_instance_profile.md (roles: a Set of String, one role per EC2 instance) and the awscc provider source of the instance profile resource, instance_profile_resource_gen.go:114 (knowledge-base evidence, not in this folder: the primary identifier is the name), read 2026-11-01","findings":[{"check_id":"role-aws-service-principal","severity":"info","message":"This is a service role used by AWS itself (EKS control plane, RDS monitoring, flow logs, CloudWatch Logs delivery, CloudTrail). STACKIT managed services run without customer-side service roles; the role usually disappears rather than being migrated.","evidence":["https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"UNKNOWN","motion":"","change_types":[],"blocker_categories":["UNKNOWN"],"target_platform":"","confidence":"LOW"}}},{"id":"module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu","source_type":"aws_cloudwatch_metric_alarm","category":"observability","kind":"metric_alarm","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.dependencies.module.checkout_elasticache_redis","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default"],"wave":0,"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf","line":169,"end_line":191},"result":{"rule_id":"aws.cloudwatch_metric_alarm","case_id":"alarm","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Observability alert rules","resources":["stackit_observability_instance","stackit_observability_alertgroup"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): observability lists 12 offerings"}]},"reason":"Alarms become Prometheus alert rules in STACKIT Observability. AWS metric namespaces (AWS/EC2, AWS/ApplicationELB…) do not exist there; each alarm is rewritten against the exporters that monitor the new resources.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/observability_alertgroup"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT Observability alert rules","confidence":"MEDIUM"}}},{"id":"module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory","source_type":"aws_cloudwatch_metric_alarm","category":"observability","kind":"metric_alarm","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.dependencies.module.checkout_elasticache_redis","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default"],"wave":0,"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf","line":193,"end_line":215},"result":{"rule_id":"aws.cloudwatch_metric_alarm","case_id":"alarm","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Observability alert rules","resources":["stackit_observability_instance","stackit_observability_alertgroup"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): observability lists 12 offerings"}]},"reason":"Alarms become Prometheus alert rules in STACKIT Observability. AWS metric namespaces (AWS/EC2, AWS/ApplicationELB…) do not exist there; each alarm is rewritten against the exporters that monitor the new resources.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/observability_alertgroup"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT Observability alert rules","confidence":"MEDIUM"}}},{"id":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/main.tf","line":24,"end_line":79},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT security groups are stateful rule sets like AWS's, including rules that reference another security group (remote_security_group_id). Rules are re-created one by one; CIDRs of AWS-internal ranges (VPC, prefix lists) must be replaced with STACKIT network prefixes.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"sg-egress-restricted","severity":"warning","message":"The source restricts egress (the AWS provider removes AWS's default allow-all egress rule; only the listed egress rules apply). Every new STACKIT security group gets two default egress rules, IPv4 and IPv6, with no ip range (any address), no protocol and no port restriction (the test of 2026-10-07, 2026-10-07: API read-back of a new group, docs concepts page), that stackit_security_group (the pinned STACKIT provider) does not manage — as generated, the draft allows all egress. After apply, delete them (stackit security-group rule list / delete --security-group-id \u003cid\u003e), or egress is wider than in the source.","evidence":["https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security group","confidence":"MEDIUM"}}},{"id":"module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default","source_type":"aws_route53_record","category":"network","kind":"dns_record","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.dependencies.module.checkout_elasticache_redis.module.dns","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default"],"wave":0,"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis.dns/main.tf","line":1,"end_line":8},"result":{"rule_id":"aws.route53_record","case_id":"address-record","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT DNS record set","resources":["stackit_dns_record_set"],"maturity":"ga","lifecycle":"active"},"reason":"The value of this record is another one after the migration: the record, in a zone managed outside this scan, becomes a STACKIT DNS record set that points at the address of a new STACKIT resource, not at the value of the source (an address or a name of a resource that the migration replaces). Three effects are tracked apart: the address change (the record has to point at the address of the new STACKIT resource, which exists only after apply), the reachability (the new address answers only once the resource is up and the record is switched) and the effect on what depends on the address (allow-lists, certificates and clients that name the old address).","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/dns_record_set","https://docs.stackit.cloud/products/network/core-networking/dns/reference/record-types/","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0; docs.stackit.cloud 'Setup IPv6 reachability' (last updated 2026-10-05), Public IP Address concepts and the Network Load Balancer FAQ (last updated 2026-02-02), read from the docs mirror 2026-10-27","findings":[{"check_id":"dns-record-address-change","severity":"warning","message":"The value of this record changes with the migration, and its three effects are kept apart: the address change, the reachability and the effect on what depends on the address. Address change: the record points at an address or a name that belongs to an AWS resource the migration replaces (an instance or Elastic IP address, a load balancer, a CloudFront distribution, an S3 website, or a value built from one of them); on STACKIT it has to point at the generated STACKIT resource (a public IP address, a load balancer address), which exists only after apply: the draft writes that reference where the source proves which resource it is and otherwise asks for the value in a variable. Reachability: the new address answers only once the STACKIT resource is up and the record is switched to it, and an AAAA value is reachable only through the IPv6 arrangement of the finding for AAAA records. Effect on what depends on the address: firewalls and allow-lists of partners, certificates validated against the old name or address, health checks and clients that hold the old address are not visible in the source and follow the record by hand. The record is therefore never carried as a like-for-like move, whatever the other records of its zone do.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/dns_record_set","https://docs.stackit.cloud/products/network/core-networking/dns/reference/record-types/"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT DNS record set","confidence":"MEDIUM"}}},{"id":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","source_type":"aws_dynamodb_table","category":"data","kind":"nosql_table","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.dependencies.module.dynamodb_carts","disabled_by":"count = 0","configuration_completeness":"COMPLETE","wave":0,"provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/main.tf","line":88,"end_line":177},"result":{"rule_id":"aws.dynamodb_table","case_id":"dynamodb","class":"REDESIGN","confidence":"MEDIUM","target":{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","resources":["stackit_mongodbflex_instance"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): mongodbflex lists 16 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): mongodbflex lists 5 offerings"}]},"reason":"There is no DynamoDB-compatible service on STACKIT. The access layer is rewritten against a document store (MongoDB Flex) or relational JSONB (PostgreSQL Flex); key design, capacity modes and conditional writes do not carry over. The draft is an alternative, not an equivalent: one MongoDB Flex instance for the estate's tables, each table a collection with its keys and secondary indexes named as MongoDB indexes.","review":["Rewrite the data access layer against the MongoDB API (queries, conditional writes, transactions).","Size the instance from the tables' data volume and request load; capacity units do not translate."],"evidence":["https://docs.stackit.cloud/products/databases/mongodb-flex/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/mongodbflex_instance"],"validated_against":"STACKIT product catalogue 2026-09-23 (no managed key-value NoSQL with a DynamoDB-compatible API); terraform-provider-stackit@0.116.0 (stackit_mongodbflex_instance: flavor, storage, replicas, backup schedule, point-in-time window; no encryption key attribute); STACKIT catalogue eu01 2026-09-24","findings":[{"check_id":"dynamodb-secondary-indexes","severity":"info","message":"Secondary indexes become MongoDB indexes on the collection; projections and the eventual consistency of global secondary indexes do not carry over."},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE","DATA"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","confidence":"MEDIUM"}}},{"id":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","source_type":"aws_dynamodb_table","category":"data","kind":"nosql_table","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.dependencies.module.dynamodb_carts","disabled_by":"count = 0","configuration_completeness":"COMPLETE","wave":0,"provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/main.tf","line":179,"end_line":268},"result":{"rule_id":"aws.dynamodb_table","case_id":"dynamodb","class":"REDESIGN","confidence":"MEDIUM","target":{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","resources":["stackit_mongodbflex_instance"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): mongodbflex lists 16 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): mongodbflex lists 5 offerings"}]},"reason":"There is no DynamoDB-compatible service on STACKIT. The access layer is rewritten against a document store (MongoDB Flex) or relational JSONB (PostgreSQL Flex); key design, capacity modes and conditional writes do not carry over. The draft is an alternative, not an equivalent: one MongoDB Flex instance for the estate's tables, each table a collection with its keys and secondary indexes named as MongoDB indexes.","review":["Rewrite the data access layer against the MongoDB API (queries, conditional writes, transactions).","Size the instance from the tables' data volume and request load; capacity units do not translate."],"evidence":["https://docs.stackit.cloud/products/databases/mongodb-flex/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/mongodbflex_instance"],"validated_against":"STACKIT product catalogue 2026-09-23 (no managed key-value NoSQL with a DynamoDB-compatible API); terraform-provider-stackit@0.116.0 (stackit_mongodbflex_instance: flavor, storage, replicas, backup schedule, point-in-time window; no encryption key attribute); STACKIT catalogue eu01 2026-09-24","findings":[{"check_id":"dynamodb-secondary-indexes","severity":"info","message":"Secondary indexes become MongoDB indexes on the collection; projections and the eventual consistency of global secondary indexes do not carry over."},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE","DATA"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","confidence":"MEDIUM"}}},{"id":"module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this","source_type":"aws_cloudwatch_log_group","category":"observability","kind":"log_group","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.dependencies.module.orders_rds","disabled_by":"for_each = 0","configuration_completeness":"COMPLETE","wave":0,"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":445,"end_line":453},"result":{"rule_id":"aws.cloudwatch_log_group","case_id":"log-group","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Logs","resources":["stackit_logs_instance","stackit_logs_access_token"],"maturity":"ga","lifecycle":"active"},"reason":"Log groups become label sets in a STACKIT Logs instance (a label-based Grafana Loki store written over OTLP or the Loki API, retention in days for the whole instance). STACKIT has no log group or stream object: a group's name survives only as a label the shipper sends. Agents switch from the CloudWatch agent to a documented shipper (Grafana Alloy, OpenTelemetry Collector, Vector or Fluent Bit); log groups that keep their logs for the same number of days share one instance.","evidence":["https://docs.stackit.cloud/products/logging-and-monitoring/observability/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/logs_instance","https://docs.stackit.cloud/products/logging-and-monitoring/logs/","https://docs.stackit.cloud/products/logging-and-monitoring/logs/basics/core-features-and-use-cases-of-logs/","https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT Logs","confidence":"MEDIUM"}}},{"id":"module.dependencies.module.orders_rds.aws_iam_role.rds_enhanced_monitoring","source_type":"aws_iam_role","category":"identity","kind":"iam_role","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.dependencies.module.orders_rds","disabled_by":"count = 0","configuration_completeness":"COMPLETE","wave":0,"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":255,"end_line":270},"result":{"rule_id":"aws.iam_role","class":"MANUAL_REVIEW","confidence":"LOW","reason":"Not decidable statically: whether dependents[0] (the value of monitoring_role_arn of module.dependencies.module.orders_rds.aws_rds_cluster_instance.this may be null (a condition not known statically)) exist decides it: with dependents[0] → role-aws-managed-service (RECONFIGURE); without dependents[0] → role-generic (MANUAL_REVIEW). An architect has to decide.","evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam); SKE workload identity docs 2026-09-15; IAM checks of 2026-10-06: provider 0.117.0 schema, docs.stackit.cloud access-and-identity 2026-10-06; IAM notes wording (Act-As, S3 bucket policy carrier, Container Registry has no resource): provider 0.119.0 schema and the docs.stackit.cloud pages cited in the checks, checked 2026-10-11; iam-managed-ssm-instance wording: provider 0.119.0 schema (stackit_server agent), docs.stackit.cloud server-agent, run-command and server pages and the AWS AmazonSSMManagedInstanceCore and Systems Manager instance-permission pages, fetched 2026-10-12; role-ec2-no-profile: provider 0.119.0 docs stackit_server_service_account_attach and stackit_service_account, read 2026-11-01; role-ec2-no-profile skips a role an awscc_iam_instance_profile names: awscc 1.103.0 docs/resources/iam_instance_profile.md (roles), read 2026-11-01; role-instance-profile of an awscc_iam_instance_profile that holds the role exactly (2026-11-01): awscc 1.103.0 docs/resources/iam_instance_profile.md (roles: a Set of String, one role per EC2 instance) and the awscc provider source of the instance profile resource, instance_profile_resource_gen.go:114 (knowledge-base evidence, not in this folder: the primary identifier is the name), read 2026-11-01","findings":[{"check_id":"role-aws-service-principal","severity":"info","message":"This is a service role used by AWS itself (EKS control plane, RDS monitoring, flow logs, CloudWatch Logs delivery, CloudTrail). STACKIT managed services run without customer-side service roles; the role usually disappears rather than being migrated.","evidence":["https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"UNKNOWN","motion":"","change_types":[],"blocker_categories":["UNKNOWN"],"target_platform":"","confidence":"LOW"}}},{"id":"module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events","source_type":"aws_cloudwatch_event_rule","category":"messaging","kind":"event_rule","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"(var.container_insights_setting == \"enhanced\" \u0026\u0026 var.lifecycle_events_enabled) ? 1 : 0","variables":["var.container_insights_setting","var.lifecycle_events_enabled"]},"standing":"UNIT","module_call":"module.retail_app_ecs","configuration_completeness":"CONDITIONAL","conditional_facets":[{"id":"module.retail_app_ecs.aws_cloudwatch_event_target.ecs_events_target","source_type":"aws_cloudwatch_event_target","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"(var.container_insights_setting == \"enhanced\" \u0026\u0026 var.lifecycle_events_enabled) ? 1 : 0","variables":["var.container_insights_setting","var.lifecycle_events_enabled"]},"switched_off":true}],"wave":0,"provenance":{"file":"../../lib/ecs/eventbridge.tf","line":18,"end_line":29},"result":{"rule_id":"aws.event_rule","case_id":"event-pattern","class":"REDESIGN","confidence":"MEDIUM","target":{"service":"none managed — application events over RabbitMQ","maturity":"ga"},"reason":"Event-pattern rules react to AWS service events that do not exist on STACKIT. The producer has to publish its own events (e.g. to RabbitMQ) and the consumer subscribes explicitly.","evidence":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/"],"validated_against":"STACKIT product catalogue 2026-09-23 (no managed event bus; Workflows API v1alpha only)","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"none managed — application events over RabbitMQ","confidence":"MEDIUM"}}},{"id":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights","source_type":"aws_cloudwatch_log_group","category":"observability","kind":"log_group","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"(var.container_insights_setting == \"enhanced\" \u0026\u0026 var.lifecycle_events_enabled) ? 1 : 0","variables":["var.container_insights_setting","var.lifecycle_events_enabled"]},"standing":"UNIT","module_call":"module.retail_app_ecs","configuration_completeness":"CONDITIONAL","wave":0,"provenance":{"file":"../../lib/ecs/eventbridge.tf","line":8,"end_line":16},"result":{"rule_id":"aws.cloudwatch_log_group","case_id":"log-group","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Logs","resources":["stackit_logs_instance","stackit_logs_access_token"],"maturity":"ga","lifecycle":"active"},"reason":"Log groups become label sets in a STACKIT Logs instance (a label-based Grafana Loki store written over OTLP or the Loki API, retention in days for the whole instance). STACKIT has no log group or stream object: a group's name survives only as a label the shipper sends. Agents switch from the CloudWatch agent to a documented shipper (Grafana Alloy, OpenTelemetry Collector, Vector or Fluent Bit); log groups that keep their logs for the same number of days share one instance.","evidence":["https://docs.stackit.cloud/products/logging-and-monitoring/observability/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/logs_instance","https://docs.stackit.cloud/products/logging-and-monitoring/logs/","https://docs.stackit.cloud/products/logging-and-monitoring/logs/basics/core-features-and-use-cases-of-logs/","https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT Logs","confidence":"MEDIUM"}}},{"id":"module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs","source_type":"aws_cloudwatch_log_resource_policy","category":"observability","kind":"log_resource_policy","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"(var.container_insights_setting == \"enhanced\" \u0026\u0026 var.lifecycle_events_enabled) ? 1 : 0","variables":["var.container_insights_setting","var.lifecycle_events_enabled"]},"standing":"UNIT","module_call":"module.retail_app_ecs","configuration_completeness":"CONDITIONAL","wave":0,"provenance":{"file":"../../lib/ecs/eventbridge.tf","line":38,"end_line":57},"result":{"rule_id":"aws.cloudwatch_log_resource_policy","case_id":"log-resource-policy","class":"RECONFIGURE","confidence":"LOW","target":{"service":"STACKIT Logs access tokens","resources":["stackit_logs_access_token"],"maturity":"ga","lifecycle":"active"},"reason":"The resource-policy JSON (which AWS service principal may put logs into this account/log group) has no counterpart shape in STACKIT: log ingestion is instead authenticated per producer with a stackit_logs_access_token bearer token. A person re-establishes the same write-access relationship by issuing a token to each log-shipping producer.","evidence":["https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/cloudwatch_log_resource_policy","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/logs_access_token"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT Logs access tokens","confidence":"LOW"}}},{"id":"module.retail_app_ecs.module.alb.aws_lambda_permission.lb","source_type":"aws_lambda_permission","category":"compute","kind":"function_trigger_permission","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.alb","disabled_by":"for_each = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":155,"end_line":167},"result":{"class":"MANUAL_REVIEW","confidence":"LOW","reason":"The knowledge base maps aws_lambda_permission as part of its parent, but its parent (through function_name) was not found in the scan (the value of function_name is not known statically, so the resource it names cannot be matched to one of this scan); it is switched off in the source as written (for_each = 0), so nothing of it is migrated unless it is switched on, and then an architect has to decide the target of this part.","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"production_eligible":false,"axes":{"feasibility":"UNKNOWN","motion":"","change_types":[],"blocker_categories":["UNKNOWN"],"target_platform":"","confidence":"LOW"}}},{"id":"module.retail_app_ecs.module.alb.aws_wafv2_web_acl_association.this","source_type":"aws_wafv2_web_acl_association","category":"network","kind":"web_application_firewall_attachment","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.alb","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.retail_app_ecs.module.alb.aws_lb.this"],"wave":0,"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":845,"end_line":849},"result":{"class":"MANUAL_REVIEW","confidence":"LOW","reason":"The knowledge base maps aws_wafv2_web_acl_association as part of its parent, but its parent (through web_acl_arn) was not found in the scan (web_acl_arn is not set in this source, so it names no resource); it is switched off in the source as written (count = 0), so nothing of it is migrated unless it is switched on, and then an architect has to decide the target of this part.","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"production_eligible":false,"axes":{"feasibility":"UNKNOWN","motion":"","change_types":[],"blocker_categories":["UNKNOWN"],"target_platform":"","confidence":"LOW"}}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","source_type":"aws_security_group","category":"network","kind":"firewall_group","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.retail_app_ecs.module.alb_sg","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":13,"end_line":32},"result":{"rule_id":"aws.security_group","case_id":"sg","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT security groups are stateful rule sets like AWS's, including rules that reference another security group (remote_security_group_id). Rules are re-created one by one; CIDRs of AWS-internal ranges (VPC, prefix lists) must be replaced with STACKIT network prefixes.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group_rule.md","https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_security_group_rule has remote_security_group_id); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_security_group and stackit_security_group_rule schemas unchanged, pages re-read; the rule has direction, protocol, port_range, ip_range, ether_type, icmp_parameters and remote_security_group_id and no action or rule number; the group has no rules attribute; the statement that a rule without protocol, port_range or source allows everything (check sg-rule-not-rendered) is NOT covered by these pages and stays as validated on 0.116.0)","findings":[{"check_id":"sg-egress-restricted","severity":"warning","message":"The source restricts egress (the AWS provider removes AWS's default allow-all egress rule; only the listed egress rules apply). Every new STACKIT security group gets two default egress rules, IPv4 and IPv6, with no ip range (any address), no protocol and no port restriction (the test of 2026-10-07, 2026-10-07: API read-back of a new group, docs concepts page), that stackit_security_group (the pinned STACKIT provider) does not manage — as generated, the draft allows all egress. After apply, delete them (stackit security-group rule list / delete --security-group-id \u003cid\u003e), or egress is wider than in the source.","evidence":["https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","docs/benchmark/probes/2026-10-07_probe6_sg-egress-portrange-s3mfa-routing/README.md"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security group","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log","source_type":"aws_cloudwatch_log_group","category":"observability","kind":"log_group","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/vpc-flow-logs.tf","line":65,"end_line":75},"result":{"rule_id":"aws.cloudwatch_log_group","case_id":"log-group","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Logs","resources":["stackit_logs_instance","stackit_logs_access_token"],"maturity":"ga","lifecycle":"active"},"reason":"Log groups become label sets in a STACKIT Logs instance (a label-based Grafana Loki store written over OTLP or the Loki API, retention in days for the whole instance). STACKIT has no log group or stream object: a group's name survives only as a label the shipper sends. Agents switch from the CloudWatch agent to a documented shipper (Grafana Alloy, OpenTelemetry Collector, Vector or Fluent Bit); log groups that keep their logs for the same number of days share one instance.","evidence":["https://docs.stackit.cloud/products/logging-and-monitoring/observability/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/logs_instance","https://docs.stackit.cloud/products/logging-and-monitoring/logs/","https://docs.stackit.cloud/products/logging-and-monitoring/logs/basics/core-features-and-use-cases-of-logs/","https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json"],"validated_against":"terraform-provider-stackit@0.116.0","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT Logs","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_default_vpc.this","source_type":"aws_default_vpc","category":"network","kind":"virtual_network","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1252,"end_line":1263},"result":{"rule_id":"aws.vpc","case_id":"vpc","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT project networking / Network Area (SNA)","resources":["stackit_network_area","stackit_network"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT has no VPC container object in its GA model: each subnet becomes a stackit_network in a project, and networks that must talk to each other privately join a Network Area. The newer stackit_vpc resources exist but are experimental (provider experiment \"vpc\"). With exactly one VPC in the estate the project is that VPC's boundary (STACKIT_STABLE profile) and the draft says so at the top of the draft's network file; with several VPCs, or a VPC count that is not visible statically, which architecture holds them is the architect's decision (the checks on several VPCs and on a VPC count that is not visible).","review":["Decide the project layout (one project per environment or per application) before mapping networks.","A Network Area can be enabled in several regions (one stackit_network_area_region per region); verify cross-region routing for multi-region AWS designs."],"evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_vpc* is experimental); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_vpc* still carries the experimental notice; stackit_network attributes unchanged from 0.116.0 (its block description lost the transitional ipv4_nameservers behaviour warning; the attribute description keeps the behaviour); stackit_network_area_region, stackit_security_group, stackit_security_group_rule, stackit_routing_table and stackit_routing_table_route schemas unchanged; no egress-only gateway, network ACL or internet-gateway resource; docs re-read: network, network_area_region, security_group, security_group_rule, routing_table); docs core-networking 2026-09-23","findings":[{"check_id":"vpc-default","severity":"info","message":"This is the account's default VPC, adopted by Terraform; only the networks the workload actually uses become STACKIT networks."},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT project networking / Network Area (SNA)","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_flow_log.this","source_type":"aws_flow_log","category":"network","kind":"flow_log","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/vpc-flow-logs.tf","line":36,"end_line":59},"result":{"rule_id":"aws.flow_log","case_id":"flow-log","class":"REDESIGN","confidence":"LOW","target":{"service":"none - no packet-flow log: a capture on the servers whose records a log shipper sends to a STACKIT Logs instance is a design of its own","maturity":"ga"},"reason":"A flow log records the IP traffic of a VPC, subnet or network interface (accepted, rejected or both) and delivers it to a log group, a bucket or a stream through a delivery role. STACKIT has no counterpart: the provider has no flow-log resource (the pinned provider schema) and the documentation read describes no record of network traffic; the STACKIT Audit Log covers API and control-plane events, not packet flows. What replaces it is a design of its own that StackToIT does not draft: a capture on the servers themselves (the firewall or connection-tracking log of each server, or a flow exporter) whose records a log shipper sends to a STACKIT Logs instance (written over OTLP; a Logs access token with the write permission lets the shipper authenticate). A capture on the servers sees what reaches a server; the documentation read states no log of the traffic the security groups drop, so a capture of rejected traffic has no documented counterpart. The log group the flow log wrote to is a unit of its own that maps to a Logs instance, which can receive the records of the replacement; a bucket or a stream as destination is a decision of its own. The delivery role is not carried: the shipper authenticates with the access token, so the role has no purpose in the replacement. If flow logs serve compliance, which traffic must stay recorded, for how long and where is the architect's input; nothing is written for the flow log.","evidence":["data/stackit/provider-schema-0.120.0.json","https://docs.stackit.cloud/platform/audit-log/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/logs_instance.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/logs_access_token.md","https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html","data/stackit/provider-schema-0.120.0.json"],"validated_against":"terraform-provider-stackit@0.116.0 (no flow-log resource); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: no such resource in the 0.120.0 schema (115 resources; since 0.116.0 only stackit_volume_automation was added))","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"none - no packet-flow log: a capture on the servers whose records a log shipper sends to a STACKIT Logs instance is a design of its own","confidence":"LOW"}}},{"id":"module.vpc.module.vpc.aws_iam_role.vpc_flow_log_cloudwatch","source_type":"aws_iam_role","category":"identity","kind":"iam_role","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/vpc-flow-logs.tf","line":77,"end_line":87},"result":{"rule_id":"aws.iam_role","case_id":"role-generic","class":"MANUAL_REVIEW","confidence":"LOW","target":{"service":"STACKIT IAM (service accounts + role assignments)","resources":["stackit_service_account","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"Not decidable statically: case role-workload-execution (assume_role_policy) depends on values only known at plan/apply time. Assuming it does not apply, the mapping would be \"role-generic\": STACKIT IAM grants (subject, role, resource) assignments; there are no policy documents, conditions or cross-account trust policies. What this role is for (service principal, federation, cross-account) decides the target and has to be read by an architect.","evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam); SKE workload identity docs 2026-09-15; IAM checks of 2026-10-06: provider 0.117.0 schema, docs.stackit.cloud access-and-identity 2026-10-06; IAM notes wording (Act-As, S3 bucket policy carrier, Container Registry has no resource): provider 0.119.0 schema and the docs.stackit.cloud pages cited in the checks, checked 2026-10-11; iam-managed-ssm-instance wording: provider 0.119.0 schema (stackit_server agent), docs.stackit.cloud server-agent, run-command and server pages and the AWS AmazonSSMManagedInstanceCore and Systems Manager instance-permission pages, fetched 2026-10-12; role-ec2-no-profile: provider 0.119.0 docs stackit_server_service_account_attach and stackit_service_account, read 2026-11-01; role-ec2-no-profile skips a role an awscc_iam_instance_profile names: awscc 1.103.0 docs/resources/iam_instance_profile.md (roles), read 2026-11-01; role-instance-profile of an awscc_iam_instance_profile that holds the role exactly (2026-11-01): awscc 1.103.0 docs/resources/iam_instance_profile.md (roles: a Set of String, one role per EC2 instance) and the awscc provider source of the instance profile resource, instance_profile_resource_gen.go:114 (knowledge-base evidence, not in this folder: the primary identifier is the name), read 2026-11-01","findings":[{"check_id":"iam-trust-not-visible","severity":"info","message":"Trust policy: the document is not visible statically as a whole (a variable, a template or file, a merged or computed document), so who may assume the role cannot be read. Where the statements are written out and only a principal, a condition value or a resource is a reference, the other findings of this unit name what the written part states; this finding stays, because the part that is not visible may add or widen who may assume the role. What to decide: read the effective trust policy (aws iam get-role) and classify its principals — a service principal becomes a service account, an AWS principal has no counterpart (give the caller its own identity), an OIDC provider becomes a federated identity provider on a service account.","evidence":["https://docs.stackit.cloud/platform/access-and-identity/","https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_federated_identity_provider"]},{"check_id":"iam-role-tag-conditioned-access","severity":"info","message":"Not verifiable statically (assume_role_policy not visible): A policy of this role (its trust policy or an inline policy) grants or limits access by a tag: a Condition on aws:ResourceTag, aws:RequestTag, aws:PrincipalTag, aws:TagKeys or a tag key of a service, or a tag policy variable. UNSUPPORTED as a condition on STACKIT: a role assignment is (resource_id, role, subject) with no condition (the pinned STACKIT provider schema). The draft may write the tags of the tagged resources as STACKIT labels; that copy is not an access-control equivalent (a role assignment has no condition attribute, so nothing the draft writes makes access depend on a label), and it never closes this item. What to decide: how each statement is expressed without a tag condition (a project of its own per environment or team, one service account per consumer, network rules), or that it is dropped.","evidence":["https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html","https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html","https://docs.aws.amazon.com/AmazonS3/latest/userguide/tagging-and-policies.html","https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/","data/stackit/provider-schema-0.119.0.json"]},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"UNKNOWN","motion":"","change_types":[],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT IAM (service accounts + role assignments)","confidence":"LOW"}}},{"id":"module.vpc.module.vpc.aws_internet_gateway.this","source_type":"aws_internet_gateway","category":"network","kind":"internet_gateway","enabled":true,"instances":-1,"presence":"CONDITIONAL","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_public_subnets \u0026\u0026 var.create_igw ? 1 : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":1},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"standing":"UNIT","module_call":"module.vpc.module.vpc","configuration_completeness":"CONDITIONAL","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1051,"end_line":1061},"result":{"rule_id":"aws.internet_gateway","case_id":"igw","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"implicit (STACKIT network default gateway)","maturity":"ga"},"reason":"There is no internet-gateway object on STACKIT; a routed network with a gateway reaches the internet and inbound access is given per resource with public IPs and security groups. The IGW disappears from the target configuration. That a network reaches the internet with no route was observed and is documented for a project outside a Network Area; for a draft that may put its project in one it is open.","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/"],"validated_against":"terraform-provider-stackit@0.116.0 (no internet-gateway resource); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: no such resource in the 0.120.0 schema (115 resources; since 0.116.0 only stackit_volume_automation was added))","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: a resource of the estate (a subnet, route table, security group, network ACL, flow log, peering connection, a Cloud Control twin of those, ...) names a VPC by a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"coverage":"UNKNOWN_RUNTIME_TOPOLOGY","semantics":{"contract":"aws.internet_gateway","expected":8,"observed":3,"accounted":3,"unaccounted":0,"critical_unaccounted":[],"critical_open":["network-topology-boundary"],"items":[{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"internet-access","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:igw"},{"id":"attached-vpc","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:igw"},{"id":"attached-vpc-unresolved","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ec2-network-insights-path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-internet-gateway-attachment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-gateway-attachment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-gateway-attachment-vpc-id","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"implicit (STACKIT network default gateway)","confidence":"MEDIUM"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"automation_eligible":false,"open_critical_without_read_set":["network-topology-boundary"],"gate_blockers":[{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"source_type":"aws_internet_gateway","closure":"TOPOLOGY:unknown"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"}],"implicit":true}},{"id":"module.vpc.module.vpc.aws_network_acl.database","source_type":"aws_network_acl","category":"network","kind":"network_acl","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":513,"end_line":524},"result":{"rule_id":"aws.network_acl","case_id":"nacl","class":"REDESIGN","confidence":"MEDIUM","target":{"service":"STACKIT security groups (no stateless NACLs)","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT has no stateless subnet ACLs: there is no network ACL resource, and in a Network Area access control at network level is carried out exclusively by security groups. Security groups work on an allow-list basis with default deny; a rule has a direction, protocol, port range and address range and no action and no rule number, so a deny entry of the ACL and the rule-number order that makes it win cannot be expressed. The rules of all groups are evaluated simultaneously, in no order, and the groups attached to one network interface are aggregated permissively (if one group allows traffic and another does not mention it, the traffic is allowed), so a group can add access and never take it away. A stateless security group exists in the API and the provider but is still allow-only, so it is no deny-capable ACL either. The Unified Firewall (generally available since 2026-07-07) aggregates the settings of security groups, database ACLs and public IP configurations and does not replace them; the pinned provider has no resource for it. A next-generation firewall is announced for 2026 only. Deny rules and subnet-level filtering therefore have to be re-expressed as security-group allow rules or a firewall appliance the customer runs. A network ACL is a ceiling on top of the security groups, not a grant, and the security groups attached to one STACKIT network interface are aggregated (the more permissive rule wins): a group written from the ACL's allow rules and attached to the servers would open every port the ACL allows, also where the servers' own groups do not, so the ceiling is carried only by narrowing the rules of those groups (or a firewall appliance), never by adding a group.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/unified-firewall/faq/","https://docs.stackit.cloud/release-notes/","https://docs.stackit.cloud/products/network/core-networking/security-groups/faq/","https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/unified-firewall/faq/"],"validated_against":"terraform-provider-stackit@0.116.0 (no network ACL resource); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: no such resource in the 0.120.0 schema (115 resources; since 0.116.0 only stackit_volume_automation was added); stackit_security_group_rule has no action and no rule number); read 2026-10-28 (docs.stackit.cloud, last-updated dates on the pages): the security groups FAQ (2025-11-19: groups of one network interface are aggregated and the more permissive rule wins; allow-list only, no explicit deny rule; rules are evaluated simultaneously, in no order); the Network Area concepts page (2025-12-11: access control at network level is carried out exclusively by security groups); the Unified Firewall concepts page (2026-08-20: it aggregates security groups, database ACLs and public IP configurations and does not replace the underlying mechanisms) and its FAQ (2025-12-05: a next-generation firewall is planned for 2026), GA release note 2026-07-07 (Terraform and CLI integration announced as coming soon; no Terraform resource in provider-schema-0.120.0.json); IaaS v2 API BaseSecurityGroupRule has no action field; stackit_security_group.stateful (default true) is a stateless option in the API and the provider that the concepts page describes only as the words can be stateful, so its availability to customers is not established; DOCUMENT CONFLICT: the security groups concepts page says rules define which traffic is allowed or denied while the FAQ says explicit deny rules cannot be created, the API and the provider schema support the FAQ","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security groups (no stateless NACLs)","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_network_acl.elasticache","source_type":"aws_network_acl","category":"network","kind":"network_acl","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":780,"end_line":791},"result":{"rule_id":"aws.network_acl","case_id":"nacl","class":"REDESIGN","confidence":"MEDIUM","target":{"service":"STACKIT security groups (no stateless NACLs)","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT has no stateless subnet ACLs: there is no network ACL resource, and in a Network Area access control at network level is carried out exclusively by security groups. Security groups work on an allow-list basis with default deny; a rule has a direction, protocol, port range and address range and no action and no rule number, so a deny entry of the ACL and the rule-number order that makes it win cannot be expressed. The rules of all groups are evaluated simultaneously, in no order, and the groups attached to one network interface are aggregated permissively (if one group allows traffic and another does not mention it, the traffic is allowed), so a group can add access and never take it away. A stateless security group exists in the API and the provider but is still allow-only, so it is no deny-capable ACL either. The Unified Firewall (generally available since 2026-07-07) aggregates the settings of security groups, database ACLs and public IP configurations and does not replace them; the pinned provider has no resource for it. A next-generation firewall is announced for 2026 only. Deny rules and subnet-level filtering therefore have to be re-expressed as security-group allow rules or a firewall appliance the customer runs. A network ACL is a ceiling on top of the security groups, not a grant, and the security groups attached to one STACKIT network interface are aggregated (the more permissive rule wins): a group written from the ACL's allow rules and attached to the servers would open every port the ACL allows, also where the servers' own groups do not, so the ceiling is carried only by narrowing the rules of those groups (or a firewall appliance), never by adding a group.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/unified-firewall/faq/","https://docs.stackit.cloud/release-notes/","https://docs.stackit.cloud/products/network/core-networking/security-groups/faq/","https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/unified-firewall/faq/"],"validated_against":"terraform-provider-stackit@0.116.0 (no network ACL resource); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: no such resource in the 0.120.0 schema (115 resources; since 0.116.0 only stackit_volume_automation was added); stackit_security_group_rule has no action and no rule number); read 2026-10-28 (docs.stackit.cloud, last-updated dates on the pages): the security groups FAQ (2025-11-19: groups of one network interface are aggregated and the more permissive rule wins; allow-list only, no explicit deny rule; rules are evaluated simultaneously, in no order); the Network Area concepts page (2025-12-11: access control at network level is carried out exclusively by security groups); the Unified Firewall concepts page (2026-08-20: it aggregates security groups, database ACLs and public IP configurations and does not replace the underlying mechanisms) and its FAQ (2025-12-05: a next-generation firewall is planned for 2026), GA release note 2026-07-07 (Terraform and CLI integration announced as coming soon; no Terraform resource in provider-schema-0.120.0.json); IaaS v2 API BaseSecurityGroupRule has no action field; stackit_security_group.stateful (default true) is a stateless option in the API and the provider that the concepts page describes only as the words can be stateful, so its availability to customers is not established; DOCUMENT CONFLICT: the security groups concepts page says rules define which traffic is allowed or denied while the FAQ says explicit deny rules cannot be created, the API and the provider schema support the FAQ","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security groups (no stateless NACLs)","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_network_acl.intra","source_type":"aws_network_acl","category":"network","kind":"network_acl","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":898,"end_line":909},"result":{"rule_id":"aws.network_acl","case_id":"nacl","class":"REDESIGN","confidence":"MEDIUM","target":{"service":"STACKIT security groups (no stateless NACLs)","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT has no stateless subnet ACLs: there is no network ACL resource, and in a Network Area access control at network level is carried out exclusively by security groups. Security groups work on an allow-list basis with default deny; a rule has a direction, protocol, port range and address range and no action and no rule number, so a deny entry of the ACL and the rule-number order that makes it win cannot be expressed. The rules of all groups are evaluated simultaneously, in no order, and the groups attached to one network interface are aggregated permissively (if one group allows traffic and another does not mention it, the traffic is allowed), so a group can add access and never take it away. A stateless security group exists in the API and the provider but is still allow-only, so it is no deny-capable ACL either. The Unified Firewall (generally available since 2026-07-07) aggregates the settings of security groups, database ACLs and public IP configurations and does not replace them; the pinned provider has no resource for it. A next-generation firewall is announced for 2026 only. Deny rules and subnet-level filtering therefore have to be re-expressed as security-group allow rules or a firewall appliance the customer runs. A network ACL is a ceiling on top of the security groups, not a grant, and the security groups attached to one STACKIT network interface are aggregated (the more permissive rule wins): a group written from the ACL's allow rules and attached to the servers would open every port the ACL allows, also where the servers' own groups do not, so the ceiling is carried only by narrowing the rules of those groups (or a firewall appliance), never by adding a group.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/unified-firewall/faq/","https://docs.stackit.cloud/release-notes/","https://docs.stackit.cloud/products/network/core-networking/security-groups/faq/","https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/unified-firewall/faq/"],"validated_against":"terraform-provider-stackit@0.116.0 (no network ACL resource); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: no such resource in the 0.120.0 schema (115 resources; since 0.116.0 only stackit_volume_automation was added); stackit_security_group_rule has no action and no rule number); read 2026-10-28 (docs.stackit.cloud, last-updated dates on the pages): the security groups FAQ (2025-11-19: groups of one network interface are aggregated and the more permissive rule wins; allow-list only, no explicit deny rule; rules are evaluated simultaneously, in no order); the Network Area concepts page (2025-12-11: access control at network level is carried out exclusively by security groups); the Unified Firewall concepts page (2026-08-20: it aggregates security groups, database ACLs and public IP configurations and does not replace the underlying mechanisms) and its FAQ (2025-12-05: a next-generation firewall is planned for 2026), GA release note 2026-07-07 (Terraform and CLI integration announced as coming soon; no Terraform resource in provider-schema-0.120.0.json); IaaS v2 API BaseSecurityGroupRule has no action field; stackit_security_group.stateful (default true) is a stateless option in the API and the provider that the concepts page describes only as the words can be stateful, so its availability to customers is not established; DOCUMENT CONFLICT: the security groups concepts page says rules define which traffic is allowed or denied while the FAQ says explicit deny rules cannot be created, the API and the provider schema support the FAQ","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security groups (no stateless NACLs)","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_network_acl.outpost","source_type":"aws_network_acl","category":"network","kind":"network_acl","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1000,"end_line":1011},"result":{"rule_id":"aws.network_acl","case_id":"nacl","class":"REDESIGN","confidence":"MEDIUM","target":{"service":"STACKIT security groups (no stateless NACLs)","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT has no stateless subnet ACLs: there is no network ACL resource, and in a Network Area access control at network level is carried out exclusively by security groups. Security groups work on an allow-list basis with default deny; a rule has a direction, protocol, port range and address range and no action and no rule number, so a deny entry of the ACL and the rule-number order that makes it win cannot be expressed. The rules of all groups are evaluated simultaneously, in no order, and the groups attached to one network interface are aggregated permissively (if one group allows traffic and another does not mention it, the traffic is allowed), so a group can add access and never take it away. A stateless security group exists in the API and the provider but is still allow-only, so it is no deny-capable ACL either. The Unified Firewall (generally available since 2026-07-07) aggregates the settings of security groups, database ACLs and public IP configurations and does not replace them; the pinned provider has no resource for it. A next-generation firewall is announced for 2026 only. Deny rules and subnet-level filtering therefore have to be re-expressed as security-group allow rules or a firewall appliance the customer runs. A network ACL is a ceiling on top of the security groups, not a grant, and the security groups attached to one STACKIT network interface are aggregated (the more permissive rule wins): a group written from the ACL's allow rules and attached to the servers would open every port the ACL allows, also where the servers' own groups do not, so the ceiling is carried only by narrowing the rules of those groups (or a firewall appliance), never by adding a group.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/unified-firewall/faq/","https://docs.stackit.cloud/release-notes/","https://docs.stackit.cloud/products/network/core-networking/security-groups/faq/","https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/unified-firewall/faq/"],"validated_against":"terraform-provider-stackit@0.116.0 (no network ACL resource); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: no such resource in the 0.120.0 schema (115 resources; since 0.116.0 only stackit_volume_automation was added); stackit_security_group_rule has no action and no rule number); read 2026-10-28 (docs.stackit.cloud, last-updated dates on the pages): the security groups FAQ (2025-11-19: groups of one network interface are aggregated and the more permissive rule wins; allow-list only, no explicit deny rule; rules are evaluated simultaneously, in no order); the Network Area concepts page (2025-12-11: access control at network level is carried out exclusively by security groups); the Unified Firewall concepts page (2026-08-20: it aggregates security groups, database ACLs and public IP configurations and does not replace the underlying mechanisms) and its FAQ (2025-12-05: a next-generation firewall is planned for 2026), GA release note 2026-07-07 (Terraform and CLI integration announced as coming soon; no Terraform resource in provider-schema-0.120.0.json); IaaS v2 API BaseSecurityGroupRule has no action field; stackit_security_group.stateful (default true) is a stateless option in the API and the provider that the concepts page describes only as the words can be stateful, so its availability to customers is not established; DOCUMENT CONFLICT: the security groups concepts page says rules define which traffic is allowed or denied while the FAQ says explicit deny rules cannot be created, the API and the provider schema support the FAQ","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security groups (no stateless NACLs)","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_network_acl.private","source_type":"aws_network_acl","category":"network","kind":"network_acl","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_subnet.private","module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":331,"end_line":342},"result":{"rule_id":"aws.network_acl","case_id":"nacl","class":"REDESIGN","confidence":"MEDIUM","target":{"service":"STACKIT security groups (no stateless NACLs)","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT has no stateless subnet ACLs: there is no network ACL resource, and in a Network Area access control at network level is carried out exclusively by security groups. Security groups work on an allow-list basis with default deny; a rule has a direction, protocol, port range and address range and no action and no rule number, so a deny entry of the ACL and the rule-number order that makes it win cannot be expressed. The rules of all groups are evaluated simultaneously, in no order, and the groups attached to one network interface are aggregated permissively (if one group allows traffic and another does not mention it, the traffic is allowed), so a group can add access and never take it away. A stateless security group exists in the API and the provider but is still allow-only, so it is no deny-capable ACL either. The Unified Firewall (generally available since 2026-07-07) aggregates the settings of security groups, database ACLs and public IP configurations and does not replace them; the pinned provider has no resource for it. A next-generation firewall is announced for 2026 only. Deny rules and subnet-level filtering therefore have to be re-expressed as security-group allow rules or a firewall appliance the customer runs. A network ACL is a ceiling on top of the security groups, not a grant, and the security groups attached to one STACKIT network interface are aggregated (the more permissive rule wins): a group written from the ACL's allow rules and attached to the servers would open every port the ACL allows, also where the servers' own groups do not, so the ceiling is carried only by narrowing the rules of those groups (or a firewall appliance), never by adding a group.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/unified-firewall/faq/","https://docs.stackit.cloud/release-notes/","https://docs.stackit.cloud/products/network/core-networking/security-groups/faq/","https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/unified-firewall/faq/"],"validated_against":"terraform-provider-stackit@0.116.0 (no network ACL resource); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: no such resource in the 0.120.0 schema (115 resources; since 0.116.0 only stackit_volume_automation was added); stackit_security_group_rule has no action and no rule number); read 2026-10-28 (docs.stackit.cloud, last-updated dates on the pages): the security groups FAQ (2025-11-19: groups of one network interface are aggregated and the more permissive rule wins; allow-list only, no explicit deny rule; rules are evaluated simultaneously, in no order); the Network Area concepts page (2025-12-11: access control at network level is carried out exclusively by security groups); the Unified Firewall concepts page (2026-08-20: it aggregates security groups, database ACLs and public IP configurations and does not replace the underlying mechanisms) and its FAQ (2025-12-05: a next-generation firewall is planned for 2026), GA release note 2026-07-07 (Terraform and CLI integration announced as coming soon; no Terraform resource in provider-schema-0.120.0.json); IaaS v2 API BaseSecurityGroupRule has no action field; stackit_security_group.stateful (default true) is a stateless option in the API and the provider that the concepts page describes only as the words can be stateful, so its availability to customers is not established; DOCUMENT CONFLICT: the security groups concepts page says rules define which traffic is allowed or denied while the FAQ says explicit deny rules cannot be created, the API and the provider schema support the FAQ","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security groups (no stateless NACLs)","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_network_acl.public","source_type":"aws_network_acl","category":"network","kind":"network_acl","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_subnet.public","module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":212,"end_line":223},"result":{"rule_id":"aws.network_acl","case_id":"nacl","class":"REDESIGN","confidence":"MEDIUM","target":{"service":"STACKIT security groups (no stateless NACLs)","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT has no stateless subnet ACLs: there is no network ACL resource, and in a Network Area access control at network level is carried out exclusively by security groups. Security groups work on an allow-list basis with default deny; a rule has a direction, protocol, port range and address range and no action and no rule number, so a deny entry of the ACL and the rule-number order that makes it win cannot be expressed. The rules of all groups are evaluated simultaneously, in no order, and the groups attached to one network interface are aggregated permissively (if one group allows traffic and another does not mention it, the traffic is allowed), so a group can add access and never take it away. A stateless security group exists in the API and the provider but is still allow-only, so it is no deny-capable ACL either. The Unified Firewall (generally available since 2026-07-07) aggregates the settings of security groups, database ACLs and public IP configurations and does not replace them; the pinned provider has no resource for it. A next-generation firewall is announced for 2026 only. Deny rules and subnet-level filtering therefore have to be re-expressed as security-group allow rules or a firewall appliance the customer runs. A network ACL is a ceiling on top of the security groups, not a grant, and the security groups attached to one STACKIT network interface are aggregated (the more permissive rule wins): a group written from the ACL's allow rules and attached to the servers would open every port the ACL allows, also where the servers' own groups do not, so the ceiling is carried only by narrowing the rules of those groups (or a firewall appliance), never by adding a group.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/unified-firewall/faq/","https://docs.stackit.cloud/release-notes/","https://docs.stackit.cloud/products/network/core-networking/security-groups/faq/","https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/unified-firewall/faq/"],"validated_against":"terraform-provider-stackit@0.116.0 (no network ACL resource); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: no such resource in the 0.120.0 schema (115 resources; since 0.116.0 only stackit_volume_automation was added); stackit_security_group_rule has no action and no rule number); read 2026-10-28 (docs.stackit.cloud, last-updated dates on the pages): the security groups FAQ (2025-11-19: groups of one network interface are aggregated and the more permissive rule wins; allow-list only, no explicit deny rule; rules are evaluated simultaneously, in no order); the Network Area concepts page (2025-12-11: access control at network level is carried out exclusively by security groups); the Unified Firewall concepts page (2026-08-20: it aggregates security groups, database ACLs and public IP configurations and does not replace the underlying mechanisms) and its FAQ (2025-12-05: a next-generation firewall is planned for 2026), GA release note 2026-07-07 (Terraform and CLI integration announced as coming soon; no Terraform resource in provider-schema-0.120.0.json); IaaS v2 API BaseSecurityGroupRule has no action field; stackit_security_group.stateful (default true) is a stateless option in the API and the provider that the concepts page describes only as the words can be stateful, so its availability to customers is not established; DOCUMENT CONFLICT: the security groups concepts page says rules define which traffic is allowed or denied while the FAQ says explicit deny rules cannot be created, the API and the provider schema support the FAQ","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security groups (no stateless NACLs)","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_network_acl.redshift","source_type":"aws_network_acl","category":"network","kind":"network_acl","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":650,"end_line":661},"result":{"rule_id":"aws.network_acl","case_id":"nacl","class":"REDESIGN","confidence":"MEDIUM","target":{"service":"STACKIT security groups (no stateless NACLs)","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active"},"reason":"STACKIT has no stateless subnet ACLs: there is no network ACL resource, and in a Network Area access control at network level is carried out exclusively by security groups. Security groups work on an allow-list basis with default deny; a rule has a direction, protocol, port range and address range and no action and no rule number, so a deny entry of the ACL and the rule-number order that makes it win cannot be expressed. The rules of all groups are evaluated simultaneously, in no order, and the groups attached to one network interface are aggregated permissively (if one group allows traffic and another does not mention it, the traffic is allowed), so a group can add access and never take it away. A stateless security group exists in the API and the provider but is still allow-only, so it is no deny-capable ACL either. The Unified Firewall (generally available since 2026-07-07) aggregates the settings of security groups, database ACLs and public IP configurations and does not replace them; the pinned provider has no resource for it. A next-generation firewall is announced for 2026 only. Deny rules and subnet-level filtering therefore have to be re-expressed as security-group allow rules or a firewall appliance the customer runs. A network ACL is a ceiling on top of the security groups, not a grant, and the security groups attached to one STACKIT network interface are aggregated (the more permissive rule wins): a group written from the ACL's allow rules and attached to the servers would open every port the ACL allows, also where the servers' own groups do not, so the ceiling is carried only by narrowing the rules of those groups (or a firewall appliance), never by adding a group.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md","https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/unified-firewall/faq/","https://docs.stackit.cloud/release-notes/","https://docs.stackit.cloud/products/network/core-networking/security-groups/faq/","https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/basics/concepts/","https://docs.stackit.cloud/products/network/network-security/unified-firewall/faq/"],"validated_against":"terraform-provider-stackit@0.116.0 (no network ACL resource); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: no such resource in the 0.120.0 schema (115 resources; since 0.116.0 only stackit_volume_automation was added); stackit_security_group_rule has no action and no rule number); read 2026-10-28 (docs.stackit.cloud, last-updated dates on the pages): the security groups FAQ (2025-11-19: groups of one network interface are aggregated and the more permissive rule wins; allow-list only, no explicit deny rule; rules are evaluated simultaneously, in no order); the Network Area concepts page (2025-12-11: access control at network level is carried out exclusively by security groups); the Unified Firewall concepts page (2026-08-20: it aggregates security groups, database ACLs and public IP configurations and does not replace the underlying mechanisms) and its FAQ (2025-12-05: a next-generation firewall is planned for 2026), GA release note 2026-07-07 (Terraform and CLI integration announced as coming soon; no Terraform resource in provider-schema-0.120.0.json); IaaS v2 API BaseSecurityGroupRule has no action field; stackit_security_group.stateful (default true) is a stateless option in the API and the provider that the concepts page describes only as the words can be stateful, so its availability to customers is not established; DOCUMENT CONFLICT: the security groups concepts page says rules define which traffic is allowed or denied while the FAQ says explicit deny rules cannot be created, the API and the provider schema support the FAQ","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT security groups (no stateless NACLs)","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_route_table.database","source_type":"aws_route_table","category":"network","kind":"route_table","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":430,"end_line":445},"result":{"rule_id":"aws.route_table","case_id":"rt-local-only","class":"MANUAL_REVIEW","confidence":"LOW","reason":"The table states no route, but a main-table association, an association outside the scan or an open route set could still make subnets follow the table or add routes to it, so the scan does not show that its subnets reach only their VPC; the case closes when the scan shows a subnet association of the table, no separate route resource that may add a route, and a closed route set, and the table is then the closed local-only case, a REDESIGN of how the outbound access of those subnets is restricted. Until then the unit is a review (no network setting is documented as a control of outbound access).","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table_route.md","docs/benchmark/probes/2026-10-10_probe16_routing-equivalence/README.md","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table","https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/route_table.html.markdown","https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-route.html","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table_association","https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-gatewayroutetableassociation.html","https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/routing-tables/","https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/data-sources/routing_table.md","https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/main_route_table_association.html.markdown","https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/route_table.html.markdown","https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","https://docs.stackit.cloud/products/network/core-networking/network-area/faq/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_routing_table requires experiment routing-tables; stackit_network no_ipv4_gateway; stackit_routing_table_route destination cidrv4 only); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_routing_table still part of the experimental feature routing-tables, stackit_routing_table_route destination (Only `cidrv4` is supported during experimental stage), stackit_network no_ipv4_gateway (the network does not have a gateway when true); schemas of the two routing resources unchanged, pages routing_table and routing_table_route re-read); terraform-provider-aws@6.66.0 route_table docs 2026-09-28; rt-route-set-route-server / rt-route-set-unmodelled-source (2026-10-08): terraform-provider-aws@6.66.0 vpc_route_server_propagation, vpc_route_server, fsx_ontap_file_system and fsx_openzfs_file_system docs (local provider-docs mirror), terraform-provider-stackit@0.118.0 schema (stackit_routing_table.dynamic_routes); rt-route-set-route-list-unread / rt-route-set-gated-propagation / rt-route-set-maybe-member (2026-10-08): terraform-provider-aws@6.66.0 route_table docs lines 120-123, vpn_gateway_route_propagation docs lines 11 and 31-32, route docs line 53, route_table_association docs line 37 (local provider-docs mirror), Terraform dynamic blocks and count documentation; rt-route-set-maybe-member narrowed to route-adding resources and rt-association-table-undecided added (KB-ROUTE-SET-3, 2026-10-08): route_table_association docs line 37, main_route_table_association docs line 31 (local provider-docs mirror), EC2 API AssociateRouteTable (docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateRouteTable.html read 2026-10-08: associates a subnet, internet gateway or virtual private gateway with a route table; no route parameter); rt-default-only, rt-default-only-nat, rt-default-only-area (2026-10-10): the test of 2026-10-10 (a STACKIT project in eu01, outside a Network Area), the area's default routing table unobserved (403); rt-default-only-open worded for an internet gateway created only when a plan runs (L2, 2026-10-27; wording only: the class and the case are unchanged; the cause is the reference not being exact, the knowledge-base input node.ref_exact, a target whose presence is not known is not pinned); rt-default-only-open narrowed (N2-2, 2026-10-27): a NAT gateway picked by an index is the NAT case, a plainly stated Gateway endpoint of S3 or DynamoDB does not hold the table (docs.stackit.cloud Virtual Network concepts, Last updated Mar 11, 2026, mirror virtual-network/basics/concepts.txt:144; the STACKIT professional-services example of Velero backups on SKE addresses Object Storage as https://object.storage.\u003cregion\u003e.onstackit.cloud; terraform-provider-stackit@0.120.0 provider-schema-0.120.0.json: 115 resources, none a private endpoint, PrivateLink or VPC endpoint, no such attribute on any; stackit_objectstorage_bucket exposes url_path_style and url_virtual_hosted_style; terraform-provider-aws@6.66.0 vpc_endpoint docs line 184 route_table_ids \"Applicable for endpoints of type Gateway\", line 193 vpc_endpoint_type defaults to Gateway); rt-local-only-closed and rt-default-only-open for a Gateway endpoint whose service name a plan decides (2026-10-31): AWS PrivateLink concepts (docs.aws.amazon.com/vpc/latest/privatelink/concepts.html, read 2026-10-31: the endpoint type Gateway \"creates a gateway endpoint to send traffic to Amazon S3 or DynamoDB\") and Gateway endpoints page (docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html, the same day: \"Gateway VPC endpoints provide reliable connectivity to Amazon S3 and DynamoDB\"; the added route has the service's prefix list as destination and the endpoint as target), terraform-provider-aws@6.66.0 vpc_endpoint docs (route_table_ids \"Applicable for endpoints of type Gateway\", vpc_endpoint_type defaults to Gateway), the rest of the evidence of rt-default-only-open N2-2; rt-local-only-closed (2026-10-27): docs.stackit.cloud Virtual Network concepts (Last updated Mar 11, 2026, mirror virtual-network/basics/concepts.txt:144: \"Every subnet is routed to the public internet\"), network-area FAQ (mirror network-area/faq.txt:146-147: disabling the internet access of a project is not supported), routing-tables page (public preview), terraform-provider-aws@6.66.0 route_table docs line 152 (the VPC-CIDR local route is created implicitly); the AWS VPC User Guide pages are cited by URL, they are not in the local mirror; rt-local-only worded for what makes it a review and what closes it (L4, 2026-10-27; wording only: the class, the confidence and the case are unchanged): terraform-provider-aws@6.66.0 main_route_table_association docs (the AWS provider documentation of main_route_table_association: the resource sets the main route table of a VPC, vpc_id and route_table_id arguments), the case rt-local-only-closed above and its evidence (Virtual Network concepts, network-area FAQ: no network setting is documented as a control of outbound access, so the earlier text offering the gateway setting as one is removed); rt-default-only-open narrowed (#320, 2026-10-28): an internet gateway created only when a plan runs that the route names by a literal key is the internet case (OpenTofu v1.13.1, local probe docs/benchmark/probes/2026-10-28_probe-conditional-igw-route: a plan that creates the route without the named instance fails, Invalid index, exit 1; terraform-provider-aws@6.66.0 route docs line 61, local provider-docs mirror: one target argument must be supplied); read 2026-10-28: the Routing tables page (last updated 2026-04-14: one default routing table per Network Area, created automatically, not deletable, followed by every routed network unless another is assigned; the feature is a public preview) and the Network Area FAQ (2025-12-12: the internet access of a project cannot be disabled); the IaaS v2 API specification (stackit-api-specifications checkout of 2026-10-13): the routing-table endpoints (iaas.network-area.rt.list, rt.get, rt.route.list) are scoped to the organisation (resource-type organization) while the project endpoints (iaas.project.get) return the area ID of a project and no routing table; provider-schema-0.120.0.json: the data sources stackit_routing_table, stackit_routing_tables and stackit_routing_table_routes require organization_id and network_area_id (stackit_routing_table also routing_table_id), stackit_network exposes routing_table_id; the role that carries the routing-table actions is not named on the roles page and the next hop of 0.0.0.0/0 in the default table is not documented anywhere read, so the question stays open","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"UNKNOWN","motion":"","change_types":[],"blocker_categories":["UNKNOWN"],"target_platform":"","confidence":"LOW"}}},{"id":"module.vpc.module.vpc.aws_route_table.elasticache","source_type":"aws_route_table","category":"network","kind":"route_table","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":747,"end_line":757},"result":{"rule_id":"aws.route_table","case_id":"rt-local-only","class":"MANUAL_REVIEW","confidence":"LOW","reason":"The table states no route, but a main-table association, an association outside the scan or an open route set could still make subnets follow the table or add routes to it, so the scan does not show that its subnets reach only their VPC; the case closes when the scan shows a subnet association of the table, no separate route resource that may add a route, and a closed route set, and the table is then the closed local-only case, a REDESIGN of how the outbound access of those subnets is restricted. Until then the unit is a review (no network setting is documented as a control of outbound access).","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table_route.md","docs/benchmark/probes/2026-10-10_probe16_routing-equivalence/README.md","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table","https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/route_table.html.markdown","https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-route.html","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table_association","https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-gatewayroutetableassociation.html","https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/routing-tables/","https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/data-sources/routing_table.md","https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/main_route_table_association.html.markdown","https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/route_table.html.markdown","https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","https://docs.stackit.cloud/products/network/core-networking/network-area/faq/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_routing_table requires experiment routing-tables; stackit_network no_ipv4_gateway; stackit_routing_table_route destination cidrv4 only); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_routing_table still part of the experimental feature routing-tables, stackit_routing_table_route destination (Only `cidrv4` is supported during experimental stage), stackit_network no_ipv4_gateway (the network does not have a gateway when true); schemas of the two routing resources unchanged, pages routing_table and routing_table_route re-read); terraform-provider-aws@6.66.0 route_table docs 2026-09-28; rt-route-set-route-server / rt-route-set-unmodelled-source (2026-10-08): terraform-provider-aws@6.66.0 vpc_route_server_propagation, vpc_route_server, fsx_ontap_file_system and fsx_openzfs_file_system docs (local provider-docs mirror), terraform-provider-stackit@0.118.0 schema (stackit_routing_table.dynamic_routes); rt-route-set-route-list-unread / rt-route-set-gated-propagation / rt-route-set-maybe-member (2026-10-08): terraform-provider-aws@6.66.0 route_table docs lines 120-123, vpn_gateway_route_propagation docs lines 11 and 31-32, route docs line 53, route_table_association docs line 37 (local provider-docs mirror), Terraform dynamic blocks and count documentation; rt-route-set-maybe-member narrowed to route-adding resources and rt-association-table-undecided added (KB-ROUTE-SET-3, 2026-10-08): route_table_association docs line 37, main_route_table_association docs line 31 (local provider-docs mirror), EC2 API AssociateRouteTable (docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateRouteTable.html read 2026-10-08: associates a subnet, internet gateway or virtual private gateway with a route table; no route parameter); rt-default-only, rt-default-only-nat, rt-default-only-area (2026-10-10): the test of 2026-10-10 (a STACKIT project in eu01, outside a Network Area), the area's default routing table unobserved (403); rt-default-only-open worded for an internet gateway created only when a plan runs (L2, 2026-10-27; wording only: the class and the case are unchanged; the cause is the reference not being exact, the knowledge-base input node.ref_exact, a target whose presence is not known is not pinned); rt-default-only-open narrowed (N2-2, 2026-10-27): a NAT gateway picked by an index is the NAT case, a plainly stated Gateway endpoint of S3 or DynamoDB does not hold the table (docs.stackit.cloud Virtual Network concepts, Last updated Mar 11, 2026, mirror virtual-network/basics/concepts.txt:144; the STACKIT professional-services example of Velero backups on SKE addresses Object Storage as https://object.storage.\u003cregion\u003e.onstackit.cloud; terraform-provider-stackit@0.120.0 provider-schema-0.120.0.json: 115 resources, none a private endpoint, PrivateLink or VPC endpoint, no such attribute on any; stackit_objectstorage_bucket exposes url_path_style and url_virtual_hosted_style; terraform-provider-aws@6.66.0 vpc_endpoint docs line 184 route_table_ids \"Applicable for endpoints of type Gateway\", line 193 vpc_endpoint_type defaults to Gateway); rt-local-only-closed and rt-default-only-open for a Gateway endpoint whose service name a plan decides (2026-10-31): AWS PrivateLink concepts (docs.aws.amazon.com/vpc/latest/privatelink/concepts.html, read 2026-10-31: the endpoint type Gateway \"creates a gateway endpoint to send traffic to Amazon S3 or DynamoDB\") and Gateway endpoints page (docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html, the same day: \"Gateway VPC endpoints provide reliable connectivity to Amazon S3 and DynamoDB\"; the added route has the service's prefix list as destination and the endpoint as target), terraform-provider-aws@6.66.0 vpc_endpoint docs (route_table_ids \"Applicable for endpoints of type Gateway\", vpc_endpoint_type defaults to Gateway), the rest of the evidence of rt-default-only-open N2-2; rt-local-only-closed (2026-10-27): docs.stackit.cloud Virtual Network concepts (Last updated Mar 11, 2026, mirror virtual-network/basics/concepts.txt:144: \"Every subnet is routed to the public internet\"), network-area FAQ (mirror network-area/faq.txt:146-147: disabling the internet access of a project is not supported), routing-tables page (public preview), terraform-provider-aws@6.66.0 route_table docs line 152 (the VPC-CIDR local route is created implicitly); the AWS VPC User Guide pages are cited by URL, they are not in the local mirror; rt-local-only worded for what makes it a review and what closes it (L4, 2026-10-27; wording only: the class, the confidence and the case are unchanged): terraform-provider-aws@6.66.0 main_route_table_association docs (the AWS provider documentation of main_route_table_association: the resource sets the main route table of a VPC, vpc_id and route_table_id arguments), the case rt-local-only-closed above and its evidence (Virtual Network concepts, network-area FAQ: no network setting is documented as a control of outbound access, so the earlier text offering the gateway setting as one is removed); rt-default-only-open narrowed (#320, 2026-10-28): an internet gateway created only when a plan runs that the route names by a literal key is the internet case (OpenTofu v1.13.1, local probe docs/benchmark/probes/2026-10-28_probe-conditional-igw-route: a plan that creates the route without the named instance fails, Invalid index, exit 1; terraform-provider-aws@6.66.0 route docs line 61, local provider-docs mirror: one target argument must be supplied); read 2026-10-28: the Routing tables page (last updated 2026-04-14: one default routing table per Network Area, created automatically, not deletable, followed by every routed network unless another is assigned; the feature is a public preview) and the Network Area FAQ (2025-12-12: the internet access of a project cannot be disabled); the IaaS v2 API specification (stackit-api-specifications checkout of 2026-10-13): the routing-table endpoints (iaas.network-area.rt.list, rt.get, rt.route.list) are scoped to the organisation (resource-type organization) while the project endpoints (iaas.project.get) return the area ID of a project and no routing table; provider-schema-0.120.0.json: the data sources stackit_routing_table, stackit_routing_tables and stackit_routing_table_routes require organization_id and network_area_id (stackit_routing_table also routing_table_id), stackit_network exposes routing_table_id; the role that carries the routing-table actions is not named on the roles page and the next hop of 0.0.0.0/0 in the default table is not documented anywhere read, so the question stays open","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"UNKNOWN","motion":"","change_types":[],"blocker_categories":["UNKNOWN"],"target_platform":"","confidence":"LOW"}}},{"id":"module.vpc.module.vpc.aws_route_table.intra","source_type":"aws_route_table","category":"network","kind":"route_table","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":866,"end_line":881},"result":{"rule_id":"aws.route_table","case_id":"rt-local-only","class":"MANUAL_REVIEW","confidence":"LOW","reason":"The table states no route, but a main-table association, an association outside the scan or an open route set could still make subnets follow the table or add routes to it, so the scan does not show that its subnets reach only their VPC; the case closes when the scan shows a subnet association of the table, no separate route resource that may add a route, and a closed route set, and the table is then the closed local-only case, a REDESIGN of how the outbound access of those subnets is restricted. Until then the unit is a review (no network setting is documented as a control of outbound access).","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table_route.md","docs/benchmark/probes/2026-10-10_probe16_routing-equivalence/README.md","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table","https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/route_table.html.markdown","https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-route.html","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table_association","https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-gatewayroutetableassociation.html","https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/routing-tables/","https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/data-sources/routing_table.md","https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/main_route_table_association.html.markdown","https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/route_table.html.markdown","https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","https://docs.stackit.cloud/products/network/core-networking/network-area/faq/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_routing_table requires experiment routing-tables; stackit_network no_ipv4_gateway; stackit_routing_table_route destination cidrv4 only); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_routing_table still part of the experimental feature routing-tables, stackit_routing_table_route destination (Only `cidrv4` is supported during experimental stage), stackit_network no_ipv4_gateway (the network does not have a gateway when true); schemas of the two routing resources unchanged, pages routing_table and routing_table_route re-read); terraform-provider-aws@6.66.0 route_table docs 2026-09-28; rt-route-set-route-server / rt-route-set-unmodelled-source (2026-10-08): terraform-provider-aws@6.66.0 vpc_route_server_propagation, vpc_route_server, fsx_ontap_file_system and fsx_openzfs_file_system docs (local provider-docs mirror), terraform-provider-stackit@0.118.0 schema (stackit_routing_table.dynamic_routes); rt-route-set-route-list-unread / rt-route-set-gated-propagation / rt-route-set-maybe-member (2026-10-08): terraform-provider-aws@6.66.0 route_table docs lines 120-123, vpn_gateway_route_propagation docs lines 11 and 31-32, route docs line 53, route_table_association docs line 37 (local provider-docs mirror), Terraform dynamic blocks and count documentation; rt-route-set-maybe-member narrowed to route-adding resources and rt-association-table-undecided added (KB-ROUTE-SET-3, 2026-10-08): route_table_association docs line 37, main_route_table_association docs line 31 (local provider-docs mirror), EC2 API AssociateRouteTable (docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateRouteTable.html read 2026-10-08: associates a subnet, internet gateway or virtual private gateway with a route table; no route parameter); rt-default-only, rt-default-only-nat, rt-default-only-area (2026-10-10): the test of 2026-10-10 (a STACKIT project in eu01, outside a Network Area), the area's default routing table unobserved (403); rt-default-only-open worded for an internet gateway created only when a plan runs (L2, 2026-10-27; wording only: the class and the case are unchanged; the cause is the reference not being exact, the knowledge-base input node.ref_exact, a target whose presence is not known is not pinned); rt-default-only-open narrowed (N2-2, 2026-10-27): a NAT gateway picked by an index is the NAT case, a plainly stated Gateway endpoint of S3 or DynamoDB does not hold the table (docs.stackit.cloud Virtual Network concepts, Last updated Mar 11, 2026, mirror virtual-network/basics/concepts.txt:144; the STACKIT professional-services example of Velero backups on SKE addresses Object Storage as https://object.storage.\u003cregion\u003e.onstackit.cloud; terraform-provider-stackit@0.120.0 provider-schema-0.120.0.json: 115 resources, none a private endpoint, PrivateLink or VPC endpoint, no such attribute on any; stackit_objectstorage_bucket exposes url_path_style and url_virtual_hosted_style; terraform-provider-aws@6.66.0 vpc_endpoint docs line 184 route_table_ids \"Applicable for endpoints of type Gateway\", line 193 vpc_endpoint_type defaults to Gateway); rt-local-only-closed and rt-default-only-open for a Gateway endpoint whose service name a plan decides (2026-10-31): AWS PrivateLink concepts (docs.aws.amazon.com/vpc/latest/privatelink/concepts.html, read 2026-10-31: the endpoint type Gateway \"creates a gateway endpoint to send traffic to Amazon S3 or DynamoDB\") and Gateway endpoints page (docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html, the same day: \"Gateway VPC endpoints provide reliable connectivity to Amazon S3 and DynamoDB\"; the added route has the service's prefix list as destination and the endpoint as target), terraform-provider-aws@6.66.0 vpc_endpoint docs (route_table_ids \"Applicable for endpoints of type Gateway\", vpc_endpoint_type defaults to Gateway), the rest of the evidence of rt-default-only-open N2-2; rt-local-only-closed (2026-10-27): docs.stackit.cloud Virtual Network concepts (Last updated Mar 11, 2026, mirror virtual-network/basics/concepts.txt:144: \"Every subnet is routed to the public internet\"), network-area FAQ (mirror network-area/faq.txt:146-147: disabling the internet access of a project is not supported), routing-tables page (public preview), terraform-provider-aws@6.66.0 route_table docs line 152 (the VPC-CIDR local route is created implicitly); the AWS VPC User Guide pages are cited by URL, they are not in the local mirror; rt-local-only worded for what makes it a review and what closes it (L4, 2026-10-27; wording only: the class, the confidence and the case are unchanged): terraform-provider-aws@6.66.0 main_route_table_association docs (the AWS provider documentation of main_route_table_association: the resource sets the main route table of a VPC, vpc_id and route_table_id arguments), the case rt-local-only-closed above and its evidence (Virtual Network concepts, network-area FAQ: no network setting is documented as a control of outbound access, so the earlier text offering the gateway setting as one is removed); rt-default-only-open narrowed (#320, 2026-10-28): an internet gateway created only when a plan runs that the route names by a literal key is the internet case (OpenTofu v1.13.1, local probe docs/benchmark/probes/2026-10-28_probe-conditional-igw-route: a plan that creates the route without the named instance fails, Invalid index, exit 1; terraform-provider-aws@6.66.0 route docs line 61, local provider-docs mirror: one target argument must be supplied); read 2026-10-28: the Routing tables page (last updated 2026-04-14: one default routing table per Network Area, created automatically, not deletable, followed by every routed network unless another is assigned; the feature is a public preview) and the Network Area FAQ (2025-12-12: the internet access of a project cannot be disabled); the IaaS v2 API specification (stackit-api-specifications checkout of 2026-10-13): the routing-table endpoints (iaas.network-area.rt.list, rt.get, rt.route.list) are scoped to the organisation (resource-type organization) while the project endpoints (iaas.project.get) return the area ID of a project and no routing table; provider-schema-0.120.0.json: the data sources stackit_routing_table, stackit_routing_tables and stackit_routing_table_routes require organization_id and network_area_id (stackit_routing_table also routing_table_id), stackit_network exposes routing_table_id; the role that carries the routing-table actions is not named on the roles page and the next hop of 0.0.0.0/0 in the default table is not documented anywhere read, so the question stays open","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"UNKNOWN","motion":"","change_types":[],"blocker_categories":["UNKNOWN"],"target_platform":"","confidence":"LOW"}}},{"id":"module.vpc.module.vpc.aws_route_table.private","source_type":"aws_route_table","category":"network","kind":"route_table","enabled":true,"instances":-1,"presence":"CONDITIONAL","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_private_subnets \u0026\u0026 local.max_subnet_length \u003e 0 ? local.nat_gateway_count : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":1},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"standing":"UNIT","module_call":"module.vpc.module.vpc","open_dependencies":["module.vpc.module.vpc.aws_subnet.private"],"facets":["module.vpc.module.vpc.aws_route.private_nat_gateway","module.vpc.module.vpc.aws_route_table_association.private"],"configuration_completeness":"CONDITIONAL","conditional_facets":[{"id":"module.vpc.module.vpc.aws_route_table_association.private","source_type":"aws_route_table_association","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_private_subnets ? local.len_private_subnets : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":3},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}}}],"depends_on":["module.vpc.module.vpc.aws_nat_gateway.this","module.vpc.module.vpc.aws_subnet.private","module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":296,"end_line":311},"result":{"rule_id":"aws.route_table","case_id":"rt-default-only-nat","class":"RECONFIGURE","confidence":"LOW","target":{"service":"implicit (STACKIT network default routing)","maturity":"ga"},"reason":"A route of the table sends traffic to a NAT gateway (the others, if any, to an internet gateway), and the draft's project is outside a Network Area. Observed on the target (tested on a STACKIT project in eu01 on 2026-10-10, a project outside a Network Area): a routed STACKIT network gives servers with and without a public IP the same outbound reachability with no route and no routing table, nothing initiated from the internet reaches a server behind the network address, and egress is restricted by the egress rules of security groups. The table is therefore not drafted: STACKIT's default routing replaces it. What a NAT gateway has beyond an internet route is NOT CARRIED and stays an open review: the gateway's fixed egress address is LOST (observed: the address a routed network leaves by is its project's publicIp, one address for every routed network of the project, not fixed - it changed after every network of the project was deleted, twice - and not settable, a PATCH answers 202 and is ignored), so a third party's allow-list on the NAT gateway's address does not survive and needs a STACKIT public IP per server (the only address the probe saw stay fixed); the restriction of egress to the gateway is carried only by security-group egress rules, which the draft does not tie to this table; the absence of an inbound path is observed. LOW: the loss is for a person to decide, as the plan decision NAT_FIXED_EGRESS_ADDRESS_LOST. The egress itself is not widened where the gateway is a public one: the subnets of this table reached the internet through it in the source, so the plan decision EXPOSURE_WIDENED_EGRESS (a subnet whose source had no route to the internet; a subnet behind a private NAT gateway is one, a private gateway gives no internet access) is not what this table raises; what changes is the address. STACKIT documents the way out as source NAT of the network (Virtual Network concepts, last updated Mar 11, 2026). Which NAT gateway the route names does not change this: a table that picks its NAT gateway by an index (one gateway per availability zone) or by a conditional between NAT gateways is decided as a table with one plain reference, because every gateway it can name is lost the same way and STACKIT has no NAT gateway to pick. A Gateway endpoint of S3 or DynamoDB that names the table adds a route that is NOT CARRIED (Object Storage is reached over the network's default path); it does not change the case, a check on the gateway endpoint names it. The destinations are read by the check of the route destinations. (Whether deps[3] (module.vpc.module.vpc.aws_route_table_association.private's count/for_each is not known statically (it may not exist)) exist was evaluated for each possibility; the mapping decides the same either way.)","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table_route.md","docs/benchmark/probes/2026-10-10_probe16_routing-equivalence/README.md","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table","https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/route_table.html.markdown","https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-route.html","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table_association","https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-gatewayroutetableassociation.html","https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/routing-tables/","https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/data-sources/routing_table.md","docs/benchmark/probes/2026-10-10_probe16_routing-equivalence/README.md","https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_routing_table requires experiment routing-tables; stackit_network no_ipv4_gateway; stackit_routing_table_route destination cidrv4 only); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_routing_table still part of the experimental feature routing-tables, stackit_routing_table_route destination (Only `cidrv4` is supported during experimental stage), stackit_network no_ipv4_gateway (the network does not have a gateway when true); schemas of the two routing resources unchanged, pages routing_table and routing_table_route re-read); terraform-provider-aws@6.66.0 route_table docs 2026-09-28; rt-route-set-route-server / rt-route-set-unmodelled-source (2026-10-08): terraform-provider-aws@6.66.0 vpc_route_server_propagation, vpc_route_server, fsx_ontap_file_system and fsx_openzfs_file_system docs (local provider-docs mirror), terraform-provider-stackit@0.118.0 schema (stackit_routing_table.dynamic_routes); rt-route-set-route-list-unread / rt-route-set-gated-propagation / rt-route-set-maybe-member (2026-10-08): terraform-provider-aws@6.66.0 route_table docs lines 120-123, vpn_gateway_route_propagation docs lines 11 and 31-32, route docs line 53, route_table_association docs line 37 (local provider-docs mirror), Terraform dynamic blocks and count documentation; rt-route-set-maybe-member narrowed to route-adding resources and rt-association-table-undecided added (KB-ROUTE-SET-3, 2026-10-08): route_table_association docs line 37, main_route_table_association docs line 31 (local provider-docs mirror), EC2 API AssociateRouteTable (docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateRouteTable.html read 2026-10-08: associates a subnet, internet gateway or virtual private gateway with a route table; no route parameter); rt-default-only, rt-default-only-nat, rt-default-only-area (2026-10-10): the test of 2026-10-10 (a STACKIT project in eu01, outside a Network Area), the area's default routing table unobserved (403); rt-default-only-open worded for an internet gateway created only when a plan runs (L2, 2026-10-27; wording only: the class and the case are unchanged; the cause is the reference not being exact, the knowledge-base input node.ref_exact, a target whose presence is not known is not pinned); rt-default-only-open narrowed (N2-2, 2026-10-27): a NAT gateway picked by an index is the NAT case, a plainly stated Gateway endpoint of S3 or DynamoDB does not hold the table (docs.stackit.cloud Virtual Network concepts, Last updated Mar 11, 2026, mirror virtual-network/basics/concepts.txt:144; the STACKIT professional-services example of Velero backups on SKE addresses Object Storage as https://object.storage.\u003cregion\u003e.onstackit.cloud; terraform-provider-stackit@0.120.0 provider-schema-0.120.0.json: 115 resources, none a private endpoint, PrivateLink or VPC endpoint, no such attribute on any; stackit_objectstorage_bucket exposes url_path_style and url_virtual_hosted_style; terraform-provider-aws@6.66.0 vpc_endpoint docs line 184 route_table_ids \"Applicable for endpoints of type Gateway\", line 193 vpc_endpoint_type defaults to Gateway); rt-local-only-closed and rt-default-only-open for a Gateway endpoint whose service name a plan decides (2026-10-31): AWS PrivateLink concepts (docs.aws.amazon.com/vpc/latest/privatelink/concepts.html, read 2026-10-31: the endpoint type Gateway \"creates a gateway endpoint to send traffic to Amazon S3 or DynamoDB\") and Gateway endpoints page (docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html, the same day: \"Gateway VPC endpoints provide reliable connectivity to Amazon S3 and DynamoDB\"; the added route has the service's prefix list as destination and the endpoint as target), terraform-provider-aws@6.66.0 vpc_endpoint docs (route_table_ids \"Applicable for endpoints of type Gateway\", vpc_endpoint_type defaults to Gateway), the rest of the evidence of rt-default-only-open N2-2; rt-local-only-closed (2026-10-27): docs.stackit.cloud Virtual Network concepts (Last updated Mar 11, 2026, mirror virtual-network/basics/concepts.txt:144: \"Every subnet is routed to the public internet\"), network-area FAQ (mirror network-area/faq.txt:146-147: disabling the internet access of a project is not supported), routing-tables page (public preview), terraform-provider-aws@6.66.0 route_table docs line 152 (the VPC-CIDR local route is created implicitly); the AWS VPC User Guide pages are cited by URL, they are not in the local mirror; rt-local-only worded for what makes it a review and what closes it (L4, 2026-10-27; wording only: the class, the confidence and the case are unchanged): terraform-provider-aws@6.66.0 main_route_table_association docs (the AWS provider documentation of main_route_table_association: the resource sets the main route table of a VPC, vpc_id and route_table_id arguments), the case rt-local-only-closed above and its evidence (Virtual Network concepts, network-area FAQ: no network setting is documented as a control of outbound access, so the earlier text offering the gateway setting as one is removed); rt-default-only-open narrowed (#320, 2026-10-28): an internet gateway created only when a plan runs that the route names by a literal key is the internet case (OpenTofu v1.13.1, local probe docs/benchmark/probes/2026-10-28_probe-conditional-igw-route: a plan that creates the route without the named instance fails, Invalid index, exit 1; terraform-provider-aws@6.66.0 route docs line 61, local provider-docs mirror: one target argument must be supplied); read 2026-10-28: the Routing tables page (last updated 2026-04-14: one default routing table per Network Area, created automatically, not deletable, followed by every routed network unless another is assigned; the feature is a public preview) and the Network Area FAQ (2025-12-12: the internet access of a project cannot be disabled); the IaaS v2 API specification (stackit-api-specifications checkout of 2026-10-13): the routing-table endpoints (iaas.network-area.rt.list, rt.get, rt.route.list) are scoped to the organisation (resource-type organization) while the project endpoints (iaas.project.get) return the area ID of a project and no routing table; provider-schema-0.120.0.json: the data sources stackit_routing_table, stackit_routing_tables and stackit_routing_table_routes require organization_id and network_area_id (stackit_routing_table also routing_table_id), stackit_network exposes routing_table_id; the role that carries the routing-table actions is not named on the roles page and the next hop of 0.0.0.0/0 in the default table is not documented anywhere read, so the question stays open","findings":[{"check_id":"topology-route-table-not-drafted","severity":"warning","message":"This route table is created with count or for_each. What the draft makes of it follows the decision of this unit. A table that STACKIT's default routing replaces (the cases of a table with only internet or NAT routes in a project outside a Network Area) is not drafted at all, whatever its count: no routing table is made and none is to be attached, and this warning only records that the table is repeated. A table the decision keeps as a routing table of its own (rt-custom) is made only where the source names, instance by instance, which route and which subnet belongs to which instance (a table created with count whose routes and associations name the table by their own count.index): one routing table for each instance, with the routes the draft carries in each, attached to no network, and none at all when the draft carries none of the routes. Where the source does not name them, the draft makes none (which instance a route belongs to is not decided). For a table the decision keeps, nothing in the draft states which VPC the table belonged to (the routing table the draft writes, stackit_routing_table, belongs to a Network Area; the experimental stackit_vpc_routing_table of the pinned provider takes a vpc_id, but the draft writes none): the table, its routes and the subnets it is associated with are re-created or attached by hand once the VPC architecture is decided.","evidence":["https://docs.stackit.cloud/products/network/core-networking/network-area/basics/routing-tables/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table.md"],"blocker_category":"NETWORK"},{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this route table names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"rt-private-subnet-association","severity":"warning","message":"A subnet uses a route table whose default route goes through a NAT gateway — a private subnet in AWS. STACKIT networks have no public/private split: a server there is reachable as soon as it gets a public IP, only its security group restricts it. Keep the converted servers without a public IP (or restrict them) where privacy is needed.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/public_ip.md","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table"],"blocker_category":"NETWORK"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"coverage":"UNKNOWN_RUNTIME_TOPOLOGY","semantics":{"contract":"aws.route_table","expected":37,"observed":11,"accounted":11,"unaccounted":0,"critical_unaccounted":[],"critical_open":["routes","route-destinations","route-targets","nat-fixed-egress-address","egress-restriction","subnet-association-target","tcr-route-table-vpc-id","network-topology-boundary"],"items":[{"id":"routes","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rt-default-only-nat","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"route-destinations","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rt-default-only-nat","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"route-targets","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rt-default-only-nat","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"route-drafted","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"route-drafted-inline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-routes-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-route-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-route-destination","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-route-gateway-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpn-propagation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpn-propagation-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nat-fixed-egress-address","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rt-default-only-nat","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"egress-restriction","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rt-default-only-nat","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"inbound-none","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:rt-default-only-nat"},{"id":"route-set-completeness","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:rt-default-only-nat"},{"id":"associations","critical":false,"observed":"yes","disposition":"REVIEW","by":"case:rt-default-only-nat"},{"id":"association-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subnet-association-target","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:rt-private-subnet-association","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"association-drafted","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"main-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"main-association-drafted","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"edge-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-route-table-vpc-id","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"tcp-route-destination-cidr-block","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-destination-ipv6-cidr-block","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-carrier-gateway-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-destination-prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-egress-only-gateway-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-local-gateway-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-network-interface-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-transit-gateway-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-vpc-endpoint-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-vpc-peering-connection-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-ip-pool-route-table-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-route-server-propagation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"implicit (STACKIT network default routing)","confidence":"LOW"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"critical":[{"node":"module.vpc.module.vpc.aws_route_table.private","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.route_table/tcr-route-table-vpc-id:REVIEW"},{"node":"module.vpc.module.vpc.aws_route.private_nat_gateway","attribute":"destination_cidr_block","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.route_table/route-destinations:REVIEW"},{"node":"module.vpc.module.vpc.aws_route.private_nat_gateway","attribute":"nat_gateway_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.route_table/egress-restriction:REVIEW"},{"node":"module.vpc.module.vpc.aws_route_table_association.private","attribute":"subnet_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.route_table/subnet-association-target:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["egress-restriction","nat-fixed-egress-address","network-topology-boundary"],"gate_blockers":[{"source_type":"aws_route","attribute":"destination_cidr_block","closure":"CLOSED:REVIEW"},{"source_type":"aws_route","attribute":"nat_gateway_id","closure":"CLOSED:REVIEW"},{"source_type":"aws_route_table","attribute":"vpc_id","closure":"CLOSED:REVIEW"},{"source_type":"aws_route_table_association","attribute":"subnet_id","closure":"CLOSED:REVIEW"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"source_type":"aws_route_table","closure":"TOPOLOGY:unknown"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"egress-restriction","closure":"open-critical-without-read-set"},{"semantic":"nat-fixed-egress-address","closure":"open-critical-without-read-set"}],"implicit":true}},{"id":"module.vpc.module.vpc.aws_route_table.public","source_type":"aws_route_table","category":"network","kind":"route_table","enabled":true,"instances":-1,"presence":"CONDITIONAL","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_public_subnets ? local.num_public_route_tables : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":1},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"standing":"UNIT","module_call":"module.vpc.module.vpc","open_dependencies":["module.vpc.module.vpc.aws_internet_gateway.this","module.vpc.module.vpc.aws_subnet.public"],"facets":["module.vpc.module.vpc.aws_route.public_internet_gateway","module.vpc.module.vpc.aws_route_table_association.public"],"configuration_completeness":"CONDITIONAL","conditional_facets":[{"id":"module.vpc.module.vpc.aws_route.public_internet_gateway","source_type":"aws_route","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_public_subnets \u0026\u0026 var.create_igw ? local.num_public_route_tables : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":1},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}}},{"id":"module.vpc.module.vpc.aws_route_table_association.public","source_type":"aws_route_table_association","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_public_subnets ? local.len_public_subnets : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":3},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}}}],"depends_on":["module.vpc.module.vpc.aws_internet_gateway.this","module.vpc.module.vpc.aws_subnet.public","module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":164,"end_line":179},"result":{"rule_id":"aws.route_table","case_id":"rt-default-only","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"implicit (STACKIT network default routing)","maturity":"ga"},"reason":"Every route of the table sends traffic to an internet gateway (a reference to an aws_internet_gateway, or an ID that is not a virtual private gateway's) and the draft's project is outside a Network Area. Observed on the target (tested on a STACKIT project in eu01 on 2026-10-10, a project outside a Network Area): a routed STACKIT network gives servers with and without a public IP the same outbound reachability with no route and no routing table configured (HTTPS, ICMP, DNS and TCP 443 in 62 of 62 rounds over 30 minutes per server; a non-routed network reaches nothing), nothing initiated from the internet reaches a server behind the network address (tcp 22, 80, 8080 timed out in 137 of 137 samples with an admitting security group), egress is restricted by the egress rules of security groups, and routed networks reach each other with no table. The table is therefore not drafted: STACKIT's default routing replaces it. Equivalent for a server that has a public IP. NOT equivalent for a server WITHOUT one: in the source an internet gateway serves only an instance with a public IPv4 or Elastic IP address (\"the instances in the public subnet must have public IP addresses or Elastic IP addresses to enable communication with the internet over the internet gateway\", AWS internet gateway documentation), so such an instance has no internet path; on STACKIT the same server leaves through the SNAT address of its network (observed in the STACKIT sandbox on two rounds; \"VM without one: the SNAT address of its network, shared by every VM in that network without its own public IP\", stackitcloud/professional-service examples/vpn-full-tunnel-central-egress README). The draft therefore GIVES egress to servers the source did not give it; the table does not carry that, and it is decided on the subnet (the finding that the egress of the subnet is not proven, and the plan decision EXPOSURE_WIDENED_EGRESS of the subnet, private egress ipv4), not here. What the STACKIT documentation says of the same behaviour (Virtual Network concepts, last updated Mar 11, 2026, read 2026-10-27): \"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading\", it \"supports outbound internet access but does not allow traffic initiated from the public internet to reach your resources\", and the routing \"can be controlled using Routing tables\" only for projects that are part of a Network Area. So outside an area the equivalence rests on the documentation and on the test of 2026-10-10, which agree. Not HIGH: the test was one project, one region, one day, no probe in a Network Area (a draft that writes a Network Area is the case of a table in a Network Area), and the servers without a public IP are not equivalent (above). The destinations are read by the check of the route destinations: only 0.0.0.0/0 is default routing, any other destination (IPv6 included) is REVIEW. A Gateway endpoint of S3 or DynamoDB that names the table adds a route that is NOT CARRIED and does not change the case. (Whether deps[2] (module.vpc.module.vpc.aws_route.public_internet_gateway's count/for_each is not known statically (it may not exist)); deps[3] (module.vpc.module.vpc.aws_route_table_association.public's count/for_each is not known statically (it may not exist)) exist was evaluated for each possibility; the mapping decides the same either way.)","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table_route.md","docs/benchmark/probes/2026-10-10_probe16_routing-equivalence/README.md","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table","https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/route_table.html.markdown","https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-route.html","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table_association","https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-gatewayroutetableassociation.html","https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/routing-tables/","https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/data-sources/routing_table.md","docs/benchmark/probes/2026-10-10_probe16_routing-equivalence/README.md","https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html","https://github.com/stackitcloud/professional-service/blob/main/examples/vpn-full-tunnel-central-egress/README.md"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_routing_table requires experiment routing-tables; stackit_network no_ipv4_gateway; stackit_routing_table_route destination cidrv4 only); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_routing_table still part of the experimental feature routing-tables, stackit_routing_table_route destination (Only `cidrv4` is supported during experimental stage), stackit_network no_ipv4_gateway (the network does not have a gateway when true); schemas of the two routing resources unchanged, pages routing_table and routing_table_route re-read); terraform-provider-aws@6.66.0 route_table docs 2026-09-28; rt-route-set-route-server / rt-route-set-unmodelled-source (2026-10-08): terraform-provider-aws@6.66.0 vpc_route_server_propagation, vpc_route_server, fsx_ontap_file_system and fsx_openzfs_file_system docs (local provider-docs mirror), terraform-provider-stackit@0.118.0 schema (stackit_routing_table.dynamic_routes); rt-route-set-route-list-unread / rt-route-set-gated-propagation / rt-route-set-maybe-member (2026-10-08): terraform-provider-aws@6.66.0 route_table docs lines 120-123, vpn_gateway_route_propagation docs lines 11 and 31-32, route docs line 53, route_table_association docs line 37 (local provider-docs mirror), Terraform dynamic blocks and count documentation; rt-route-set-maybe-member narrowed to route-adding resources and rt-association-table-undecided added (KB-ROUTE-SET-3, 2026-10-08): route_table_association docs line 37, main_route_table_association docs line 31 (local provider-docs mirror), EC2 API AssociateRouteTable (docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateRouteTable.html read 2026-10-08: associates a subnet, internet gateway or virtual private gateway with a route table; no route parameter); rt-default-only, rt-default-only-nat, rt-default-only-area (2026-10-10): the test of 2026-10-10 (a STACKIT project in eu01, outside a Network Area), the area's default routing table unobserved (403); rt-default-only-open worded for an internet gateway created only when a plan runs (L2, 2026-10-27; wording only: the class and the case are unchanged; the cause is the reference not being exact, the knowledge-base input node.ref_exact, a target whose presence is not known is not pinned); rt-default-only-open narrowed (N2-2, 2026-10-27): a NAT gateway picked by an index is the NAT case, a plainly stated Gateway endpoint of S3 or DynamoDB does not hold the table (docs.stackit.cloud Virtual Network concepts, Last updated Mar 11, 2026, mirror virtual-network/basics/concepts.txt:144; the STACKIT professional-services example of Velero backups on SKE addresses Object Storage as https://object.storage.\u003cregion\u003e.onstackit.cloud; terraform-provider-stackit@0.120.0 provider-schema-0.120.0.json: 115 resources, none a private endpoint, PrivateLink or VPC endpoint, no such attribute on any; stackit_objectstorage_bucket exposes url_path_style and url_virtual_hosted_style; terraform-provider-aws@6.66.0 vpc_endpoint docs line 184 route_table_ids \"Applicable for endpoints of type Gateway\", line 193 vpc_endpoint_type defaults to Gateway); rt-local-only-closed and rt-default-only-open for a Gateway endpoint whose service name a plan decides (2026-10-31): AWS PrivateLink concepts (docs.aws.amazon.com/vpc/latest/privatelink/concepts.html, read 2026-10-31: the endpoint type Gateway \"creates a gateway endpoint to send traffic to Amazon S3 or DynamoDB\") and Gateway endpoints page (docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html, the same day: \"Gateway VPC endpoints provide reliable connectivity to Amazon S3 and DynamoDB\"; the added route has the service's prefix list as destination and the endpoint as target), terraform-provider-aws@6.66.0 vpc_endpoint docs (route_table_ids \"Applicable for endpoints of type Gateway\", vpc_endpoint_type defaults to Gateway), the rest of the evidence of rt-default-only-open N2-2; rt-local-only-closed (2026-10-27): docs.stackit.cloud Virtual Network concepts (Last updated Mar 11, 2026, mirror virtual-network/basics/concepts.txt:144: \"Every subnet is routed to the public internet\"), network-area FAQ (mirror network-area/faq.txt:146-147: disabling the internet access of a project is not supported), routing-tables page (public preview), terraform-provider-aws@6.66.0 route_table docs line 152 (the VPC-CIDR local route is created implicitly); the AWS VPC User Guide pages are cited by URL, they are not in the local mirror; rt-local-only worded for what makes it a review and what closes it (L4, 2026-10-27; wording only: the class, the confidence and the case are unchanged): terraform-provider-aws@6.66.0 main_route_table_association docs (the AWS provider documentation of main_route_table_association: the resource sets the main route table of a VPC, vpc_id and route_table_id arguments), the case rt-local-only-closed above and its evidence (Virtual Network concepts, network-area FAQ: no network setting is documented as a control of outbound access, so the earlier text offering the gateway setting as one is removed); rt-default-only-open narrowed (#320, 2026-10-28): an internet gateway created only when a plan runs that the route names by a literal key is the internet case (OpenTofu v1.13.1, local probe docs/benchmark/probes/2026-10-28_probe-conditional-igw-route: a plan that creates the route without the named instance fails, Invalid index, exit 1; terraform-provider-aws@6.66.0 route docs line 61, local provider-docs mirror: one target argument must be supplied); read 2026-10-28: the Routing tables page (last updated 2026-04-14: one default routing table per Network Area, created automatically, not deletable, followed by every routed network unless another is assigned; the feature is a public preview) and the Network Area FAQ (2025-12-12: the internet access of a project cannot be disabled); the IaaS v2 API specification (stackit-api-specifications checkout of 2026-10-13): the routing-table endpoints (iaas.network-area.rt.list, rt.get, rt.route.list) are scoped to the organisation (resource-type organization) while the project endpoints (iaas.project.get) return the area ID of a project and no routing table; provider-schema-0.120.0.json: the data sources stackit_routing_table, stackit_routing_tables and stackit_routing_table_routes require organization_id and network_area_id (stackit_routing_table also routing_table_id), stackit_network exposes routing_table_id; the role that carries the routing-table actions is not named on the roles page and the next hop of 0.0.0.0/0 in the default table is not documented anywhere read, so the question stays open","findings":[{"check_id":"topology-route-table-not-drafted","severity":"warning","message":"This route table is created with count or for_each. What the draft makes of it follows the decision of this unit. A table that STACKIT's default routing replaces (the cases of a table with only internet or NAT routes in a project outside a Network Area) is not drafted at all, whatever its count: no routing table is made and none is to be attached, and this warning only records that the table is repeated. A table the decision keeps as a routing table of its own (rt-custom) is made only where the source names, instance by instance, which route and which subnet belongs to which instance (a table created with count whose routes and associations name the table by their own count.index): one routing table for each instance, with the routes the draft carries in each, attached to no network, and none at all when the draft carries none of the routes. Where the source does not name them, the draft makes none (which instance a route belongs to is not decided). For a table the decision keeps, nothing in the draft states which VPC the table belonged to (the routing table the draft writes, stackit_routing_table, belongs to a Network Area; the experimental stackit_vpc_routing_table of the pinned provider takes a vpc_id, but the draft writes none): the table, its routes and the subnets it is associated with are re-created or attached by hand once the VPC architecture is decided.","evidence":["https://docs.stackit.cloud/products/network/core-networking/network-area/basics/routing-tables/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table.md"],"blocker_category":"NETWORK"},{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this route table names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"coverage":"UNKNOWN_RUNTIME_TOPOLOGY","semantics":{"contract":"aws.route_table","expected":37,"observed":8,"accounted":8,"unaccounted":0,"critical_unaccounted":[],"critical_open":["routes","route-destinations","route-targets","tcr-route-table-vpc-id","network-topology-boundary"],"items":[{"id":"routes","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rt-default-only","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"route-destinations","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rt-default-only","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"route-targets","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:rt-default-only","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"route-drafted","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"route-drafted-inline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inline-routes-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-route-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-route-destination","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"standalone-route-gateway-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpn-propagation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpn-propagation-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nat-fixed-egress-address","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"egress-restriction","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"inbound-none","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"route-set-completeness","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:rt-default-only"},{"id":"associations","critical":false,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:rt-default-only"},{"id":"association-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subnet-association-target","critical":true,"observed":"yes","disposition":"NOT_APPLICABLE","by":"case:rt-default-only"},{"id":"association-drafted","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"main-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"main-association-drafted","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"edge-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-route-table-vpc-id","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"tcp-route-destination-cidr-block","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-destination-ipv6-cidr-block","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-carrier-gateway-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-destination-prefix-list-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-egress-only-gateway-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-local-gateway-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-network-interface-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-transit-gateway-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-vpc-endpoint-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-route-vpc-peering-connection-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-ip-pool-route-table-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-route-server-propagation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"implicit (STACKIT network default routing)","confidence":"MEDIUM"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"critical":[{"node":"module.vpc.module.vpc.aws_route_table.public","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.route_table/tcr-route-table-vpc-id:REVIEW"},{"node":"module.vpc.module.vpc.aws_route.public_internet_gateway","attribute":"destination_cidr_block","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.route_table/route-destinations:REVIEW"},{"node":"module.vpc.module.vpc.aws_route.public_internet_gateway","attribute":"gateway_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.route_table/route-targets:REVIEW"},{"node":"module.vpc.module.vpc.aws_route_table_association.public","attribute":"subnet_id","class":"CRITICAL","category":"network-exposure","closure":"OPEN:not-applicable","by":"aws.route_table/subnet-association-target:NOT_APPLICABLE"}],"automation_eligible":false,"open_critical_without_read_set":["network-topology-boundary"],"gate_blockers":[{"source_type":"aws_route","attribute":"destination_cidr_block","closure":"CLOSED:REVIEW"},{"source_type":"aws_route","attribute":"gateway_id","closure":"CLOSED:REVIEW"},{"source_type":"aws_route_table","attribute":"vpc_id","closure":"CLOSED:REVIEW"},{"source_type":"aws_route_table_association","attribute":"subnet_id","closure":"OPEN:not-applicable"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"source_type":"aws_route_table","closure":"TOPOLOGY:unknown"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"}],"implicit":true}},{"id":"module.vpc.module.vpc.aws_route_table.redshift","source_type":"aws_route_table","category":"network","kind":"route_table","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":610,"end_line":620},"result":{"rule_id":"aws.route_table","case_id":"rt-local-only","class":"MANUAL_REVIEW","confidence":"LOW","reason":"The table states no route, but a main-table association, an association outside the scan or an open route set could still make subnets follow the table or add routes to it, so the scan does not show that its subnets reach only their VPC; the case closes when the scan shows a subnet association of the table, no separate route resource that may add a route, and a closed route set, and the table is then the closed local-only case, a REDESIGN of how the outbound access of those subnets is restricted. Until then the unit is a review (no network setting is documented as a control of outbound access).","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table.md","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table_route.md","docs/benchmark/probes/2026-10-10_probe16_routing-equivalence/README.md","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table","https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/route_table.html.markdown","https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-route.html","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table_association","https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-gatewayroutetableassociation.html","https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/routing-tables/","https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/data-sources/routing_table.md","https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/main_route_table_association.html.markdown","https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/route_table.html.markdown","https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","https://docs.stackit.cloud/products/network/core-networking/network-area/faq/"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_routing_table requires experiment routing-tables; stackit_network no_ipv4_gateway; stackit_routing_table_route destination cidrv4 only); terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_routing_table still part of the experimental feature routing-tables, stackit_routing_table_route destination (Only `cidrv4` is supported during experimental stage), stackit_network no_ipv4_gateway (the network does not have a gateway when true); schemas of the two routing resources unchanged, pages routing_table and routing_table_route re-read); terraform-provider-aws@6.66.0 route_table docs 2026-09-28; rt-route-set-route-server / rt-route-set-unmodelled-source (2026-10-08): terraform-provider-aws@6.66.0 vpc_route_server_propagation, vpc_route_server, fsx_ontap_file_system and fsx_openzfs_file_system docs (local provider-docs mirror), terraform-provider-stackit@0.118.0 schema (stackit_routing_table.dynamic_routes); rt-route-set-route-list-unread / rt-route-set-gated-propagation / rt-route-set-maybe-member (2026-10-08): terraform-provider-aws@6.66.0 route_table docs lines 120-123, vpn_gateway_route_propagation docs lines 11 and 31-32, route docs line 53, route_table_association docs line 37 (local provider-docs mirror), Terraform dynamic blocks and count documentation; rt-route-set-maybe-member narrowed to route-adding resources and rt-association-table-undecided added (KB-ROUTE-SET-3, 2026-10-08): route_table_association docs line 37, main_route_table_association docs line 31 (local provider-docs mirror), EC2 API AssociateRouteTable (docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateRouteTable.html read 2026-10-08: associates a subnet, internet gateway or virtual private gateway with a route table; no route parameter); rt-default-only, rt-default-only-nat, rt-default-only-area (2026-10-10): the test of 2026-10-10 (a STACKIT project in eu01, outside a Network Area), the area's default routing table unobserved (403); rt-default-only-open worded for an internet gateway created only when a plan runs (L2, 2026-10-27; wording only: the class and the case are unchanged; the cause is the reference not being exact, the knowledge-base input node.ref_exact, a target whose presence is not known is not pinned); rt-default-only-open narrowed (N2-2, 2026-10-27): a NAT gateway picked by an index is the NAT case, a plainly stated Gateway endpoint of S3 or DynamoDB does not hold the table (docs.stackit.cloud Virtual Network concepts, Last updated Mar 11, 2026, mirror virtual-network/basics/concepts.txt:144; the STACKIT professional-services example of Velero backups on SKE addresses Object Storage as https://object.storage.\u003cregion\u003e.onstackit.cloud; terraform-provider-stackit@0.120.0 provider-schema-0.120.0.json: 115 resources, none a private endpoint, PrivateLink or VPC endpoint, no such attribute on any; stackit_objectstorage_bucket exposes url_path_style and url_virtual_hosted_style; terraform-provider-aws@6.66.0 vpc_endpoint docs line 184 route_table_ids \"Applicable for endpoints of type Gateway\", line 193 vpc_endpoint_type defaults to Gateway); rt-local-only-closed and rt-default-only-open for a Gateway endpoint whose service name a plan decides (2026-10-31): AWS PrivateLink concepts (docs.aws.amazon.com/vpc/latest/privatelink/concepts.html, read 2026-10-31: the endpoint type Gateway \"creates a gateway endpoint to send traffic to Amazon S3 or DynamoDB\") and Gateway endpoints page (docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html, the same day: \"Gateway VPC endpoints provide reliable connectivity to Amazon S3 and DynamoDB\"; the added route has the service's prefix list as destination and the endpoint as target), terraform-provider-aws@6.66.0 vpc_endpoint docs (route_table_ids \"Applicable for endpoints of type Gateway\", vpc_endpoint_type defaults to Gateway), the rest of the evidence of rt-default-only-open N2-2; rt-local-only-closed (2026-10-27): docs.stackit.cloud Virtual Network concepts (Last updated Mar 11, 2026, mirror virtual-network/basics/concepts.txt:144: \"Every subnet is routed to the public internet\"), network-area FAQ (mirror network-area/faq.txt:146-147: disabling the internet access of a project is not supported), routing-tables page (public preview), terraform-provider-aws@6.66.0 route_table docs line 152 (the VPC-CIDR local route is created implicitly); the AWS VPC User Guide pages are cited by URL, they are not in the local mirror; rt-local-only worded for what makes it a review and what closes it (L4, 2026-10-27; wording only: the class, the confidence and the case are unchanged): terraform-provider-aws@6.66.0 main_route_table_association docs (the AWS provider documentation of main_route_table_association: the resource sets the main route table of a VPC, vpc_id and route_table_id arguments), the case rt-local-only-closed above and its evidence (Virtual Network concepts, network-area FAQ: no network setting is documented as a control of outbound access, so the earlier text offering the gateway setting as one is removed); rt-default-only-open narrowed (#320, 2026-10-28): an internet gateway created only when a plan runs that the route names by a literal key is the internet case (OpenTofu v1.13.1, local probe docs/benchmark/probes/2026-10-28_probe-conditional-igw-route: a plan that creates the route without the named instance fails, Invalid index, exit 1; terraform-provider-aws@6.66.0 route docs line 61, local provider-docs mirror: one target argument must be supplied); read 2026-10-28: the Routing tables page (last updated 2026-04-14: one default routing table per Network Area, created automatically, not deletable, followed by every routed network unless another is assigned; the feature is a public preview) and the Network Area FAQ (2025-12-12: the internet access of a project cannot be disabled); the IaaS v2 API specification (stackit-api-specifications checkout of 2026-10-13): the routing-table endpoints (iaas.network-area.rt.list, rt.get, rt.route.list) are scoped to the organisation (resource-type organization) while the project endpoints (iaas.project.get) return the area ID of a project and no routing table; provider-schema-0.120.0.json: the data sources stackit_routing_table, stackit_routing_tables and stackit_routing_table_routes require organization_id and network_area_id (stackit_routing_table also routing_table_id), stackit_network exposes routing_table_id; the role that carries the routing-table actions is not named on the roles page and the next hop of 0.0.0.0/0 in the default table is not documented anywhere read, so the question stays open","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"UNKNOWN","motion":"","change_types":[],"blocker_categories":["UNKNOWN"],"target_platform":"","confidence":"LOW"}}},{"id":"module.vpc.module.vpc.aws_subnet.database","source_type":"aws_subnet","category":"network","kind":"subnet","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":387,"end_line":412},"result":{"rule_id":"aws.subnet","case_id":"subnet","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT network","resources":["stackit_network"],"maturity":"ga","lifecycle":"active"},"reason":"A subnet becomes a stackit_network with the same IPv4 prefix. Public vs private is not a subnet property on STACKIT: servers get public IPs explicitly, and a network can be created without a default gateway.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/network.md"],"validated_against":"terraform-provider-stackit@0.116.0; terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_network re-read, stackit_network attributes unchanged from 0.116.0 (its block description lost the transitional ipv4_nameservers behaviour warning; the attribute description keeps the behaviour); no destroy-protection, DNS64, hostname or per-server record attribute in stackit_network or stackit_server (both unchanged); stackit_public_ip and stackit_dns_record_set unchanged)","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT network","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_subnet.elasticache","source_type":"aws_subnet","category":"network","kind":"subnet","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":706,"end_line":731},"result":{"rule_id":"aws.subnet","case_id":"subnet","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT network","resources":["stackit_network"],"maturity":"ga","lifecycle":"active"},"reason":"A subnet becomes a stackit_network with the same IPv4 prefix. Public vs private is not a subnet property on STACKIT: servers get public IPs explicitly, and a network can be created without a default gateway.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/network.md"],"validated_against":"terraform-provider-stackit@0.116.0; terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_network re-read, stackit_network attributes unchanged from 0.116.0 (its block description lost the transitional ipv4_nameservers behaviour warning; the attribute description keeps the behaviour); no destroy-protection, DNS64, hostname or per-server record attribute in stackit_network or stackit_server (both unchanged); stackit_public_ip and stackit_dns_record_set unchanged)","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT network","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_subnet.intra","source_type":"aws_subnet","category":"network","kind":"subnet","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":835,"end_line":860},"result":{"rule_id":"aws.subnet","case_id":"subnet","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT network","resources":["stackit_network"],"maturity":"ga","lifecycle":"active"},"reason":"A subnet becomes a stackit_network with the same IPv4 prefix. Public vs private is not a subnet property on STACKIT: servers get public IPs explicitly, and a network can be created without a default gateway.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/network.md"],"validated_against":"terraform-provider-stackit@0.116.0; terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_network re-read, stackit_network attributes unchanged from 0.116.0 (its block description lost the transitional ipv4_nameservers behaviour warning; the attribute description keeps the behaviour); no destroy-protection, DNS64, hostname or per-server record attribute in stackit_network or stackit_server (both unchanged); stackit_public_ip and stackit_dns_record_set unchanged)","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT network","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_subnet.outpost","source_type":"aws_subnet","category":"network","kind":"subnet","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":953,"end_line":980},"result":{"rule_id":"aws.subnet","case_id":"subnet","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT network","resources":["stackit_network"],"maturity":"ga","lifecycle":"active"},"reason":"A subnet becomes a stackit_network with the same IPv4 prefix. Public vs private is not a subnet property on STACKIT: servers get public IPs explicitly, and a network can be created without a default gateway.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/network.md"],"validated_against":"terraform-provider-stackit@0.116.0; terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_network re-read, stackit_network attributes unchanged from 0.116.0 (its block description lost the transitional ipv4_nameservers behaviour warning; the attribute description keeps the behaviour); no destroy-protection, DNS64, hostname or per-server record attribute in stackit_network or stackit_server (both unchanged); stackit_public_ip and stackit_dns_record_set unchanged)","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT network","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_subnet.private","source_type":"aws_subnet","category":"network","kind":"subnet","enabled":true,"instances":-1,"presence":"CONDITIONAL","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_private_subnets ? local.len_private_subnets : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":3},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"standing":"UNIT","module_call":"module.vpc.module.vpc","configuration_completeness":"CONDITIONAL","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":267,"end_line":293},"result":{"rule_id":"aws.subnet","case_id":"subnet","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT network","resources":["stackit_network"],"maturity":"ga","lifecycle":"active"},"reason":"A subnet becomes a stackit_network with the same IPv4 prefix. Public vs private is not a subnet property on STACKIT: servers get public IPs explicitly, and a network can be created without a default gateway.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/network.md"],"validated_against":"terraform-provider-stackit@0.116.0; terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_network re-read, stackit_network attributes unchanged from 0.116.0 (its block description lost the transitional ipv4_nameservers behaviour warning; the attribute description keeps the behaviour); no destroy-protection, DNS64, hostname or per-server record attribute in stackit_network or stackit_server (both unchanged); stackit_public_ip and stackit_dns_record_set unchanged)","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this subnet names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"subnet-egress-ipv4-unproven","severity":"warning","message":"PRIVATE_EGRESS_EQUIVALENCE_UNPROVEN (IPv4, not proven). The scan cannot say whether this subnet can start an IPv4 connection to the internet: which route table it follows, or what that table's default route goes to, is not proven; or the route table sends 0.0.0.0/0 to an internet gateway but the scan shows no public IPv4 address for what is launched in the subnet - no server in it that has one (a public address asked for or given by the subnet at launch, or an Elastic IP), a server in it that has none, a server whose address or whose subnet is not visible or not resolved, a server with an address in only some of the instances of a repeated subnet, or a workload the reader does not read (a function, a container service, a cluster): \"The instances in the public subnet must have public IP addresses or Elastic IP addresses to enable communication with the internet over the internet gateway\" (AWS VPC User Guide, Internet gateways, read 2026-10-12). The cause is named below. The stackit_network the draft makes of it (an aws_default_subnet gets none: adopting the account's default subnet is a decision) keeps STACKIT's default gateway, which reaches the internet through source NAT (\"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading.\", docs.stackit.cloud Virtual Network concepts, read 2026-10-11), so where the source has no route to the internet the two are not equivalent. The draft sets neither routed nor no_ipv4_gateway (see the subnet's egress finding: what either does to outbound access is not documented). Closing evidence: the route table the subnet follows and its default route - name the association by an exact reference to the table and to the subnet, with a count that is known - and, for a route to an internet gateway, the public IPv4 address of every server in the subnet named by an exact reference (its own switch, an Elastic IP or the subnet's setting at launch) - or an architect's statement of what the source subnet reaches. A subnet that is not proven to reach the internet is never read as one that does. Here: IPv4 egress reading UNKNOWN (table-not-proven (selects-collapsed)); no route table of the configuration is proven for the subnet.","evidence":["https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html","https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html","https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","https://registry.terraform.io/providers/stackitcloud/stackit/0.119.0/docs/resources/network"],"blocker_category":"NETWORK"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"coverage":"UNKNOWN_RUNTIME_TOPOLOGY","semantics":{"contract":"aws.subnet","expected":96,"observed":9,"accounted":9,"unaccounted":0,"critical_unaccounted":[],"critical_open":["subnet-vpc-membership","network-topology-boundary","private-egress-ipv4","prefix","availability-zone"],"items":[{"id":"subnet-vpc-membership","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"effective-route-table","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"effective-route-table-attached","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"private-egress-ipv4","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:subnet-egress-ipv4-unproven","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"egress-ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"prefix","critical":true,"observed":"unknown","disposition":"REVIEW","by":"observed-unknown:case:subnet","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"prefix-from-variable","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"public-ip-on-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ipv6","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:subnet"},{"id":"availability-zone","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:subnet","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"dns64","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:subnet"},{"id":"default-subnet-force-destroy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ipam-pools","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"outposts-and-customer-owned-ips","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-default-subnet-enable-resource-name-dns-a-record-on-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-default-subnet-enable-resource-name-dns-aaaa-record-on-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-default-subnet-private-dns-hostname-type-on-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-subnet-enable-resource-name-dns-a-record-on-launch","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:subnet"},{"id":"tc-subnet-enable-resource-name-dns-aaaa-record-on-launch","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:subnet"},{"id":"tc-subnet-private-dns-hostname-type-on-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dax-subnet-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ec2-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ec2-subnet-cidr-reservation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-globalaccelerator-custom-routing-endpoint-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-memorydb-subnet-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-networkmanager-connect-peer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-networkmanager-device","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-networkmanager-vpc-attachment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-s3outposts-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-spot-fleet-request","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-block-public-access-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-endpoint-subnet-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apigatewayv2-vpc-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-auto-scaling-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-ec2-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-flow-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance-connect-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-launch-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-route-server-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-spot-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-subnet-cidr-block","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-subnet-cidr-reservation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-subnet-network-acl-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-verified-access-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-block-public-access-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-fargate-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancing-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkfirewall-firewall","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkfirewall-vpc-endpoint-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkmanager-connect-peer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkmanager-device","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkmanager-vpc-attachment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-s3outposts-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT network","confidence":"MEDIUM"}},"property_accounting":{"set":10,"excluded":1,"meaningful":9,"by_status":{"CONSUMED":0,"CONTRACT":6,"NOT_CARRIED":3,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.vpc.module.vpc.aws_subnet.private","attribute":"availability_zone"},{"node":"module.vpc.module.vpc.aws_subnet.private","attribute":"availability_zone_id"},{"node":"module.vpc.module.vpc.aws_subnet.private","attribute":"vpc_id"}],"class_counts":{"CRITICAL":9},"critical":[{"node":"module.vpc.module.vpc.aws_subnet.private","attribute":"availability_zone","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.vpc.module.vpc.aws_subnet.private): availability_zone, availability_zone_id — stackit_network has no availability zone (pinned provider): the network serves the region; servers and volumes choose their zone. (contract aws.subnet/availability-zone:REVIEW)"},{"node":"module.vpc.module.vpc.aws_subnet.private","attribute":"availability_zone_id","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.vpc.module.vpc.aws_subnet.private): availability_zone, availability_zone_id — stackit_network has no availability zone (pinned provider): the network serves the region; servers and volumes choose their zone. (contract aws.subnet/availability-zone:REVIEW)"},{"node":"module.vpc.module.vpc.aws_subnet.private","attribute":"cidr_block","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.subnet/prefix:REVIEW"},{"node":"module.vpc.module.vpc.aws_subnet.private","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.vpc.module.vpc.aws_subnet.private): vpc_id — the source VPC is not generated: the network is created in the project (stackit_network also takes a vpc_id of the experimental STACKIT VPC feature, pinned provider — not used by this draft). (contract aws.subnet/subnet-vpc-membership:REVIEW)"}],"automation_eligible":false,"open_critical_without_read_set":["network-topology-boundary","private-egress-ipv4"],"gate_blockers":[{"source_type":"aws_subnet","attribute":"availability_zone","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_subnet","attribute":"availability_zone_id","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_subnet","attribute":"vpc_id","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_subnet","attribute":"cidr_block","closure":"CLOSED:REVIEW"},{"source_type":"aws_subnet","semantic":"convert:module.vpc.module.vpc.aws_subnet.private:network:WORKLOAD_PLACEMENT","closure":"CONVERT:open-decision"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"source_type":"aws_subnet","closure":"TOPOLOGY:unknown"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"private-egress-ipv4","closure":"open-critical-without-read-set"}]}},{"id":"module.vpc.module.vpc.aws_subnet.public","source_type":"aws_subnet","category":"network","kind":"subnet","enabled":true,"instances":-1,"presence":"CONDITIONAL","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_public_subnets \u0026\u0026 (!var.one_nat_gateway_per_az || local.len_public_subnets \u003e= length(var.azs)) ? local.len_public_subnets : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":3},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"standing":"UNIT","module_call":"module.vpc.module.vpc","configuration_completeness":"CONDITIONAL","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":131,"end_line":158},"result":{"rule_id":"aws.subnet","case_id":"subnet","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT network","resources":["stackit_network"],"maturity":"ga","lifecycle":"active"},"reason":"A subnet becomes a stackit_network with the same IPv4 prefix. Public vs private is not a subnet property on STACKIT: servers get public IPs explicitly, and a network can be created without a default gateway.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/network.md"],"validated_against":"terraform-provider-stackit@0.116.0; terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_network re-read, stackit_network attributes unchanged from 0.116.0 (its block description lost the transitional ipv4_nameservers behaviour warning; the attribute description keeps the behaviour); no destroy-protection, DNS64, hostname or per-server record attribute in stackit_network or stackit_server (both unchanged); stackit_public_ip and stackit_dns_record_set unchanged)","findings":[{"check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this subnet names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"blocker_category":"NETWORK"},{"check_id":"subnet-route-table-undecided","severity":"warning","message":"The scan cannot say which route table this subnet follows: a route table association may name it through a value the scan cannot resolve (a variable, a literal ID, a conditional, a value from a module call), an association names only some of its instances or repeats by a count or for_each that is not the subnet's own (aws_subnet.x[0].id for a counted subnet, fewer association instances than subnet instances), an association may create no instance (a count or for_each that a variable decides, count = var.on ? 1 : 0, whatever the variable's default: the subnet then follows the main route table), the VPC of the subnet or its main route table is not decided (count or for_each, two resources that set the main table, a main association and an aws_default_route_table on one VPC, a table or VPC outside the configuration). node.subnet_routing carries the cause. Which table the subnet follows, and so what its routing and exposure are, is not decided here; the draft attaches no routing table to its network.","evidence":["https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/main_route_table_association"],"blocker_category":"NETWORK"},{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"},{"check_id":"subnet-egress-ipv4-unproven","severity":"warning","message":"PRIVATE_EGRESS_EQUIVALENCE_UNPROVEN (IPv4, not proven). The scan cannot say whether this subnet can start an IPv4 connection to the internet: which route table it follows, or what that table's default route goes to, is not proven; or the route table sends 0.0.0.0/0 to an internet gateway but the scan shows no public IPv4 address for what is launched in the subnet - no server in it that has one (a public address asked for or given by the subnet at launch, or an Elastic IP), a server in it that has none, a server whose address or whose subnet is not visible or not resolved, a server with an address in only some of the instances of a repeated subnet, or a workload the reader does not read (a function, a container service, a cluster): \"The instances in the public subnet must have public IP addresses or Elastic IP addresses to enable communication with the internet over the internet gateway\" (AWS VPC User Guide, Internet gateways, read 2026-10-12). The cause is named below. The stackit_network the draft makes of it (an aws_default_subnet gets none: adopting the account's default subnet is a decision) keeps STACKIT's default gateway, which reaches the internet through source NAT (\"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading.\", docs.stackit.cloud Virtual Network concepts, read 2026-10-11), so where the source has no route to the internet the two are not equivalent. The draft sets neither routed nor no_ipv4_gateway (see the subnet's egress finding: what either does to outbound access is not documented). Closing evidence: the route table the subnet follows and its default route - name the association by an exact reference to the table and to the subnet, with a count that is known - and, for a route to an internet gateway, the public IPv4 address of every server in the subnet named by an exact reference (its own switch, an Elastic IP or the subnet's setting at launch) - or an architect's statement of what the source subnet reaches. A subnet that is not proven to reach the internet is never read as one that does. Here: IPv4 egress reading UNKNOWN (the route table association module.vpc.module.vpc.aws_route_table_association.public names the subnet module.vpc.module.vpc.aws_subnet.public but the scan cannot show that it names every instance of it (a value that is not exactly one reference to it, an index that picks some instances, a count or for_each that is not the subnet's own), so which table it follows is not decided here); no route table of the configuration is proven for the subnet.","evidence":["https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html","https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html","https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","https://registry.terraform.io/providers/stackitcloud/stackit/0.119.0/docs/resources/network"],"blocker_category":"NETWORK"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"coverage":"UNKNOWN_RUNTIME_TOPOLOGY","semantics":{"contract":"aws.subnet","expected":96,"observed":11,"accounted":11,"unaccounted":0,"critical_unaccounted":[],"critical_open":["subnet-vpc-membership","network-topology-boundary","effective-route-table","private-egress-ipv4","prefix","availability-zone"],"items":[{"id":"subnet-vpc-membership","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"network-topology-boundary","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:topology-vpc-unproven","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"effective-route-table","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:subnet-route-table-undecided","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"effective-route-table-attached","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"private-egress-ipv4","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:subnet-egress-ipv4-unproven","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"egress-ipv6","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"prefix","critical":true,"observed":"unknown","disposition":"REVIEW","by":"observed-unknown:case:subnet","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"prefix-from-variable","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"public-ip-on-launch","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:subnet"},{"id":"ipv6","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:subnet"},{"id":"availability-zone","critical":true,"observed":"unknown","disposition":"REVIEW","by":"case:subnet","instances_not_broken_down":{"reason":"unknown_count"}},{"id":"dns64","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:subnet"},{"id":"default-subnet-force-destroy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ipam-pools","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"outposts-and-customer-owned-ips","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-default-subnet-enable-resource-name-dns-a-record-on-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-default-subnet-enable-resource-name-dns-aaaa-record-on-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-default-subnet-private-dns-hostname-type-on-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-subnet-enable-resource-name-dns-a-record-on-launch","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:subnet"},{"id":"tc-subnet-enable-resource-name-dns-aaaa-record-on-launch","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:subnet"},{"id":"tc-subnet-private-dns-hostname-type-on-launch","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-dax-subnet-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-db-proxy-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-docdbelastic-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ec2-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ec2-subnet-cidr-reservation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-elasticsearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-globalaccelerator-custom-routing-endpoint-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-lambdacore-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-memorydb-subnet-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-networkmanager-connect-peer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-networkmanager-device","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-networkmanager-vpc-attachment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearch-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-opensearchserverless-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-osis-pipeline-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-endpoint-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-redshiftserverless-workgroup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-s3outposts-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-spot-fleet-request","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-timestreaminfluxdb-db-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-verifiedaccess-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-block-public-access-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpc-endpoint-subnet-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-aws-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apigatewayv2-vpc-link","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-apprunner-vpc-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-autoscaling-auto-scaling-group","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-batch-compute-environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-ec2-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-flow-log","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-instance-connect-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-launch-template","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-network-interface","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-route-server-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-spot-fleet","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-subnet-cidr-block","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-subnet-cidr-reservation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-subnet-network-acl-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-verified-access-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-block-public-access-exclusion","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ec2-vpc-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-express-gateway-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-ecs-task-set","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-eks-fargate-profile","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancing-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-elasticloadbalancingv2-load-balancer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-imagebuilder-infrastructure-configuration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-capacity-provider","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-lambda-network-connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-replicator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-serverless-cluster","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-msk-vpc-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkfirewall-firewall","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkfirewall-vpc-endpoint-association","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkmanager-connect-peer","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkmanager-device","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-networkmanager-vpc-attachment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-route53resolver-resolver-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-s3outposts-endpoint","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-synthetics-canary","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"nbr-awscc-vpclattice-resource-gateway","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT network","confidence":"MEDIUM"}},"property_accounting":{"set":11,"excluded":1,"meaningful":10,"by_status":{"CONSUMED":0,"CONTRACT":7,"NOT_CARRIED":3,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"module.vpc.module.vpc.aws_subnet.public","attribute":"availability_zone"},{"node":"module.vpc.module.vpc.aws_subnet.public","attribute":"availability_zone_id"},{"node":"module.vpc.module.vpc.aws_subnet.public","attribute":"vpc_id"}],"class_counts":{"CRITICAL":10},"critical":[{"node":"module.vpc.module.vpc.aws_subnet.public","attribute":"availability_zone","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.vpc.module.vpc.aws_subnet.public): availability_zone, availability_zone_id — stackit_network has no availability zone (pinned provider): the network serves the region; servers and volumes choose their zone. (contract aws.subnet/availability-zone:REVIEW)"},{"node":"module.vpc.module.vpc.aws_subnet.public","attribute":"availability_zone_id","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.vpc.module.vpc.aws_subnet.public): availability_zone, availability_zone_id — stackit_network has no availability zone (pinned provider): the network serves the region; servers and volumes choose their zone. (contract aws.subnet/availability-zone:REVIEW)"},{"node":"module.vpc.module.vpc.aws_subnet.public","attribute":"cidr_block","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"aws.subnet/prefix:REVIEW"},{"node":"module.vpc.module.vpc.aws_subnet.public","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (module.vpc.module.vpc.aws_subnet.public): vpc_id — the source VPC is not generated: the network is created in the project (stackit_network also takes a vpc_id of the experimental STACKIT VPC feature, pinned provider — not used by this draft). (contract aws.subnet/subnet-vpc-membership:REVIEW)"}],"automation_eligible":false,"open_critical_without_read_set":["effective-route-table","network-topology-boundary","private-egress-ipv4"],"gate_blockers":[{"source_type":"aws_subnet","attribute":"availability_zone","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_subnet","attribute":"availability_zone_id","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_subnet","attribute":"vpc_id","closure":"CLOSED:NC+REVIEW"},{"source_type":"aws_subnet","attribute":"cidr_block","closure":"CLOSED:REVIEW"},{"target":"provider:aws","closure":"PROVIDER:UNPINNED"},{"source_type":"aws_subnet","closure":"TOPOLOGY:unknown"},{"semantic":"network-topology-boundary","closure":"TOPOLOGY:vpc-unproven"},{"semantic":"effective-route-table","closure":"open-critical-without-read-set"},{"semantic":"private-egress-ipv4","closure":"open-critical-without-read-set"}]}},{"id":"module.vpc.module.vpc.aws_subnet.redshift","source_type":"aws_subnet","category":"network","kind":"subnet","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":569,"end_line":594},"result":{"rule_id":"aws.subnet","case_id":"subnet","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT network","resources":["stackit_network"],"maturity":"ga","lifecycle":"active"},"reason":"A subnet becomes a stackit_network with the same IPv4 prefix. Public vs private is not a subnet property on STACKIT: servers get public IPs explicitly, and a network can be created without a default gateway.","evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/network.md"],"validated_against":"terraform-provider-stackit@0.116.0; terraform-provider-stackit@0.120.0 (re-checked 2026-10-18 against provider-schema-0.120.0.json and the v0.120.0 tag docs: stackit_network re-read, stackit_network attributes unchanged from 0.116.0 (its block description lost the transitional ipv4_nameservers behaviour warning; the attribute description keeps the behaviour); no destroy-protection, DNS64, hostname or per-server record attribute in stackit_network or stackit_server (both unchanged); stackit_public_ip and stackit_dns_record_set unchanged)","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT network","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","source_type":"aws_vpc_block_public_access_exclusion","category":"network","kind":"network_exposure_exclusion","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"for_each = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_subnet.private","module.vpc.module.vpc.aws_subnet.public","module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":68,"end_line":93},"result":{"rule_id":"aws.vpc_block_public_access","case_id":"bpa-exclusion-redesign","class":"REDESIGN","confidence":"MEDIUM","target":{"service":"none - no account guardrail to except a VPC or subnet from","maturity":"ga"},"reason":"The exclusion lets one VPC or subnet keep internet gateway traffic (allow-egress or allow-bidirectional) while Block Public Access is on for the account. STACKIT has no account-wide block to make an exception to, so the exclusion has no counterpart; what it expressed is which networks may reach or be reached from the internet, and that is decided on STACKIT by the public IPs attached to the servers of that network and by the security group rules of the interfaces.","review":["List the networks the exclusion kept open to the internet and keep a public IP and an internet-facing ingress rule only there."],"evidence":["https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_block_public_access_options","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_block_public_access_exclusion","https://registry.terraform.io/providers/stackitcloud/stackit/0.119.0/docs/resources/public_ip","https://registry.terraform.io/providers/stackitcloud/stackit/0.119.0/docs/resources/security_group","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"validated_against":"terraform-provider-stackit@0.119.0 (no account- or VPC-level internet-access guardrail; stackit_public_ip, stackit_security_group); IaaS v2 specification x-stackit-authorization actions iaas.public-ip.create and iaas.server.public-ip.add; docs.stackit.cloud network-area concepts ('all incoming traffic is denied by default') read 2026-10-15","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"none - no account guardrail to except a VPC or subnet from","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_vpc_block_public_access_options.this","source_type":"aws_vpc_block_public_access_options","category":"network","kind":"account_setting","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":62,"end_line":66},"result":{"rule_id":"aws.vpc_block_public_access","case_id":"bpa-options-redesign","class":"REDESIGN","confidence":"MEDIUM","target":{"service":"none - no account guardrail; exposure is set by security groups and by who may attach public IPs","maturity":"ga"},"reason":"The setting blocks internet gateway traffic for every VPC of the account in the Region: block-bidirectional (no traffic in or out through internet gateways), block-ingress (outbound allowed) or off. STACKIT has no such guardrail. Inbound access is denied by default by security groups (docs: 'all incoming traffic is denied by default') and a server is reachable from the internet only through a public IP, which is created and attached through the IAM-authorised actions iaas.public-ip.create and iaas.server.public-ip.add; the replacement is a role set that withholds those actions plus security groups without internet-wide ingress rules. Outbound traffic of a routed network leaves through the router's source NAT (docs.stackit.cloud architecture page; observed in the test of 2026-10-10 of this knowledge base) and no schema attribute blocks it, so block-bidirectional cannot be expressed as a setting.","review":["Decide who may create and attach public IPs in the STACKIT project and keep security groups free of internet-wide ingress rules; outbound blocking has no setting."],"evidence":["https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_block_public_access_options","https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_block_public_access_exclusion","https://registry.terraform.io/providers/stackitcloud/stackit/0.119.0/docs/resources/public_ip","https://registry.terraform.io/providers/stackitcloud/stackit/0.119.0/docs/resources/security_group","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"validated_against":"terraform-provider-stackit@0.119.0 (no account- or VPC-level internet-access guardrail; stackit_public_ip, stackit_security_group); IaaS v2 specification x-stackit-authorization actions iaas.public-ip.create and iaas.server.public-ip.add; docs.stackit.cloud network-area concepts ('all incoming traffic is denied by default') read 2026-10-15","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"none - no account guardrail; exposure is set by security groups and by who may attach public IPs","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_vpc_dhcp_options.this","source_type":"aws_vpc_dhcp_options","category":"network","kind":"dhcp_options","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":99,"end_line":114},"result":{"rule_id":"aws.vpc_dhcp_options","case_id":"dhcp","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT network DNS settings","resources":["stackit_network"],"maturity":"ga","lifecycle":"active"},"reason":"Custom DNS servers and domain name for the VPC become the name-server settings of the STACKIT networks.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/network"],"validated_against":"terraform-provider-stackit@0.116.0 (stackit_network nameservers)","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT network DNS settings","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_vpn_gateway.this","source_type":"aws_vpn_gateway","category":"network","kind":"vpn_gateway","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1188,"end_line":1200},"result":{"rule_id":"aws.vpn","case_id":"vpn","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT VPN","resources":["stackit_vpn_gateway","stackit_vpn_connection"],"maturity":"ga","lifecycle":"active"},"reason":"The site-to-site VPN is rebuilt as a STACKIT VPN gateway and connection (IPsec IKEv2, two tunnels per connection, like AWS). The on-premises device gets new peer addresses, pre-shared keys and tunnel parameters; routes are re-announced or re-entered on both sides.","review":["Agree a cut-over window with the network team that owns the on-premises device."],"evidence":["https://docs.stackit.cloud/products/network/connectivity-hybrid-multi-cloud/vpn/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/vpn_gateway","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/vpn_connection"],"validated_against":"terraform-provider-stackit@0.116.0; docs network/vpn 2026-09-23 (available via the STACKIT API since 2026-05-05 per the release notes, API v1, no beta note in provider 0.116.0 — the docs use no GA label, checked 2026-09-25; IKEv2, two tunnels, static or BGP routing)","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"maturity":"beta","lifecycle":"internal","production_eligible":false,"axes":{"feasibility":"SUPPORTED","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["UNKNOWN"],"target_platform":"STACKIT VPN","confidence":"MEDIUM"}}},{"id":"module.vpc.module.vpc.aws_vpn_gateway_attachment.this","source_type":"aws_vpn_gateway_attachment","category":"network","kind":"vpn_gateway_attachment","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","standing":"UNIT","module_call":"module.vpc.module.vpc","disabled_by":"count = 0","configuration_completeness":"COMPLETE","depends_on":["module.vpc.module.vpc.aws_vpc.this"],"wave":0,"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1202,"end_line":1207},"result":{"class":"MANUAL_REVIEW","confidence":"LOW","reason":"The knowledge base maps aws_vpn_gateway_attachment as part of its parent, but its parent (through vpn_gateway_id) was not found in the scan (vpn_gateway_id is empty in this source, so it names no resource); it is switched off in the source as written (count = 0), so nothing of it is migrated unless it is switched on, and then an architect has to decide the target of this part.","findings":[{"check_id":"source-provider-unpinned","severity":"warning","message":"root: source-provider-unpinned:aws","root":"source-provider-unpinned:aws","impact":"PROPAGATED_IMPACT"}],"production_eligible":false,"axes":{"feasibility":"UNKNOWN","motion":"","change_types":[],"blocker_categories":["UNKNOWN"],"target_platform":"","confidence":"LOW"}}}],"graph":{"files":["main.tf","output.tf","variables.tf","versions.tf","../../lib/tags/main.tf","../../lib/vpc/outputs.tf","../../lib/vpc/variables.tf","../../lib/vpc/vpc.tf",".terraform/modules/vpc.vpc/main.tf",".terraform/modules/vpc.vpc/outputs.tf",".terraform/modules/vpc.vpc/variables.tf",".terraform/modules/vpc.vpc/versions.tf",".terraform/modules/vpc.vpc/vpc-flow-logs.tf","../../lib/dependencies/catalog_opensearch.tf","../../lib/dependencies/catalog_rds.tf","../../lib/dependencies/dynamodb.tf","../../lib/dependencies/elasticache.tf","../../lib/dependencies/main.tf","../../lib/dependencies/mq.tf","../../lib/dependencies/orders_rds.tf","../../lib/dependencies/outputs.tf","../../lib/dependencies/variables.tf","../../lib/dependencies/versions.tf",".terraform/modules/dependencies.catalog_opensearch/main.tf",".terraform/modules/dependencies.catalog_opensearch/outputs.tf",".terraform/modules/dependencies.catalog_opensearch/variables.tf",".terraform/modules/dependencies.catalog_opensearch/versions.tf",".terraform/modules/dependencies.catalog_rds/main.tf",".terraform/modules/dependencies.catalog_rds/outputs.tf",".terraform/modules/dependencies.catalog_rds/variables.tf",".terraform/modules/dependencies.catalog_rds/versions.tf",".terraform/modules/dependencies.dynamodb_carts/autoscaling.tf",".terraform/modules/dependencies.dynamodb_carts/main.tf",".terraform/modules/dependencies.dynamodb_carts/outputs.tf",".terraform/modules/dependencies.dynamodb_carts/variables.tf",".terraform/modules/dependencies.dynamodb_carts/versions.tf",".terraform/modules/dependencies.checkout_elasticache_redis/context.tf",".terraform/modules/dependencies.checkout_elasticache_redis/main.tf",".terraform/modules/dependencies.checkout_elasticache_redis/outputs.tf",".terraform/modules/dependencies.checkout_elasticache_redis/security_group_inputs.tf",".terraform/modules/dependencies.checkout_elasticache_redis/variables-deprecated.tf",".terraform/modules/dependencies.checkout_elasticache_redis/variables.tf",".terraform/modules/dependencies.checkout_elasticache_redis/versions.tf",".terraform/modules/dependencies.checkout_elasticache_redis.this/descriptors.tf",".terraform/modules/dependencies.checkout_elasticache_redis.this/main.tf",".terraform/modules/dependencies.checkout_elasticache_redis.this/outputs.tf",".terraform/modules/dependencies.checkout_elasticache_redis.this/variables.tf",".terraform/modules/dependencies.checkout_elasticache_redis.this/versions.tf",".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/context.tf",".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/main.tf",".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/normalize.tf",".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/outputs.tf",".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/variables.tf",".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/versions.tf",".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group.this/descriptors.tf",".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group.this/main.tf",".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group.this/outputs.tf",".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group.this/variables.tf",".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group.this/versions.tf",".terraform/modules/dependencies.checkout_elasticache_redis.dns/context.tf",".terraform/modules/dependencies.checkout_elasticache_redis.dns/main.tf",".terraform/modules/dependencies.checkout_elasticache_redis.dns/outputs.tf",".terraform/modules/dependencies.checkout_elasticache_redis.dns/variables.tf",".terraform/modules/dependencies.checkout_elasticache_redis.dns/versions.tf",".terraform/modules/dependencies.checkout_elasticache_redis.dns.this/descriptors.tf",".terraform/modules/dependencies.checkout_elasticache_redis.dns.this/main.tf",".terraform/modules/dependencies.checkout_elasticache_redis.dns.this/outputs.tf",".terraform/modules/dependencies.checkout_elasticache_redis.dns.this/variables.tf",".terraform/modules/dependencies.checkout_elasticache_redis.dns.this/versions.tf",".terraform/modules/dependencies.orders_rds/main.tf",".terraform/modules/dependencies.orders_rds/outputs.tf",".terraform/modules/dependencies.orders_rds/variables.tf",".terraform/modules/dependencies.orders_rds/versions.tf","../../lib/ecs/alb.tf","../../lib/ecs/carts.tf","../../lib/ecs/catalog.tf","../../lib/ecs/checkout.tf","../../lib/ecs/cluster.tf","../../lib/ecs/common.tf","../../lib/ecs/eventbridge.tf","../../lib/ecs/main.tf","../../lib/ecs/orders.tf","../../lib/ecs/outputs.tf","../../lib/ecs/ui.tf","../../lib/ecs/variables.tf","../../lib/ecs/versions.tf","../../lib/ecs/vpc.tf",".terraform/modules/retail_app_ecs.alb_sg/main.tf",".terraform/modules/retail_app_ecs.alb_sg/outputs.tf",".terraform/modules/retail_app_ecs.alb_sg/rules.tf",".terraform/modules/retail_app_ecs.alb_sg/variables.tf",".terraform/modules/retail_app_ecs.alb_sg/versions.tf",".terraform/modules/retail_app_ecs.alb/main.tf",".terraform/modules/retail_app_ecs.alb/outputs.tf",".terraform/modules/retail_app_ecs.alb/variables.tf",".terraform/modules/retail_app_ecs.alb/versions.tf","../../lib/images/generated.tf.json","../../lib/images/main.tf","../../lib/images/outputs.tf","../../lib/images/variables.tf","../../lib/ecs/service/ecs.tf","../../lib/ecs/service/iam.tf","../../lib/ecs/service/outputs.tf","../../lib/ecs/service/sg.tf","../../lib/ecs/service/variables.tf"],"nodes":[{"id":"module.dependencies.aws_iam_policy.carts_dynamo","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"carts_dynamo","module_path":["dependencies"],"category":"identity","kind":"iam_policy","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"Dynamo policy for carts application","name":"retail-store-ecs-carts-dynamo","path":"/","policy":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"unknown":["policy"],"unknown_causes":{"policy":"runtime-data"},"attr_variables":{"name":["environment_name"],"policy":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/dependencies/dynamodb.tf","line":30,"end_line":52}},{"id":"module.dependencies.aws_mq_broker.mq","mode":"managed","provider":"aws","source_type":"aws_mq_broker","name":"mq","module_path":["dependencies"],"category":"messaging","kind":"message_broker","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"apply_immediately":true,"auto_minor_version_upgrade":true,"broker_name":"retail-store-ecs-orders-broker","deployment_mode":"SINGLE_INSTANCE","engine_type":"RabbitMQ","engine_version":"3.13","host_instance_type":"mq.m5.large","publicly_accessible":false,"security_groups":["\u003cunknown\u003e"],"subnet_ids":["\u003cunknown\u003e"],"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"user":[{"password":"\u003cunknown\u003e","username":"default_mq_user"}]},"unknown":["security_groups","subnet_ids","user.password"],"unknown_causes":{"security_groups":"provider-computed","subnet_ids":"runtime-data","user.password":"provider-computed"},"attr_variables":{"broker_name":["environment_name"],"subnet_ids":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/dependencies/mq.tf","line":12,"end_line":31}},{"id":"module.dependencies.aws_security_group.catalog_opensearch_sg","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"catalog_opensearch_sg","module_path":["dependencies"],"category":"network","kind":"firewall_group","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"Security group for OpenSearch","name":"catalog_opensearch_sg","vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"vpc_id":"runtime-data"},"attr_variables":{"vpc_id":["environment_name"]},"provenance":{"file":"../../lib/dependencies/catalog_opensearch.tf","line":14,"end_line":18}},{"id":"module.dependencies.aws_security_group.mq","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"mq","module_path":["dependencies"],"category":"network","kind":"firewall_group","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"Secure traffic to Rabbit MQ","name":"retail-store-ecs-orders-broker","tags":{"Name":"retail-store-ecs-orders-broker","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"vpc_id":"runtime-data"},"attr_variables":{"name":["environment_name"],"tags":["environment_name"],"vpc_id":["environment_name"]},"provenance":{"file":"../../lib/dependencies/mq.tf","line":33,"end_line":43}},{"id":"module.dependencies.aws_security_group_rule.allow_https_from_client","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"allow_https_from_client","module_path":["dependencies"],"category":"network","kind":"firewall_rule","facet_of":"module.dependencies.aws_security_group.catalog_opensearch_sg","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"Allow HTTPS from client","from_port":443,"protocol":"tcp","security_group_id":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":443,"type":"ingress"},"unknown":["security_group_id","source_security_group_id"],"unknown_causes":{"security_group_id":"provider-computed","source_security_group_id":"module-cycle"},"provenance":{"file":"../../lib/dependencies/catalog_opensearch.tf","line":20,"end_line":28}},{"id":"module.dependencies.aws_security_group_rule.mq","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"mq","module_path":["dependencies"],"category":"network","kind":"firewall_rule","facet_of":"module.dependencies.aws_security_group.mq","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"from_port":5671,"protocol":"tcp","security_group_id":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":5671,"type":"ingress"},"unknown":["security_group_id","source_security_group_id"],"unknown_causes":{"security_group_id":"provider-computed","source_security_group_id":"module-cycle"},"instance_attrs":[{"from_port":5671,"protocol":"tcp","security_group_id":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":5671,"type":"ingress"}],"instance_keys":["0"],"provenance":{"file":"../../lib/dependencies/mq.tf","line":45,"end_line":55}},{"id":"module.dependencies.data.aws_caller_identity.current","mode":"data","provider":"aws","source_type":"aws_caller_identity","name":"current","module_path":["dependencies"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/dependencies/main.tf","line":3,"end_line":3}},{"id":"module.dependencies.data.aws_partition.current","mode":"data","provider":"aws","source_type":"aws_partition","name":"current","module_path":["dependencies"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/dependencies/main.tf","line":5,"end_line":5}},{"id":"module.dependencies.data.aws_region.current","mode":"data","provider":"aws","source_type":"aws_region","name":"current","module_path":["dependencies"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/dependencies/main.tf","line":1,"end_line":1}},{"id":"module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this","mode":"managed","provider":"aws","source_type":"aws_cloudwatch_log_group","name":"this","module_path":["dependencies","catalog_opensearch"],"category":"observability","kind":"log_group","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"kms_key_id":"\u003cunknown\u003e","log_group_class":"\u003cunknown\u003e","name":"\u003cunknown\u003e","retention_in_days":"\u003cunknown\u003e","skip_destroy":"\u003cunknown\u003e","tags":"\u003cunknown\u003e"},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":405,"end_line":415}},{"id":"module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_resource_policy.this","mode":"managed","provider":"aws","source_type":"aws_cloudwatch_log_resource_policy","name":"this","module_path":["dependencies","catalog_opensearch"],"category":"observability","kind":"log_resource_policy","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"policy_document":"\u003cunknown\u003e","policy_name":"opensearch-retail-store-ecs-catalog"},"attr_variables":{"policy_name":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":450,"end_line":455}},{"id":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","mode":"managed","provider":"aws","source_type":"aws_opensearch_domain","name":"this","module_path":["dependencies","catalog_opensearch"],"category":"data","kind":"search_cluster","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"advanced_options":{},"advanced_security_options":[{"anonymous_auth_enabled":false,"enabled":true,"internal_user_database_enabled":true,"master_user_options":[{"master_user_name":"admin","master_user_password":"\u003cunknown\u003e"}]}],"cluster_config":[{"dedicated_master_count":3,"dedicated_master_enabled":false,"dedicated_master_type":"c6g.large.search","instance_count":1,"instance_type":"r8g.medium.search","zone_awareness_enabled":false}],"domain_endpoint_options":[{"enforce_https":true,"tls_security_policy":"Policy-Min-TLS-1-2-2019-07"}],"domain_name":"retail-store-ecs-catalog","ebs_options":[{"ebs_enabled":true,"volume_size":50,"volume_type":"gp3"}],"encrypt_at_rest":[{"enabled":true}],"engine_version":"OpenSearch_3.3","node_to_node_encryption":[{"enabled":true}],"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs","terraform-aws-modules":"opensearch"},"timeouts":[{}],"vpc_options":[{"security_group_ids":"\u003cunknown\u003e","subnet_ids":"\u003cunknown\u003e"}]},"unknown":["advanced_security_options.master_user_options.master_user_password","vpc_options.security_group_ids","vpc_options.subnet_ids"],"unknown_causes":{"advanced_security_options.master_user_options.master_user_password":"unknown-iteration","vpc_options.security_group_ids":"unknown-iteration","vpc_options.subnet_ids":"unknown-iteration"},"instance_attrs":[{"advanced_options":{},"advanced_security_options":[{"anonymous_auth_enabled":false,"enabled":true,"internal_user_database_enabled":true,"master_user_options":[{"master_user_name":"admin","master_user_password":"\u003cunknown\u003e"}]}],"cluster_config":[{"dedicated_master_count":3,"dedicated_master_enabled":false,"dedicated_master_type":"c6g.large.search","instance_count":1,"instance_type":"r8g.medium.search","zone_awareness_enabled":false}],"domain_endpoint_options":[{"enforce_https":true,"tls_security_policy":"Policy-Min-TLS-1-2-2019-07"}],"domain_name":"retail-store-ecs-catalog","ebs_options":[{"ebs_enabled":true,"volume_size":50,"volume_type":"gp3"}],"encrypt_at_rest":[{"enabled":true}],"engine_version":"OpenSearch_3.3","node_to_node_encryption":[{"enabled":true}],"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs","terraform-aws-modules":"opensearch"},"timeouts":[{}],"vpc_options":[{"security_group_ids":"\u003cunknown\u003e","subnet_ids":"\u003cunknown\u003e"}]}],"instance_keys":["0"],"attr_variables":{"domain_name":["environment_name"],"tags":["environment_name"],"vpc_options[0].security_group_ids":["environment_name"],"vpc_options[0].subnet_ids":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":29,"end_line":233}},{"id":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this","mode":"managed","provider":"aws","source_type":"aws_opensearch_domain_policy","name":"this","module_path":["dependencies","catalog_opensearch"],"category":"data","kind":"search_access_policy","facet_of":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"access_policies":"\u003cunknown\u003e","domain_name":"\u003cunknown\u003e"},"unknown":["access_policies","domain_name"],"unknown_causes":{"access_policies":"runtime-data","domain_name":"provider-computed"},"instance_attrs":[{"access_policies":"\u003cunknown\u003e","domain_name":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"access_policies":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":269,"end_line":274}},{"id":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain_saml_options.this","mode":"managed","provider":"aws","source_type":"aws_opensearch_domain_saml_options","name":"this","module_path":["dependencies","catalog_opensearch"],"category":"identity","kind":"search_saml","facet_of":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"domain_name":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":330,"end_line":357}},{"id":"module.dependencies.module.catalog_opensearch.aws_opensearch_outbound_connection.this","mode":"managed","provider":"aws","source_type":"aws_opensearch_outbound_connection","name":"this","module_path":["dependencies","catalog_opensearch"],"category":"data","kind":"search_cross_cluster","facet_of":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"accept_connection":"\u003cunknown\u003e","connection_alias":"\u003cunknown\u003e","connection_mode":"\u003cunknown\u003e","connection_properties":[{"_dynamic":"unknown for_each","_template":{"cross_cluster_search":[{"_dynamic":"unknown for_each","_template":{"skip_unavailable":"\u003cunknown\u003e"},"skip_unavailable":"\u003cunknown\u003e"}]},"cross_cluster_search":[{"_dynamic":"unknown for_each","skip_unavailable":"\u003cunknown\u003e"}]}],"local_domain_info":[{"domain_name":"\u003cunknown\u003e","owner_id":"\u003cunknown\u003e","region":"\u003cunknown\u003e"}],"remote_domain_info":[{"domain_name":"\u003cunknown\u003e","owner_id":"\u003cunknown\u003e","region":"\u003cunknown\u003e"}]},"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":363,"end_line":395}},{"id":"module.dependencies.module.catalog_opensearch.aws_opensearch_package_association.this","mode":"managed","provider":"aws","source_type":"aws_opensearch_package_association","name":"this","module_path":["dependencies","catalog_opensearch"],"category":"data","kind":"search_package_binding","facet_of":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"domain_name":"\u003cunknown\u003e","package_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":239,"end_line":244}},{"id":"module.dependencies.module.catalog_opensearch.aws_opensearch_vpc_endpoint.this","mode":"managed","provider":"aws","source_type":"aws_opensearch_vpc_endpoint","name":"this","module_path":["dependencies","catalog_opensearch"],"category":"data","kind":"search_vpc_endpoint","facet_of":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"domain_arn":"\u003cunknown\u003e","vpc_options":[{"security_group_ids":"\u003cunknown\u003e","subnet_ids":"\u003cunknown\u003e"}]},"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":250,"end_line":259}},{"id":"module.dependencies.module.catalog_opensearch.aws_security_group.this","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"this","module_path":["dependencies","catalog_opensearch"],"category":"network","kind":"firewall_group","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"name_prefix":"retail-store-ecs-catalog-","revoke_rules_on_delete":true,"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs","terraform-aws-modules":"opensearch"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"name_prefix":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":472,"end_line":486}},{"id":"module.dependencies.module.catalog_opensearch.aws_vpc_security_group_egress_rule.this","mode":"managed","provider":"aws","source_type":"aws_vpc_security_group_egress_rule","name":"this","module_path":["dependencies","catalog_opensearch"],"category":"network","kind":"firewall_rule","facet_of":"module.dependencies.module.catalog_opensearch.aws_security_group.this","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_ipv4":"\u003cunknown\u003e","cidr_ipv6":"\u003cunknown\u003e","description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","ip_protocol":"\u003cunknown\u003e","prefix_list_id":"\u003cunknown\u003e","referenced_security_group_id":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","tags":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":507,"end_line":524}},{"id":"module.dependencies.module.catalog_opensearch.aws_vpc_security_group_ingress_rule.this","mode":"managed","provider":"aws","source_type":"aws_vpc_security_group_ingress_rule","name":"this","module_path":["dependencies","catalog_opensearch"],"category":"network","kind":"firewall_rule","facet_of":"module.dependencies.module.catalog_opensearch.aws_security_group.this","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_ipv4":"\u003cunknown\u003e","cidr_ipv6":"\u003cunknown\u003e","description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","ip_protocol":"\u003cunknown\u003e","prefix_list_id":"\u003cunknown\u003e","referenced_security_group_id":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","tags":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":488,"end_line":505}},{"id":"module.dependencies.module.catalog_opensearch.data.aws_caller_identity.current","mode":"data","provider":"aws","source_type":"aws_caller_identity","name":"current","module_path":["dependencies","catalog_opensearch"],"multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"instance_attrs":[{}],"instance_keys":["0"],"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":7,"end_line":9}},{"id":"module.dependencies.module.catalog_opensearch.data.aws_iam_policy_document.cloudwatch","mode":"data","provider":"aws","source_type":"aws_iam_policy_document","name":"cloudwatch","module_path":["dependencies","catalog_opensearch"],"multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"statement":[{"actions":["logs:CreateLogStream","logs:PutLogEvents","logs:PutLogEventsBatch"],"condition":[{"test":"StringEquals","values":["\u003cunknown\u003e"],"variable":"aws:SourceAccount"},{"test":"ArnLike","values":["\u003cunknown\u003e"],"variable":"aws:SourceArn"}],"principals":[{"identifiers":["es.amazonaws.com"],"type":"Service"}],"resources":["\u003cunknown\u003e"]}]},"attr_variables":{"statement[0].condition[1].values":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":417,"end_line":448}},{"id":"module.dependencies.module.catalog_opensearch.data.aws_iam_policy_document.this","mode":"data","provider":"aws","source_type":"aws_iam_policy_document","name":"this","module_path":["dependencies","catalog_opensearch"],"multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"override_policy_documents":[],"source_policy_documents":[]},"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":276,"end_line":324}},{"id":"module.dependencies.module.catalog_opensearch.data.aws_iam_session_context.current","mode":"data","provider":"aws","source_type":"aws_iam_session_context","name":"current","module_path":["dependencies","catalog_opensearch"],"multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"arn":"\u003cunknown\u003e"},"unknown":["arn"],"unknown_causes":{"arn":"runtime-data"},"instance_attrs":[{"arn":"\u003cunknown\u003e"}],"instance_keys":["0"],"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":10,"end_line":13}},{"id":"module.dependencies.module.catalog_opensearch.data.aws_partition.current","mode":"data","provider":"aws","source_type":"aws_partition","name":"current","module_path":["dependencies","catalog_opensearch"],"multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"instance_attrs":[{}],"instance_keys":["0"],"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":4,"end_line":6}},{"id":"module.dependencies.module.catalog_opensearch.data.aws_region.current","mode":"data","provider":"aws","source_type":"aws_region","name":"current","module_path":["dependencies","catalog_opensearch"],"multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"instance_attrs":[{}],"instance_keys":["0"],"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":1,"end_line":3}},{"id":"module.dependencies.module.catalog_opensearch.data.aws_subnet.this","mode":"data","provider":"aws","source_type":"aws_subnet","name":"this","module_path":["dependencies","catalog_opensearch"],"multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"id":"\u003cunknown\u003e"},"attr_variables":{"id":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":466,"end_line":470}},{"id":"module.dependencies.module.catalog_rds.aws_appautoscaling_policy.this","mode":"managed","provider":"aws","source_type":"aws_appautoscaling_policy","name":"this","module_path":["dependencies","catalog_rds"],"category":"compute","kind":"scaling_policy","facet_of":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"name":"target-metric","policy_type":"TargetTrackingScaling","resource_id":"\u003cunknown\u003e","scalable_dimension":"rds:cluster:ReadReplicaCount","service_namespace":"rds","target_tracking_scaling_policy_configuration":[{"predefined_metric_specification":[{"predefined_metric_type":"RDSReaderAverageCPUUtilization"}],"scale_in_cooldown":300,"scale_out_cooldown":300,"target_value":70}]},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":293,"end_line":315}},{"id":"module.dependencies.module.catalog_rds.aws_appautoscaling_target.this","mode":"managed","provider":"aws","source_type":"aws_appautoscaling_target","name":"this","module_path":["dependencies","catalog_rds"],"category":"compute","kind":"scaling_target","facet_of":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"max_capacity":2,"min_capacity":0,"resource_id":"\u003cunknown\u003e","scalable_dimension":"rds:cluster:ReadReplicaCount","service_namespace":"rds"},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":283,"end_line":291}},{"id":"module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this","mode":"managed","provider":"aws","source_type":"aws_cloudwatch_log_group","name":"this","module_path":["dependencies","catalog_rds"],"category":"observability","kind":"log_group","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"name":"\u003cunknown\u003e","retention_in_days":7,"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":445,"end_line":453}},{"id":"module.dependencies.module.catalog_rds.aws_db_parameter_group.this","mode":"managed","provider":"aws","source_type":"aws_db_parameter_group","name":"this","module_path":["dependencies","catalog_rds"],"category":"data","kind":"database_parameters","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"family":"aurora-mysql8.0","name_prefix":"retail-store-ecs-catalog-","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"instance_attrs":[{"family":"aurora-mysql8.0","name_prefix":"retail-store-ecs-catalog-","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}}],"instance_keys":["0"],"attr_variables":{"name_prefix":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":415,"end_line":438}},{"id":"module.dependencies.module.catalog_rds.aws_db_subnet_group.this","mode":"managed","provider":"aws","source_type":"aws_db_subnet_group","name":"this","module_path":["dependencies","catalog_rds"],"category":"network","kind":"database_subnet_group","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"For Aurora cluster retail-store-ecs-catalog","name":"retail-store-ecs-catalog","subnet_ids":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"unknown":["subnet_ids"],"unknown_causes":{"subnet_ids":"runtime-data"},"instance_attrs":[{"description":"For Aurora cluster retail-store-ecs-catalog","name":"retail-store-ecs-catalog","subnet_ids":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}}],"instance_keys":["0"],"attr_variables":{"description":["environment_name"],"name":["environment_name"],"subnet_ids":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":47,"end_line":55}},{"id":"module.dependencies.module.catalog_rds.aws_iam_role.rds_enhanced_monitoring","mode":"managed","provider":"aws","source_type":"aws_iam_role","name":"rds_enhanced_monitoring","module_path":["dependencies","catalog_rds"],"category":"identity","kind":"iam_role","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"assume_role_policy":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"monitoring.rds.amazonaws.com\"\n      }\n    }\n  ]\n}","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":255,"end_line":270}},{"id":"module.dependencies.module.catalog_rds.aws_iam_role_policy_attachment.rds_enhanced_monitoring","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"rds_enhanced_monitoring","module_path":["dependencies","catalog_rds"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.dependencies.module.catalog_rds.aws_iam_role.rds_enhanced_monitoring","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":272,"end_line":277}},{"id":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","mode":"managed","provider":"aws","source_type":"aws_rds_cluster","name":"this","module_path":["dependencies","catalog_rds"],"category":"data","kind":"relational_database_cluster","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"allow_major_version_upgrade":true,"apply_immediately":true,"backup_retention_period":7,"cluster_identifier":"retail-store-ecs-catalog","database_name":"catalog","db_cluster_parameter_group_name":"\u003cunknown\u003e","db_subnet_group_name":"\u003cunknown\u003e","enabled_cloudwatch_logs_exports":[],"engine":"aurora-mysql","engine_mode":"provisioned","engine_version":"8.0","master_password":"\u003cunknown\u003e","master_username":"root","port":3306,"preferred_backup_window":"02:00-03:00","preferred_maintenance_window":"sun:05:00-sun:06:00","skip_final_snapshot":true,"storage_encrypted":true,"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{}],"vpc_security_group_ids":"\u003cunknown\u003e"},"unknown":["db_cluster_parameter_group_name","db_subnet_group_name","master_password","vpc_security_group_ids"],"unknown_causes":{"db_cluster_parameter_group_name":"provider-computed","db_subnet_group_name":"provider-computed","master_password":"provider-computed","vpc_security_group_ids":"provider-computed"},"instance_attrs":[{"allow_major_version_upgrade":true,"apply_immediately":true,"backup_retention_period":7,"cluster_identifier":"retail-store-ecs-catalog","database_name":"catalog","db_cluster_parameter_group_name":"\u003cunknown\u003e","db_subnet_group_name":"\u003cunknown\u003e","enabled_cloudwatch_logs_exports":[],"engine":"aurora-mysql","engine_mode":"provisioned","engine_version":"8.0","master_password":"\u003cunknown\u003e","master_username":"root","port":3306,"preferred_backup_window":"02:00-03:00","preferred_maintenance_window":"sun:05:00-sun:06:00","skip_final_snapshot":true,"storage_encrypted":true,"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{}],"vpc_security_group_ids":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"cluster_identifier":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":61,"end_line":169}},{"id":"module.dependencies.module.catalog_rds.aws_rds_cluster_endpoint.this","mode":"managed","provider":"aws","source_type":"aws_rds_cluster_endpoint","name":"this","module_path":["dependencies","catalog_rds"],"category":"data","kind":"db_endpoint","facet_of":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cluster_endpoint_identifier":"\u003cunknown\u003e","cluster_identifier":"\u003cunknown\u003e","custom_endpoint_type":"\u003cunknown\u003e","excluded_members":"\u003cunknown\u003e","static_members":"\u003cunknown\u003e","tags":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":213,"end_line":226}},{"id":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","mode":"managed","provider":"aws","source_type":"aws_rds_cluster_instance","name":"this","module_path":["dependencies","catalog_rds"],"category":"data","kind":"relational_database_cluster_member","facet_of":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","multiplicity":"for_each","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"apply_immediately":"\u003cunknown\u003e","auto_minor_version_upgrade":"\u003cunknown\u003e","availability_zone":"\u003cunknown\u003e","cluster_identifier":"\u003cunknown\u003e","copy_tags_to_snapshot":"\u003cunknown\u003e","db_parameter_group_name":"\u003cunknown\u003e","db_subnet_group_name":"\u003cunknown\u003e","engine":"aurora-mysql","engine_version":"8.0","identifier":"\u003cunknown\u003e","instance_class":"\u003cunknown\u003e","monitoring_interval":"\u003cunknown\u003e","monitoring_role_arn":"\u003cunknown\u003e","performance_insights_enabled":"\u003cunknown\u003e","performance_insights_kms_key_id":"\u003cunknown\u003e","performance_insights_retention_period":"\u003cunknown\u003e","preferred_maintenance_window":"\u003cunknown\u003e","promotion_tier":"\u003cunknown\u003e","publicly_accessible":"\u003cunknown\u003e","tags":"\u003cunknown\u003e","timeouts":[{}]},"unknown":["apply_immediately","auto_minor_version_upgrade","availability_zone","cluster_identifier","copy_tags_to_snapshot","db_parameter_group_name","db_subnet_group_name","identifier","instance_class","monitoring_interval","monitoring_role_arn","performance_insights_enabled","performance_insights_kms_key_id","performance_insights_retention_period","preferred_maintenance_window","promotion_tier","publicly_accessible","tags"],"unknown_causes":{"apply_immediately":"unknown-iteration","auto_minor_version_upgrade":"unknown-iteration","availability_zone":"unknown-iteration","cluster_identifier":"provider-computed","copy_tags_to_snapshot":"unknown-iteration","db_parameter_group_name":"provider-computed","db_subnet_group_name":"provider-computed","identifier":"unknown-iteration","instance_class":"unknown-iteration","monitoring_interval":"unknown-iteration","monitoring_role_arn":"provider-computed","performance_insights_enabled":"unknown-iteration","performance_insights_kms_key_id":"unknown-iteration","performance_insights_retention_period":"unknown-iteration","preferred_maintenance_window":"unknown-iteration","promotion_tier":"unknown-iteration","publicly_accessible":"unknown-iteration","tags":"unknown-iteration"},"instance_attrs":[{"apply_immediately":true,"cluster_identifier":"\u003cunknown\u003e","db_parameter_group_name":"\u003cunknown\u003e","db_subnet_group_name":"\u003cunknown\u003e","engine":"aurora-mysql","engine_version":"8.0","identifier":"retail-store-ecs-catalog-one","instance_class":"db.t3.medium","monitoring_interval":0,"monitoring_role_arn":"\u003cunknown\u003e","preferred_maintenance_window":"sun:05:00-sun:06:00","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{}]}],"instance_keys":["one"],"attr_variables":{"identifier":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":175,"end_line":207}},{"id":"module.dependencies.module.catalog_rds.aws_rds_cluster_parameter_group.this","mode":"managed","provider":"aws","source_type":"aws_rds_cluster_parameter_group","name":"this","module_path":["dependencies","catalog_rds"],"category":"data","kind":"database_parameters","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"family":"aurora-mysql8.0","name_prefix":"retail-store-ecs-catalog-","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"instance_attrs":[{"family":"aurora-mysql8.0","name_prefix":"retail-store-ecs-catalog-","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}}],"instance_keys":["0"],"attr_variables":{"name_prefix":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":386,"end_line":409}},{"id":"module.dependencies.module.catalog_rds.aws_rds_cluster_role_association.this","mode":"managed","provider":"aws","source_type":"aws_rds_cluster_role_association","name":"this","module_path":["dependencies","catalog_rds"],"category":"data","kind":"db_cluster_role","facet_of":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"db_cluster_identifier":"\u003cunknown\u003e","feature_name":"\u003cunknown\u003e","role_arn":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":232,"end_line":238}},{"id":"module.dependencies.module.catalog_rds.aws_security_group.this","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"this","module_path":["dependencies","catalog_rds"],"category":"network","kind":"firewall_group","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"Control traffic to/from RDS Aurora retail-store-ecs-catalog","name_prefix":"retail-store-ecs-catalog-","tags":{"Name":"retail-store-ecs-catalog","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"vpc_id":"runtime-data"},"instance_attrs":[{"description":"Control traffic to/from RDS Aurora retail-store-ecs-catalog","name_prefix":"retail-store-ecs-catalog-","tags":{"Name":"retail-store-ecs-catalog","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"description":["environment_name"],"name_prefix":["environment_name"],"tags":["environment_name"],"vpc_id":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":321,"end_line":334}},{"id":"module.dependencies.module.catalog_rds.aws_security_group_rule.cidr_ingress","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"cidr_ingress","module_path":["dependencies","catalog_rds"],"category":"network","kind":"firewall_rule","facet_of":"module.dependencies.module.catalog_rds.aws_security_group.this","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_blocks":[],"description":"From allowed CIDRs","from_port":3306,"protocol":"tcp","security_group_id":"\u003cunknown\u003e","to_port":3306,"type":"ingress"},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":351,"end_line":362}},{"id":"module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"default_ingress","module_path":["dependencies","catalog_rds"],"category":"network","kind":"firewall_rule","facet_of":"module.dependencies.module.catalog_rds.aws_security_group.this","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"From allowed SGs","from_port":3306,"protocol":"tcp","security_group_id":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":3306,"type":"ingress"},"unknown":["security_group_id","source_security_group_id"],"unknown_causes":{"security_group_id":"provider-computed","source_security_group_id":"module-cycle"},"instance_attrs":[{"description":"From allowed SGs","from_port":3306,"protocol":"tcp","security_group_id":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":3306,"type":"ingress"}],"instance_keys":["0"],"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":337,"end_line":348}},{"id":"module.dependencies.module.catalog_rds.aws_security_group_rule.egress","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"egress","module_path":["dependencies","catalog_rds"],"category":"network","kind":"firewall_rule","facet_of":"module.dependencies.module.catalog_rds.aws_security_group.this","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_blocks":"\u003cunknown\u003e","description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","ipv6_cidr_blocks":"\u003cunknown\u003e","prefix_list_ids":"\u003cunknown\u003e","protocol":"tcp","security_group_id":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"egress"},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":364,"end_line":380}},{"id":"module.dependencies.module.catalog_rds.data.aws_iam_policy_document.monitoring_rds_assume_role","mode":"data","provider":"aws","source_type":"aws_iam_policy_document","name":"monitoring_rds_assume_role","module_path":["dependencies","catalog_rds"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"statement":[{"actions":["sts:AssumeRole"],"principals":[{"identifiers":["monitoring.rds.amazonaws.com"],"type":"Service"}]}]},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":244,"end_line":253}},{"id":"module.dependencies.module.catalog_rds.data.aws_partition.current","mode":"data","provider":"aws","source_type":"aws_partition","name":"current","module_path":["dependencies","catalog_rds"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":1,"end_line":1}},{"id":"module.dependencies.module.catalog_rds.random_id.snapshot_identifier","mode":"managed","provider":"random","source_type":"random_id","name":"snapshot_identifier","module_path":["dependencies","catalog_rds"],"category":"support","kind":"generated_value","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"byte_length":4,"keepers":{"redacted":true,"fingerprint":"06aa64292e1538f48312ba65fbc45c5314b4858396c5f5c26fbbed471827a6ad","byte_length":33,"format":"unknown"}},"attr_variables":{"keepers":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":33,"end_line":41}},{"id":"module.dependencies.module.catalog_rds.random_password.master_password","mode":"managed","provider":"random","source_type":"random_password","name":"master_password","module_path":["dependencies","catalog_rds"],"category":"support","kind":"generated_secret","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"length":10,"special":false},"provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":26,"end_line":31}},{"id":"module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu","mode":"managed","provider":"aws","source_type":"aws_cloudwatch_metric_alarm","name":"cache_cpu","module_path":["dependencies","checkout_elasticache_redis"],"category":"observability","kind":"metric_alarm","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"alarm_actions":[],"alarm_description":"Redis cluster CPU utilization","alarm_name":"\u003cunknown\u003e","comparison_operator":"GreaterThanThreshold","dimensions":{"CacheClusterId":"\u003cunknown\u003e"},"evaluation_periods":1,"metric_name":"CPUUtilization","namespace":"AWS/ElastiCache","ok_actions":[],"period":300,"statistic":"Average","tags":{"Name":"retail-store-ecs-checkout","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"threshold":75},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf","line":169,"end_line":191}},{"id":"module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory","mode":"managed","provider":"aws","source_type":"aws_cloudwatch_metric_alarm","name":"cache_memory","module_path":["dependencies","checkout_elasticache_redis"],"category":"observability","kind":"metric_alarm","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"alarm_actions":[],"alarm_description":"Redis cluster freeable memory","alarm_name":"\u003cunknown\u003e","comparison_operator":"LessThanThreshold","dimensions":{"CacheClusterId":"\u003cunknown\u003e"},"evaluation_periods":1,"metric_name":"FreeableMemory","namespace":"AWS/ElastiCache","ok_actions":[],"period":60,"statistic":"Average","tags":{"Name":"retail-store-ecs-checkout","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"threshold":10000000},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf","line":193,"end_line":215}},{"id":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_parameter_group.default","mode":"managed","provider":"aws","source_type":"aws_elasticache_parameter_group","name":"default","module_path":["dependencies","checkout_elasticache_redis"],"category":"data","kind":"cache_parameters","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"Elasticache parameter group for retail-store-ecs-checkout","family":"redis4.0","name":"retail-store-ecs-checkout","tags":{"Name":"retail-store-ecs-checkout","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"instance_attrs":[{"description":"Elasticache parameter group for retail-store-ecs-checkout","family":"redis4.0","name":"retail-store-ecs-checkout","tags":{"Name":"retail-store-ecs-checkout","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}}],"instance_keys":["0"],"attr_variables":{"description":["environment_name"],"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf","line":91,"end_line":113}},{"id":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","mode":"managed","provider":"aws","source_type":"aws_elasticache_replication_group","name":"default","module_path":["dependencies","checkout_elasticache_redis"],"category":"data","kind":"in_memory_cache","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"apply_immediately":true,"at_rest_encryption_enabled":false,"automatic_failover_enabled":false,"data_tiering_enabled":false,"description":"retail-store-ecs-checkout","engine_version":"4.0.10","maintenance_window":"wed:03:00-wed:04:00","multi_az_enabled":false,"node_type":"cache.t3.micro","notification_topic_arn":"","num_cache_clusters":1,"parameter_group_name":"\u003cunknown\u003e","port":6379,"replication_group_id":"retail-store-ecs-checkout","security_group_ids":["\u003cunknown\u003e"],"snapshot_arns":[],"snapshot_retention_limit":0,"snapshot_window":"06:30-07:30","subnet_group_name":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs-checkout","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"transit_encryption_enabled":false},"unknown":["parameter_group_name","security_group_ids","subnet_group_name"],"unknown_causes":{"parameter_group_name":"provider-computed","security_group_ids":"provider-computed","subnet_group_name":"provider-computed"},"instance_attrs":[{"apply_immediately":true,"at_rest_encryption_enabled":false,"automatic_failover_enabled":false,"data_tiering_enabled":false,"description":"retail-store-ecs-checkout","engine_version":"4.0.10","maintenance_window":"wed:03:00-wed:04:00","multi_az_enabled":false,"node_type":"cache.t3.micro","notification_topic_arn":"","num_cache_clusters":1,"parameter_group_name":"\u003cunknown\u003e","port":6379,"replication_group_id":"retail-store-ecs-checkout","security_group_ids":["\u003cunknown\u003e"],"snapshot_arns":[],"snapshot_retention_limit":0,"snapshot_window":"06:30-07:30","subnet_group_name":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs-checkout","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"transit_encryption_enabled":false}],"instance_keys":["0"],"attr_variables":{"description":["environment_name"],"replication_group_id":["environment_name"],"security_group_ids":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf","line":115,"end_line":164}},{"id":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_subnet_group.default","mode":"managed","provider":"aws","source_type":"aws_elasticache_subnet_group","name":"default","module_path":["dependencies","checkout_elasticache_redis"],"category":"network","kind":"cache_subnet_group","multiplicity":"count","enabled":true,"instances":-1,"presence":"CONDITIONAL","presence_cause":{"kind":"runtime-data","where":"count","expr":"module.this.enabled \u0026\u0026 var.elasticache_subnet_group_name == \"\" \u0026\u0026 length(var.subnets) \u003e 0 ? 1 : 0","decided_by":["module.vpc.module.vpc.aws_subnet.private"],"instances_bound":{"min":0,"max":1}},"attrs":{"description":"Elasticache subnet group for retail-store-ecs-checkout","name":"retail-store-ecs-checkout","subnet_ids":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs-checkout","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"unknown":["subnet_ids"],"unknown_causes":{"count":"runtime-data","subnet_ids":"runtime-data"},"attr_variables":{"description":["environment_name"],"name":["environment_name"],"subnet_ids":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf","line":83,"end_line":89}},{"id":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"cbd","module_path":["dependencies","checkout_elasticache_redis","aws_security_group"],"category":"network","kind":"firewall_group","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"Security group for Elasticache Redis","name_prefix":"retail-store-ecs-checkout-","revoke_rules_on_delete":false,"tags":{"Name":"retail-store-ecs-checkout","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{"create":"10m","delete":"15m"}],"vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"vpc_id":"runtime-data"},"instance_attrs":[{"description":"Security group for Elasticache Redis","name_prefix":"retail-store-ecs-checkout-","revoke_rules_on_delete":false,"tags":{"Name":"retail-store-ecs-checkout","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{"create":"10m","delete":"15m"}],"vpc_id":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"name_prefix":["environment_name"],"tags":["environment_name"],"vpc_id":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/main.tf","line":81,"end_line":139}},{"id":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"default","module_path":["dependencies","checkout_elasticache_redis","aws_security_group"],"category":"network","kind":"firewall_group","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"Security group for Elasticache Redis","name":"retail-store-ecs-checkout","revoke_rules_on_delete":false,"tags":{"Name":"retail-store-ecs-checkout","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{"create":"10m","delete":"15m"}],"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"name":["environment_name"],"tags":["environment_name"],"vpc_id":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/main.tf","line":24,"end_line":79}},{"id":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"keyed","module_path":["dependencies","checkout_elasticache_redis","aws_security_group"],"category":"network","kind":"firewall_rule","facet_of":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","multiplicity":"for_each","enabled":true,"instances":2,"presence":"KNOWN_PRESENT","attrs":{"cidr_blocks":"\u003cunknown\u003e","description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","ipv6_cidr_blocks":"\u003cunknown\u003e","prefix_list_ids":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","self":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"\u003cunknown\u003e"},"unknown":["cidr_blocks","description","from_port","ipv6_cidr_blocks","prefix_list_ids","protocol","security_group_id","self","source_security_group_id","to_port","type"],"unknown_causes":{"cidr_blocks":"unknown-iteration","description":"unknown-iteration","from_port":"unknown-iteration","ipv6_cidr_blocks":"unknown-iteration","prefix_list_ids":"unknown-iteration","protocol":"unknown-iteration","security_group_id":"provider-computed","self":"unknown-iteration","source_security_group_id":"unknown-iteration","to_port":"unknown-iteration","type":"unknown-iteration"},"instance_attrs":[{"cidr_blocks":["0.0.0.0/0"],"description":"Allow all egress","from_port":0,"ipv6_cidr_blocks":["::/0"],"prefix_list_ids":[],"protocol":"-1","security_group_id":"\u003cunknown\u003e","to_port":0,"type":"egress"},{"description":"Selectively allow inbound traffic","from_port":6379,"prefix_list_ids":[],"protocol":"tcp","security_group_id":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":6379,"type":"ingress"}],"instance_keys":["_allow_all_egress_","in#in#sg#0"],"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/main.tf","line":141,"end_line":163}},{"id":"module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default","mode":"managed","provider":"aws","source_type":"aws_route53_record","name":"default","module_path":["dependencies","checkout_elasticache_redis","dns"],"category":"network","kind":"dns_record","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"name":"retail-store-ecs-checkout","records":["\u003cunknown\u003e"],"ttl":60,"type":"CNAME","zone_id":""},"attr_variables":{"name":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis.dns/main.tf","line":1,"end_line":8}},{"id":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_policy.index_read_policy","mode":"managed","provider":"aws","source_type":"aws_appautoscaling_policy","name":"index_read_policy","module_path":["dependencies","dynamodb_carts"],"category":"compute","kind":"scaling_policy","facet_of":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.index_read","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"name":"\u003cunknown\u003e","policy_type":"TargetTrackingScaling","resource_id":"\u003cunknown\u003e","scalable_dimension":"\u003cunknown\u003e","service_namespace":"\u003cunknown\u003e","target_tracking_scaling_policy_configuration":[{"predefined_metric_specification":[{"predefined_metric_type":"DynamoDBReadCapacityUtilization"}],"scale_in_cooldown":"\u003cunknown\u003e","scale_out_cooldown":"\u003cunknown\u003e","target_value":"\u003cunknown\u003e"}]},"provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/autoscaling.tf","line":71,"end_line":89}},{"id":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_policy.index_write_policy","mode":"managed","provider":"aws","source_type":"aws_appautoscaling_policy","name":"index_write_policy","module_path":["dependencies","dynamodb_carts"],"category":"compute","kind":"scaling_policy","facet_of":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.index_write","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"name":"\u003cunknown\u003e","policy_type":"TargetTrackingScaling","resource_id":"\u003cunknown\u003e","scalable_dimension":"\u003cunknown\u003e","service_namespace":"\u003cunknown\u003e","target_tracking_scaling_policy_configuration":[{"predefined_metric_specification":[{"predefined_metric_type":"DynamoDBWriteCapacityUtilization"}],"scale_in_cooldown":"\u003cunknown\u003e","scale_out_cooldown":"\u003cunknown\u003e","target_value":"\u003cunknown\u003e"}]},"provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/autoscaling.tf","line":101,"end_line":119}},{"id":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_policy.table_read_policy","mode":"managed","provider":"aws","source_type":"aws_appautoscaling_policy","name":"table_read_policy","module_path":["dependencies","dynamodb_carts"],"category":"compute","kind":"scaling_policy","facet_of":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.table_read","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"name":"\u003cunknown\u003e","policy_type":"TargetTrackingScaling","resource_id":"\u003cunknown\u003e","scalable_dimension":"\u003cunknown\u003e","service_namespace":"\u003cunknown\u003e","target_tracking_scaling_policy_configuration":[{"predefined_metric_specification":[{"predefined_metric_type":"DynamoDBReadCapacityUtilization"}],"scale_in_cooldown":0,"scale_out_cooldown":0,"target_value":70}]},"provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/autoscaling.tf","line":11,"end_line":29}},{"id":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_policy.table_write_policy","mode":"managed","provider":"aws","source_type":"aws_appautoscaling_policy","name":"table_write_policy","module_path":["dependencies","dynamodb_carts"],"category":"compute","kind":"scaling_policy","facet_of":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.table_write","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"name":"\u003cunknown\u003e","policy_type":"TargetTrackingScaling","resource_id":"\u003cunknown\u003e","scalable_dimension":"\u003cunknown\u003e","service_namespace":"\u003cunknown\u003e","target_tracking_scaling_policy_configuration":[{"predefined_metric_specification":[{"predefined_metric_type":"DynamoDBWriteCapacityUtilization"}],"scale_in_cooldown":0,"scale_out_cooldown":0,"target_value":70}]},"provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/autoscaling.tf","line":41,"end_line":59}},{"id":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.index_read","mode":"managed","provider":"aws","source_type":"aws_appautoscaling_target","name":"index_read","module_path":["dependencies","dynamodb_carts"],"category":"compute","kind":"scaling_target","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"max_capacity":"\u003cunknown\u003e","min_capacity":"\u003cunknown\u003e","resource_id":"\u003cunknown\u003e","scalable_dimension":"dynamodb:index:ReadCapacityUnits","service_namespace":"dynamodb"},"provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/autoscaling.tf","line":61,"end_line":69}},{"id":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.index_write","mode":"managed","provider":"aws","source_type":"aws_appautoscaling_target","name":"index_write","module_path":["dependencies","dynamodb_carts"],"category":"compute","kind":"scaling_target","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"max_capacity":"\u003cunknown\u003e","min_capacity":"\u003cunknown\u003e","resource_id":"\u003cunknown\u003e","scalable_dimension":"dynamodb:index:WriteCapacityUnits","service_namespace":"dynamodb"},"provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/autoscaling.tf","line":91,"end_line":99}},{"id":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.table_read","mode":"managed","provider":"aws","source_type":"aws_appautoscaling_target","name":"table_read","module_path":["dependencies","dynamodb_carts"],"category":"compute","kind":"scaling_target","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"max_capacity":"\u003cunknown\u003e","resource_id":"\u003cunknown\u003e","scalable_dimension":"dynamodb:table:ReadCapacityUnits","service_namespace":"dynamodb"},"provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/autoscaling.tf","line":1,"end_line":9}},{"id":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.table_write","mode":"managed","provider":"aws","source_type":"aws_appautoscaling_target","name":"table_write","module_path":["dependencies","dynamodb_carts"],"category":"compute","kind":"scaling_target","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"max_capacity":"\u003cunknown\u003e","resource_id":"\u003cunknown\u003e","scalable_dimension":"dynamodb:table:WriteCapacityUnits","service_namespace":"dynamodb"},"provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/autoscaling.tf","line":31,"end_line":39}},{"id":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","mode":"managed","provider":"aws","source_type":"aws_dynamodb_table","name":"autoscaled","module_path":["dependencies","dynamodb_carts"],"category":"data","kind":"nosql_table","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"attribute":[{"name":"id","type":"S"},{"name":"customerId","type":"S"}],"billing_mode":"PAY_PER_REQUEST","global_secondary_index":[{"hash_key":"customerId","name":"idx_global_customerId","projection_type":"ALL"}],"hash_key":"id","name":"retail-store-ecs-carts","point_in_time_recovery":[{"enabled":false}],"server_side_encryption":[{"enabled":false}],"stream_enabled":false,"tags":{"Name":"retail-store-ecs-carts","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{"create":"10m","delete":"10m","update":"60m"}],"ttl":[{"attribute_name":"","enabled":false}]},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/main.tf","line":88,"end_line":177}},{"id":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","mode":"managed","provider":"aws","source_type":"aws_dynamodb_table","name":"autoscaled_gsi_ignore","module_path":["dependencies","dynamodb_carts"],"category":"data","kind":"nosql_table","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"attribute":[{"name":"id","type":"S"},{"name":"customerId","type":"S"}],"billing_mode":"PAY_PER_REQUEST","global_secondary_index":[{"hash_key":"customerId","name":"idx_global_customerId","projection_type":"ALL"}],"hash_key":"id","name":"retail-store-ecs-carts","point_in_time_recovery":[{"enabled":false}],"server_side_encryption":[{"enabled":false}],"stream_enabled":false,"tags":{"Name":"retail-store-ecs-carts","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{"create":"10m","delete":"10m","update":"60m"}],"ttl":[{"attribute_name":"","enabled":false}]},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/main.tf","line":179,"end_line":268}},{"id":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","mode":"managed","provider":"aws","source_type":"aws_dynamodb_table","name":"this","module_path":["dependencies","dynamodb_carts"],"category":"data","kind":"nosql_table","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"attribute":[{"name":"id","type":"S"},{"name":"customerId","type":"S"}],"billing_mode":"PAY_PER_REQUEST","global_secondary_index":[{"hash_key":"customerId","name":"idx_global_customerId","projection_type":"ALL"}],"hash_key":"id","name":"retail-store-ecs-carts","point_in_time_recovery":[{"enabled":false}],"server_side_encryption":[{"enabled":false}],"stream_enabled":false,"tags":{"Name":"retail-store-ecs-carts","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{"create":"10m","delete":"10m","update":"60m"}],"ttl":[{"attribute_name":"","enabled":false}]},"instance_attrs":[{"attribute":[{"name":"id","type":"S"},{"name":"customerId","type":"S"}],"billing_mode":"PAY_PER_REQUEST","global_secondary_index":[{"hash_key":"customerId","name":"idx_global_customerId","projection_type":"ALL"}],"hash_key":"id","name":"retail-store-ecs-carts","point_in_time_recovery":[{"enabled":false}],"server_side_encryption":[{"enabled":false}],"stream_enabled":false,"tags":{"Name":"retail-store-ecs-carts","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{"create":"10m","delete":"10m","update":"60m"}],"ttl":[{"attribute_name":"","enabled":false}]}],"instance_keys":["0"],"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/main.tf","line":1,"end_line":86}},{"id":"module.dependencies.module.orders_rds.aws_appautoscaling_policy.this","mode":"managed","provider":"aws","source_type":"aws_appautoscaling_policy","name":"this","module_path":["dependencies","orders_rds"],"category":"compute","kind":"scaling_policy","facet_of":"module.dependencies.module.orders_rds.aws_rds_cluster.this","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"name":"target-metric","policy_type":"TargetTrackingScaling","resource_id":"\u003cunknown\u003e","scalable_dimension":"rds:cluster:ReadReplicaCount","service_namespace":"rds","target_tracking_scaling_policy_configuration":[{"predefined_metric_specification":[{"predefined_metric_type":"RDSReaderAverageCPUUtilization"}],"scale_in_cooldown":300,"scale_out_cooldown":300,"target_value":70}]},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":293,"end_line":315}},{"id":"module.dependencies.module.orders_rds.aws_appautoscaling_target.this","mode":"managed","provider":"aws","source_type":"aws_appautoscaling_target","name":"this","module_path":["dependencies","orders_rds"],"category":"compute","kind":"scaling_target","facet_of":"module.dependencies.module.orders_rds.aws_rds_cluster.this","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"max_capacity":2,"min_capacity":0,"resource_id":"\u003cunknown\u003e","scalable_dimension":"rds:cluster:ReadReplicaCount","service_namespace":"rds"},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":283,"end_line":291}},{"id":"module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this","mode":"managed","provider":"aws","source_type":"aws_cloudwatch_log_group","name":"this","module_path":["dependencies","orders_rds"],"category":"observability","kind":"log_group","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"name":"\u003cunknown\u003e","retention_in_days":7,"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":445,"end_line":453}},{"id":"module.dependencies.module.orders_rds.aws_db_parameter_group.this","mode":"managed","provider":"aws","source_type":"aws_db_parameter_group","name":"this","module_path":["dependencies","orders_rds"],"category":"data","kind":"database_parameters","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"family":"aurora-postgresql15","name_prefix":"retail-store-ecs-orders-","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"instance_attrs":[{"family":"aurora-postgresql15","name_prefix":"retail-store-ecs-orders-","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}}],"instance_keys":["0"],"attr_variables":{"name_prefix":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":415,"end_line":438}},{"id":"module.dependencies.module.orders_rds.aws_db_subnet_group.this","mode":"managed","provider":"aws","source_type":"aws_db_subnet_group","name":"this","module_path":["dependencies","orders_rds"],"category":"network","kind":"database_subnet_group","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"For Aurora cluster retail-store-ecs-orders","name":"retail-store-ecs-orders","subnet_ids":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"unknown":["subnet_ids"],"unknown_causes":{"subnet_ids":"runtime-data"},"instance_attrs":[{"description":"For Aurora cluster retail-store-ecs-orders","name":"retail-store-ecs-orders","subnet_ids":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}}],"instance_keys":["0"],"attr_variables":{"description":["environment_name"],"name":["environment_name"],"subnet_ids":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":47,"end_line":55}},{"id":"module.dependencies.module.orders_rds.aws_iam_role.rds_enhanced_monitoring","mode":"managed","provider":"aws","source_type":"aws_iam_role","name":"rds_enhanced_monitoring","module_path":["dependencies","orders_rds"],"category":"identity","kind":"iam_role","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"assume_role_policy":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"monitoring.rds.amazonaws.com\"\n      }\n    }\n  ]\n}","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":255,"end_line":270}},{"id":"module.dependencies.module.orders_rds.aws_iam_role_policy_attachment.rds_enhanced_monitoring","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"rds_enhanced_monitoring","module_path":["dependencies","orders_rds"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.dependencies.module.orders_rds.aws_iam_role.rds_enhanced_monitoring","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":272,"end_line":277}},{"id":"module.dependencies.module.orders_rds.aws_rds_cluster.this","mode":"managed","provider":"aws","source_type":"aws_rds_cluster","name":"this","module_path":["dependencies","orders_rds"],"category":"data","kind":"relational_database_cluster","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"allow_major_version_upgrade":false,"apply_immediately":true,"backtrack_window":0,"backup_retention_period":7,"cluster_identifier":"retail-store-ecs-orders","database_name":"orders","db_cluster_parameter_group_name":"\u003cunknown\u003e","db_subnet_group_name":"\u003cunknown\u003e","enabled_cloudwatch_logs_exports":[],"engine":"aurora-postgresql","engine_mode":"provisioned","engine_version":"15.10","master_password":"\u003cunknown\u003e","master_username":"root","port":5432,"preferred_backup_window":"02:00-03:00","preferred_maintenance_window":"sun:05:00-sun:06:00","skip_final_snapshot":true,"storage_encrypted":true,"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{}],"vpc_security_group_ids":"\u003cunknown\u003e"},"unknown":["db_cluster_parameter_group_name","db_subnet_group_name","master_password","vpc_security_group_ids"],"unknown_causes":{"db_cluster_parameter_group_name":"provider-computed","db_subnet_group_name":"provider-computed","master_password":"provider-computed","vpc_security_group_ids":"provider-computed"},"instance_attrs":[{"allow_major_version_upgrade":false,"apply_immediately":true,"backtrack_window":0,"backup_retention_period":7,"cluster_identifier":"retail-store-ecs-orders","database_name":"orders","db_cluster_parameter_group_name":"\u003cunknown\u003e","db_subnet_group_name":"\u003cunknown\u003e","enabled_cloudwatch_logs_exports":[],"engine":"aurora-postgresql","engine_mode":"provisioned","engine_version":"15.10","master_password":"\u003cunknown\u003e","master_username":"root","port":5432,"preferred_backup_window":"02:00-03:00","preferred_maintenance_window":"sun:05:00-sun:06:00","skip_final_snapshot":true,"storage_encrypted":true,"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{}],"vpc_security_group_ids":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"cluster_identifier":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":61,"end_line":169}},{"id":"module.dependencies.module.orders_rds.aws_rds_cluster_endpoint.this","mode":"managed","provider":"aws","source_type":"aws_rds_cluster_endpoint","name":"this","module_path":["dependencies","orders_rds"],"category":"data","kind":"db_endpoint","facet_of":"module.dependencies.module.orders_rds.aws_rds_cluster.this","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cluster_endpoint_identifier":"\u003cunknown\u003e","cluster_identifier":"\u003cunknown\u003e","custom_endpoint_type":"\u003cunknown\u003e","excluded_members":"\u003cunknown\u003e","static_members":"\u003cunknown\u003e","tags":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":213,"end_line":226}},{"id":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","mode":"managed","provider":"aws","source_type":"aws_rds_cluster_instance","name":"this","module_path":["dependencies","orders_rds"],"category":"data","kind":"relational_database_cluster_member","facet_of":"module.dependencies.module.orders_rds.aws_rds_cluster.this","multiplicity":"for_each","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"apply_immediately":"\u003cunknown\u003e","auto_minor_version_upgrade":"\u003cunknown\u003e","availability_zone":"\u003cunknown\u003e","cluster_identifier":"\u003cunknown\u003e","copy_tags_to_snapshot":"\u003cunknown\u003e","db_parameter_group_name":"\u003cunknown\u003e","db_subnet_group_name":"\u003cunknown\u003e","engine":"aurora-postgresql","engine_version":"15.10","identifier":"\u003cunknown\u003e","instance_class":"\u003cunknown\u003e","monitoring_interval":"\u003cunknown\u003e","monitoring_role_arn":"\u003cunknown\u003e","performance_insights_enabled":"\u003cunknown\u003e","performance_insights_kms_key_id":"\u003cunknown\u003e","performance_insights_retention_period":"\u003cunknown\u003e","preferred_maintenance_window":"\u003cunknown\u003e","promotion_tier":"\u003cunknown\u003e","publicly_accessible":"\u003cunknown\u003e","tags":"\u003cunknown\u003e","timeouts":[{}]},"unknown":["apply_immediately","auto_minor_version_upgrade","availability_zone","cluster_identifier","copy_tags_to_snapshot","db_parameter_group_name","db_subnet_group_name","identifier","instance_class","monitoring_interval","monitoring_role_arn","performance_insights_enabled","performance_insights_kms_key_id","performance_insights_retention_period","preferred_maintenance_window","promotion_tier","publicly_accessible","tags"],"unknown_causes":{"apply_immediately":"unknown-iteration","auto_minor_version_upgrade":"unknown-iteration","availability_zone":"unknown-iteration","cluster_identifier":"provider-computed","copy_tags_to_snapshot":"unknown-iteration","db_parameter_group_name":"provider-computed","db_subnet_group_name":"provider-computed","identifier":"unknown-iteration","instance_class":"unknown-iteration","monitoring_interval":"unknown-iteration","monitoring_role_arn":"provider-computed","performance_insights_enabled":"unknown-iteration","performance_insights_kms_key_id":"unknown-iteration","performance_insights_retention_period":"unknown-iteration","preferred_maintenance_window":"unknown-iteration","promotion_tier":"unknown-iteration","publicly_accessible":"unknown-iteration","tags":"unknown-iteration"},"instance_attrs":[{"apply_immediately":true,"cluster_identifier":"\u003cunknown\u003e","db_parameter_group_name":"\u003cunknown\u003e","db_subnet_group_name":"\u003cunknown\u003e","engine":"aurora-postgresql","engine_version":"15.10","identifier":"retail-store-ecs-orders-one","instance_class":"db.t3.medium","monitoring_interval":0,"monitoring_role_arn":"\u003cunknown\u003e","preferred_maintenance_window":"sun:05:00-sun:06:00","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{}]}],"instance_keys":["one"],"attr_variables":{"identifier":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":175,"end_line":207}},{"id":"module.dependencies.module.orders_rds.aws_rds_cluster_parameter_group.this","mode":"managed","provider":"aws","source_type":"aws_rds_cluster_parameter_group","name":"this","module_path":["dependencies","orders_rds"],"category":"data","kind":"database_parameters","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"family":"aurora-postgresql15","name_prefix":"retail-store-ecs-orders-","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"instance_attrs":[{"family":"aurora-postgresql15","name_prefix":"retail-store-ecs-orders-","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}}],"instance_keys":["0"],"attr_variables":{"name_prefix":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":386,"end_line":409}},{"id":"module.dependencies.module.orders_rds.aws_rds_cluster_role_association.this","mode":"managed","provider":"aws","source_type":"aws_rds_cluster_role_association","name":"this","module_path":["dependencies","orders_rds"],"category":"data","kind":"db_cluster_role","facet_of":"module.dependencies.module.orders_rds.aws_rds_cluster.this","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"db_cluster_identifier":"\u003cunknown\u003e","feature_name":"\u003cunknown\u003e","role_arn":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":232,"end_line":238}},{"id":"module.dependencies.module.orders_rds.aws_security_group.this","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"this","module_path":["dependencies","orders_rds"],"category":"network","kind":"firewall_group","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"Control traffic to/from RDS Aurora retail-store-ecs-orders","name_prefix":"retail-store-ecs-orders-","tags":{"Name":"retail-store-ecs-orders","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"vpc_id":"runtime-data"},"instance_attrs":[{"description":"Control traffic to/from RDS Aurora retail-store-ecs-orders","name_prefix":"retail-store-ecs-orders-","tags":{"Name":"retail-store-ecs-orders","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"description":["environment_name"],"name_prefix":["environment_name"],"tags":["environment_name"],"vpc_id":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":321,"end_line":334}},{"id":"module.dependencies.module.orders_rds.aws_security_group_rule.cidr_ingress","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"cidr_ingress","module_path":["dependencies","orders_rds"],"category":"network","kind":"firewall_rule","facet_of":"module.dependencies.module.orders_rds.aws_security_group.this","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_blocks":[],"description":"From allowed CIDRs","from_port":5432,"protocol":"tcp","security_group_id":"\u003cunknown\u003e","to_port":5432,"type":"ingress"},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":351,"end_line":362}},{"id":"module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"default_ingress","module_path":["dependencies","orders_rds"],"category":"network","kind":"firewall_rule","facet_of":"module.dependencies.module.orders_rds.aws_security_group.this","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"From allowed SGs","from_port":5432,"protocol":"tcp","security_group_id":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":5432,"type":"ingress"},"unknown":["security_group_id","source_security_group_id"],"unknown_causes":{"security_group_id":"provider-computed","source_security_group_id":"module-cycle"},"instance_attrs":[{"description":"From allowed SGs","from_port":5432,"protocol":"tcp","security_group_id":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":5432,"type":"ingress"}],"instance_keys":["0"],"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":337,"end_line":348}},{"id":"module.dependencies.module.orders_rds.aws_security_group_rule.egress","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"egress","module_path":["dependencies","orders_rds"],"category":"network","kind":"firewall_rule","facet_of":"module.dependencies.module.orders_rds.aws_security_group.this","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_blocks":"\u003cunknown\u003e","description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","ipv6_cidr_blocks":"\u003cunknown\u003e","prefix_list_ids":"\u003cunknown\u003e","protocol":"tcp","security_group_id":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"egress"},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":364,"end_line":380}},{"id":"module.dependencies.module.orders_rds.data.aws_iam_policy_document.monitoring_rds_assume_role","mode":"data","provider":"aws","source_type":"aws_iam_policy_document","name":"monitoring_rds_assume_role","module_path":["dependencies","orders_rds"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"statement":[{"actions":["sts:AssumeRole"],"principals":[{"identifiers":["monitoring.rds.amazonaws.com"],"type":"Service"}]}]},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":244,"end_line":253}},{"id":"module.dependencies.module.orders_rds.data.aws_partition.current","mode":"data","provider":"aws","source_type":"aws_partition","name":"current","module_path":["dependencies","orders_rds"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":1,"end_line":1}},{"id":"module.dependencies.module.orders_rds.random_id.snapshot_identifier","mode":"managed","provider":"random","source_type":"random_id","name":"snapshot_identifier","module_path":["dependencies","orders_rds"],"category":"support","kind":"generated_value","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"byte_length":4,"keepers":{"redacted":true,"fingerprint":"50e42769321d81ffe076fdd81cfd56519e518d4e827a034b12a8961f4004d78a","byte_length":32,"format":"unknown"}},"attr_variables":{"keepers":["environment_name"]},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":33,"end_line":41}},{"id":"module.dependencies.module.orders_rds.random_password.master_password","mode":"managed","provider":"random","source_type":"random_password","name":"master_password","module_path":["dependencies","orders_rds"],"category":"support","kind":"generated_secret","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"length":10,"special":false},"provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":26,"end_line":31}},{"id":"module.dependencies.random_password.mq_password","mode":"managed","provider":"random","source_type":"random_password","name":"mq_password","module_path":["dependencies"],"category":"support","kind":"generated_secret","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"length":16,"override_special":"!#$%\u0026*()-_+{}\u003c\u003e?","special":true},"provenance":{"file":"../../lib/dependencies/mq.tf","line":6,"end_line":10}},{"id":"module.dependencies.random_string.catalog_db_master","mode":"managed","provider":"random","source_type":"random_string","name":"catalog_db_master","module_path":["dependencies"],"category":"support","kind":"generated_value","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"length":10,"special":false},"provenance":{"file":"../../lib/dependencies/catalog_rds.tf","line":38,"end_line":41}},{"id":"module.dependencies.random_string.catalog_opensearch_master","mode":"managed","provider":"random","source_type":"random_string","name":"catalog_opensearch_master","module_path":["dependencies"],"category":"support","kind":"generated_value","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"length":10,"lower":true,"min_lower":1,"min_numeric":1,"min_special":1,"min_upper":1,"numeric":true,"override_special":"#","special":true,"upper":true},"provenance":{"file":"../../lib/dependencies/catalog_opensearch.tf","line":1,"end_line":12}},{"id":"module.dependencies.random_string.orders_db_master","mode":"managed","provider":"random","source_type":"random_string","name":"orders_db_master","module_path":["dependencies"],"category":"support","kind":"generated_value","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"length":10,"special":false},"provenance":{"file":"../../lib/dependencies/orders_rds.tf","line":37,"end_line":40}},{"id":"module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events","mode":"managed","provider":"aws","source_type":"aws_cloudwatch_event_rule","name":"ecs_events","module_path":["retail_app_ecs"],"category":"messaging","kind":"event_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"(var.container_insights_setting == \"enhanced\" \u0026\u0026 var.lifecycle_events_enabled) ? 1 : 0","variables":["var.container_insights_setting","var.lifecycle_events_enabled"]},"attrs":{"description":"This rule is used to export to CloudWatch Logs the lifecycle events of the ECS Cluster retail-store-ecs-cluster.","event_pattern":"\u003cunknown\u003e","name":"\u003cunknown\u003e"},"attr_variables":{"description":["environment_name"],"event_pattern":["environment_name"]},"provenance":{"file":"../../lib/ecs/eventbridge.tf","line":18,"end_line":29}},{"id":"module.retail_app_ecs.aws_cloudwatch_event_target.ecs_events_target","mode":"managed","provider":"aws","source_type":"aws_cloudwatch_event_target","name":"ecs_events_target","module_path":["retail_app_ecs"],"category":"messaging","kind":"event_target","facet_of":"module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events","multiplicity":"count","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"(var.container_insights_setting == \"enhanced\" \u0026\u0026 var.lifecycle_events_enabled) ? 1 : 0","variables":["var.container_insights_setting","var.lifecycle_events_enabled"]},"attrs":{"arn":"\u003cunknown\u003e","rule":"\u003cunknown\u003e","target_id":"\u003cunknown\u003e"},"provenance":{"file":"../../lib/ecs/eventbridge.tf","line":31,"end_line":36}},{"id":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights","mode":"managed","provider":"aws","source_type":"aws_cloudwatch_log_group","name":"ecs_container_insights","module_path":["retail_app_ecs"],"category":"observability","kind":"log_group","multiplicity":"count","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"(var.container_insights_setting == \"enhanced\" \u0026\u0026 var.lifecycle_events_enabled) ? 1 : 0","variables":["var.container_insights_setting","var.lifecycle_events_enabled"]},"attrs":{"name":"/aws/events/ecs/containerinsights/retail-store-ecs-cluster/performance","tags":{"ClusterName":"retail-store-ecs-cluster","EventBridge-AssociatedRuleName":"\u003cunknown\u003e"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/eventbridge.tf","line":8,"end_line":16}},{"id":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","mode":"managed","provider":"aws","source_type":"aws_cloudwatch_log_group","name":"ecs_tasks","module_path":["retail_app_ecs"],"category":"observability","kind":"log_group","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"name":"retail-store-ecs-tasks"},"attr_variables":{"name":["environment_name"]},"provenance":{"file":"../../lib/ecs/cluster.tf","line":10,"end_line":12}},{"id":"module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs","mode":"managed","provider":"aws","source_type":"aws_cloudwatch_log_resource_policy","name":"eventbridge_ecs","module_path":["retail_app_ecs"],"category":"observability","kind":"log_resource_policy","multiplicity":"count","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"(var.container_insights_setting == \"enhanced\" \u0026\u0026 var.lifecycle_events_enabled) ? 1 : 0","variables":["var.container_insights_setting","var.lifecycle_events_enabled"]},"attrs":{"policy_document":"\u003cunknown\u003e","policy_name":"EventBridge-ECS-ContainerInsights"},"provenance":{"file":"../../lib/ecs/eventbridge.tf","line":38,"end_line":57}},{"id":"module.retail_app_ecs.aws_ecs_cluster.cluster","mode":"managed","provider":"aws","source_type":"aws_ecs_cluster","name":"cluster","module_path":["retail_app_ecs"],"category":"compute","kind":"container_cluster","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"name":"retail-store-ecs-cluster","setting":[{"name":"containerInsights","value":"enhanced"}]},"attr_variables":{"name":["environment_name"],"setting[0].value":["container_insights_setting"]},"provenance":{"file":"../../lib/ecs/cluster.tf","line":1,"end_line":8}},{"id":"module.retail_app_ecs.aws_iam_policy.catalog_policy","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"catalog_policy","module_path":["retail_app_ecs"],"category":"identity","kind":"iam_policy","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"Policy for catalog","name":"retail-store-ecs-catalog","path":"/","policy":"\u003cunknown\u003e"},"unknown":["policy"],"unknown_causes":{"policy":"runtime-data"},"attr_variables":{"name":["environment_name"]},"provenance":{"file":"../../lib/ecs/catalog.tf","line":52,"end_line":58}},{"id":"module.retail_app_ecs.aws_iam_policy.orders_policy","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"orders_policy","module_path":["retail_app_ecs"],"category":"identity","kind":"iam_policy","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"Policy for orders","name":"retail-store-ecs-orders","path":"/","policy":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"unknown":["policy"],"unknown_causes":{"policy":"runtime-data"},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/orders.tf","line":54,"end_line":61}},{"id":"module.retail_app_ecs.aws_kms_key.cmk","mode":"managed","provider":"aws","source_type":"aws_kms_key","name":"cmk","module_path":["retail_app_ecs"],"category":"identity","kind":"encryption_key","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"deletion_window_in_days":7,"description":"retail-store-ecs CMK"},"attr_variables":{"description":["environment_name"]},"provenance":{"file":"../../lib/ecs/common.tf","line":1,"end_line":4}},{"id":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","mode":"managed","provider":"aws","source_type":"aws_secretsmanager_secret","name":"catalog_db","module_path":["retail_app_ecs"],"category":"identity","kind":"secret","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"kms_key_id":"\u003cunknown\u003e","name":"\u003cunknown\u003e"},"unknown":["kms_key_id","name"],"unknown_causes":{"kms_key_id":"provider-computed","name":"provider-computed"},"attr_variables":{"name":["environment_name"]},"provenance":{"file":"../../lib/ecs/catalog.tf","line":65,"end_line":68}},{"id":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","mode":"managed","provider":"aws","source_type":"aws_secretsmanager_secret","name":"catalog_opensearch","module_path":["retail_app_ecs"],"category":"identity","kind":"secret","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"kms_key_id":"\u003cunknown\u003e","name":"\u003cunknown\u003e"},"unknown":["kms_key_id","name"],"unknown_causes":{"kms_key_id":"provider-computed","name":"provider-computed"},"attr_variables":{"name":["environment_name"]},"provenance":{"file":"../../lib/ecs/catalog.tf","line":82,"end_line":85}},{"id":"module.retail_app_ecs.aws_secretsmanager_secret.mq","mode":"managed","provider":"aws","source_type":"aws_secretsmanager_secret","name":"mq","module_path":["retail_app_ecs"],"category":"identity","kind":"secret","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"name":"\u003cunknown\u003e"},"unknown":["name"],"unknown_causes":{"name":"provider-computed"},"attr_variables":{"name":["environment_name"]},"provenance":{"file":"../../lib/ecs/common.tf","line":11,"end_line":13}},{"id":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","mode":"managed","provider":"aws","source_type":"aws_secretsmanager_secret","name":"orders_db","module_path":["retail_app_ecs"],"category":"identity","kind":"secret","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"name":"\u003cunknown\u003e"},"unknown":["name"],"unknown_causes":{"name":"provider-computed"},"attr_variables":{"name":["environment_name"]},"provenance":{"file":"../../lib/ecs/orders.tf","line":68,"end_line":70}},{"id":"module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db","mode":"managed","provider":"aws","source_type":"aws_secretsmanager_secret_version","name":"catalog_db","module_path":["retail_app_ecs"],"category":"identity","kind":"secret_value","facet_of":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"secret_id":"\u003cunknown\u003e","secret_string":"\u003cunknown\u003e"},"unknown":["secret_id","secret_string"],"unknown_causes":{"secret_id":"provider-computed","secret_string":"sensitive"},"attr_variables":{"secret_string":["environment_name"]},"provenance":{"file":"../../lib/ecs/catalog.tf","line":70,"end_line":80}},{"id":"module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch","mode":"managed","provider":"aws","source_type":"aws_secretsmanager_secret_version","name":"catalog_opensearch","module_path":["retail_app_ecs"],"category":"identity","kind":"secret_value","facet_of":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"secret_id":"\u003cunknown\u003e","secret_string":"\u003cunknown\u003e"},"unknown":["secret_id","secret_string"],"unknown_causes":{"secret_id":"provider-computed","secret_string":"sensitive"},"attr_variables":{"secret_string":["environment_name"]},"provenance":{"file":"../../lib/ecs/catalog.tf","line":87,"end_line":96}},{"id":"module.retail_app_ecs.aws_secretsmanager_secret_version.mq","mode":"managed","provider":"aws","source_type":"aws_secretsmanager_secret_version","name":"mq","module_path":["retail_app_ecs"],"category":"identity","kind":"secret_value","facet_of":"module.retail_app_ecs.aws_secretsmanager_secret.mq","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"secret_id":"\u003cunknown\u003e","secret_string":"\u003cunknown\u003e"},"unknown":["secret_id","secret_string"],"unknown_causes":{"secret_id":"provider-computed","secret_string":"sensitive"},"attr_variables":{"secret_string":["environment_name"]},"provenance":{"file":"../../lib/ecs/common.tf","line":15,"end_line":25}},{"id":"module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db","mode":"managed","provider":"aws","source_type":"aws_secretsmanager_secret_version","name":"orders_db","module_path":["retail_app_ecs"],"category":"identity","kind":"secret_value","facet_of":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"secret_id":"\u003cunknown\u003e","secret_string":"\u003cunknown\u003e"},"unknown":["secret_id","secret_string"],"unknown_causes":{"secret_id":"provider-computed","secret_string":"sensitive"},"attr_variables":{"secret_string":["environment_name"]},"provenance":{"file":"../../lib/ecs/orders.tf","line":72,"end_line":82}},{"id":"module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this","mode":"managed","provider":"aws","source_type":"aws_service_discovery_private_dns_namespace","name":"this","module_path":["retail_app_ecs"],"category":"network","kind":"service_discovery","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"Service discovery namespace","name":"retailstore.local","vpc":"\u003cunknown\u003e"},"unknown":["vpc"],"unknown_causes":{"vpc":"runtime-data"},"attr_variables":{"vpc":["environment_name"]},"provenance":{"file":"../../lib/ecs/cluster.tf","line":14,"end_line":18}},{"id":"module.retail_app_ecs.data.aws_caller_identity.current","mode":"data","provider":"aws","source_type":"aws_caller_identity","name":"current","module_path":["retail_app_ecs"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/ecs/eventbridge.tf","line":1,"end_line":1}},{"id":"module.retail_app_ecs.data.aws_iam_policy_document.catalog_db_secret","mode":"data","provider":"aws","source_type":"aws_iam_policy_document","name":"catalog_db_secret","module_path":["retail_app_ecs"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"statement":[{"actions":["kms:Decrypt*","secretsmanager:GetSecretValue"],"effect":"Allow","resources":["\u003cunknown\u003e","\u003cunknown\u003e","\u003cunknown\u003e"],"sid":""}]},"unknown":["statement.resources"],"unknown_causes":{"statement.resources":"provider-computed"},"provenance":{"file":"../../lib/ecs/catalog.tf","line":36,"end_line":50}},{"id":"module.retail_app_ecs.data.aws_iam_policy_document.orders_db_secret","mode":"data","provider":"aws","source_type":"aws_iam_policy_document","name":"orders_db_secret","module_path":["retail_app_ecs"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"statement":[{"actions":["kms:Decrypt*","secretsmanager:GetSecretValue"],"effect":"Allow","resources":["\u003cunknown\u003e","\u003cunknown\u003e","\u003cunknown\u003e"],"sid":""}]},"unknown":["statement.resources"],"unknown_causes":{"statement.resources":"provider-computed"},"provenance":{"file":"../../lib/ecs/orders.tf","line":38,"end_line":52}},{"id":"module.retail_app_ecs.data.aws_region.current","mode":"data","provider":"aws","source_type":"aws_region","name":"current","module_path":["retail_app_ecs"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/ecs/eventbridge.tf","line":2,"end_line":2}},{"id":"module.retail_app_ecs.module.alb.aws_lambda_permission.lb","mode":"managed","provider":"aws","source_type":"aws_lambda_permission","name":"lb","module_path":["retail_app_ecs","alb"],"category":"compute","kind":"function_trigger_permission","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"action":"\u003cunknown\u003e","event_source_token":"\u003cunknown\u003e","function_name":"\u003cunknown\u003e","principal":"\u003cunknown\u003e","qualifier":"\u003cunknown\u003e","source_account":"\u003cunknown\u003e","source_arn":"\u003cunknown\u003e","statement_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":155,"end_line":167}},{"id":"module.retail_app_ecs.module.alb.aws_lb.this","mode":"managed","provider":"aws","source_type":"aws_lb","name":"this","module_path":["retail_app_ecs","alb"],"category":"network","kind":"load_balancer","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"desync_mitigation_mode":"defensive","drop_invalid_header_fields":false,"enable_cross_zone_load_balancing":false,"enable_deletion_protection":false,"enable_http2":true,"enable_tls_version_and_cipher_suite_headers":false,"enable_waf_fail_open":false,"enable_xff_client_port":true,"idle_timeout":60,"internal":false,"ip_address_type":"ipv4","load_balancer_type":"application","name":"retail-store-ecs-ui","preserve_host_header":false,"security_groups":["\u003cunknown\u003e","\u003cunknown\u003e"],"subnets":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs-ui"},"timeouts":[{"create":"10m","delete":"10m","update":"10m"}],"xff_header_processing_mode":"append"},"unknown":["security_groups","subnets"],"unknown_causes":{"security_groups":"provider-computed","subnets":"runtime-data"},"instance_attrs":[{"desync_mitigation_mode":"defensive","drop_invalid_header_fields":false,"enable_cross_zone_load_balancing":false,"enable_deletion_protection":false,"enable_http2":true,"enable_tls_version_and_cipher_suite_headers":false,"enable_waf_fail_open":false,"enable_xff_client_port":true,"idle_timeout":60,"internal":false,"ip_address_type":"ipv4","load_balancer_type":"application","name":"retail-store-ecs-ui","preserve_host_header":false,"security_groups":["\u003cunknown\u003e","\u003cunknown\u003e"],"subnets":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs-ui"},"timeouts":[{"create":"10m","delete":"10m","update":"10m"}],"xff_header_processing_mode":"append"}],"instance_keys":["0"],"attr_variables":{"name":["environment_name"],"security_groups":["environment_name"],"subnets":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":5,"end_line":63}},{"id":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp","mode":"managed","provider":"aws","source_type":"aws_lb_listener","name":"frontend_http_tcp","module_path":["retail_app_ecs","alb"],"category":"network","kind":"load_balancer_listener","facet_of":"module.retail_app_ecs.module.alb.aws_lb.this","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"default_action":[{"_dynamic":"unknown for_each","_template":{"fixed_response":[{"_dynamic":"unknown for_each","_template":{"content_type":"\u003cunknown\u003e","message_body":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"},"content_type":"\u003cunknown\u003e","message_body":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"forward":[{"_dynamic":"unknown for_each","_template":{"stickiness":[{"_dynamic":"unknown for_each","_template":{"duration":"\u003cunknown\u003e","enabled":"\u003cunknown\u003e"},"duration":"\u003cunknown\u003e","enabled":"\u003cunknown\u003e"}],"target_group":[{"_dynamic":"unknown for_each","_template":{"arn":"\u003cunknown\u003e","weight":"\u003cunknown\u003e"},"arn":"\u003cunknown\u003e","weight":"\u003cunknown\u003e"}]},"stickiness":[{"_dynamic":"unknown for_each","duration":"\u003cunknown\u003e","enabled":"\u003cunknown\u003e"}],"target_group":[{"_dynamic":"unknown for_each","arn":"\u003cunknown\u003e","weight":"\u003cunknown\u003e"}]}],"redirect":[{"_dynamic":"unknown for_each","_template":{"host":"\u003cunknown\u003e","path":"\u003cunknown\u003e","port":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","query":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"},"host":"\u003cunknown\u003e","path":"\u003cunknown\u003e","port":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","query":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"target_group_arn":"\u003cunknown\u003e","type":"\u003cunknown\u003e"},"fixed_response":[{"_dynamic":"unknown for_each","content_type":"\u003cunknown\u003e","message_body":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"forward":[{"_dynamic":"unknown for_each","stickiness":[{"_dynamic":"unknown for_each","duration":"\u003cunknown\u003e","enabled":"\u003cunknown\u003e"}],"target_group":[{"_dynamic":"unknown for_each","arn":"\u003cunknown\u003e","weight":"\u003cunknown\u003e"}]}],"redirect":[{"_dynamic":"unknown for_each","host":"\u003cunknown\u003e","path":"\u003cunknown\u003e","port":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","query":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"target_group_arn":"\u003cunknown\u003e","type":"\u003cunknown\u003e"}],"load_balancer_arn":"\u003cunknown\u003e","port":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","tags":"\u003cunknown\u003e"},"unknown":["default_action","load_balancer_arn","port","protocol","tags"],"unknown_causes":{"default_action":"unknown-iteration","load_balancer_arn":"provider-computed","port":"unknown-iteration","protocol":"unknown-iteration","tags":"unknown-iteration"},"instance_attrs":[{"default_action":[{"target_group_arn":"\u003cunknown\u003e","type":"forward"}],"load_balancer_arn":"\u003cunknown\u003e","port":80,"protocol":"HTTP","tags":{}}],"instance_keys":["0"],"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":624,"end_line":694}},{"id":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_https","mode":"managed","provider":"aws","source_type":"aws_lb_listener","name":"frontend_https","module_path":["retail_app_ecs","alb"],"category":"network","kind":"load_balancer_listener","facet_of":"module.retail_app_ecs.module.alb.aws_lb.this","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"alpn_policy":"\u003cunknown\u003e","certificate_arn":"\u003cunknown\u003e","default_action":[{"_dynamic":"unknown for_each","_template":{"authenticate_cognito":[{"_dynamic":"unknown for_each","_template":{"authentication_request_extra_params":"\u003cunknown\u003e","on_unauthenticated_request":"\u003cunknown\u003e","scope":"\u003cunknown\u003e","session_cookie_name":"\u003cunknown\u003e","session_timeout":"\u003cunknown\u003e","user_pool_arn":"\u003cunknown\u003e","user_pool_client_id":"\u003cunknown\u003e","user_pool_domain":"\u003cunknown\u003e"},"authentication_request_extra_params":"\u003cunknown\u003e","on_unauthenticated_request":"\u003cunknown\u003e","scope":"\u003cunknown\u003e","session_cookie_name":"\u003cunknown\u003e","session_timeout":"\u003cunknown\u003e","user_pool_arn":"\u003cunknown\u003e","user_pool_client_id":"\u003cunknown\u003e","user_pool_domain":"\u003cunknown\u003e"}],"authenticate_oidc":[{"_dynamic":"unknown for_each","_template":{"authentication_request_extra_params":"\u003cunknown\u003e","authorization_endpoint":"\u003cunknown\u003e","client_id":"\u003cunknown\u003e","client_secret":"\u003cunknown\u003e","issuer":"\u003cunknown\u003e","on_unauthenticated_request":"\u003cunknown\u003e","scope":"\u003cunknown\u003e","session_cookie_name":"\u003cunknown\u003e","session_timeout":"\u003cunknown\u003e","token_endpoint":"\u003cunknown\u003e","user_info_endpoint":"\u003cunknown\u003e"},"authentication_request_extra_params":"\u003cunknown\u003e","authorization_endpoint":"\u003cunknown\u003e","client_id":"\u003cunknown\u003e","client_secret":"\u003cunknown\u003e","issuer":"\u003cunknown\u003e","on_unauthenticated_request":"\u003cunknown\u003e","scope":"\u003cunknown\u003e","session_cookie_name":"\u003cunknown\u003e","session_timeout":"\u003cunknown\u003e","token_endpoint":"\u003cunknown\u003e","user_info_endpoint":"\u003cunknown\u003e"}],"fixed_response":[{"_dynamic":"unknown for_each","_template":{"content_type":"\u003cunknown\u003e","message_body":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"},"content_type":"\u003cunknown\u003e","message_body":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"redirect":[{"_dynamic":"unknown for_each","_template":{"host":"\u003cunknown\u003e","path":"\u003cunknown\u003e","port":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","query":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"},"host":"\u003cunknown\u003e","path":"\u003cunknown\u003e","port":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","query":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"target_group_arn":"\u003cunknown\u003e","type":"\u003cunknown\u003e"},"authenticate_cognito":[{"_dynamic":"unknown for_each","authentication_request_extra_params":"\u003cunknown\u003e","on_unauthenticated_request":"\u003cunknown\u003e","scope":"\u003cunknown\u003e","session_cookie_name":"\u003cunknown\u003e","session_timeout":"\u003cunknown\u003e","user_pool_arn":"\u003cunknown\u003e","user_pool_client_id":"\u003cunknown\u003e","user_pool_domain":"\u003cunknown\u003e"}],"authenticate_oidc":[{"_dynamic":"unknown for_each","authentication_request_extra_params":"\u003cunknown\u003e","authorization_endpoint":"\u003cunknown\u003e","client_id":"\u003cunknown\u003e","client_secret":"\u003cunknown\u003e","issuer":"\u003cunknown\u003e","on_unauthenticated_request":"\u003cunknown\u003e","scope":"\u003cunknown\u003e","session_cookie_name":"\u003cunknown\u003e","session_timeout":"\u003cunknown\u003e","token_endpoint":"\u003cunknown\u003e","user_info_endpoint":"\u003cunknown\u003e"}],"fixed_response":[{"_dynamic":"unknown for_each","content_type":"\u003cunknown\u003e","message_body":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"redirect":[{"_dynamic":"unknown for_each","host":"\u003cunknown\u003e","path":"\u003cunknown\u003e","port":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","query":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"target_group_arn":"\u003cunknown\u003e","type":"\u003cunknown\u003e"},{"_dynamic":"unknown for_each","_template":{"target_group_arn":"\u003cunknown\u003e","type":"forward"},"target_group_arn":"\u003cunknown\u003e","type":"\u003cunknown\u003e"}],"load_balancer_arn":"\u003cunknown\u003e","port":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","ssl_policy":"\u003cunknown\u003e","tags":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":696,"end_line":789}},{"id":"module.retail_app_ecs.module.alb.aws_lb_listener_certificate.https_listener","mode":"managed","provider":"aws","source_type":"aws_lb_listener_certificate","name":"https_listener","module_path":["retail_app_ecs","alb"],"category":"network","kind":"load_balancer_certificate","facet_of":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_https","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"certificate_arn":"\u003cunknown\u003e","listener_arn":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":791,"end_line":796}},{"id":"module.retail_app_ecs.module.alb.aws_lb_listener_rule.http_tcp_listener_rule","mode":"managed","provider":"aws","source_type":"aws_lb_listener_rule","name":"http_tcp_listener_rule","module_path":["retail_app_ecs","alb"],"category":"network","kind":"load_balancer_rule","facet_of":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"action":[{"_dynamic":"unknown for_each","_template":{"redirect":[{"host":"\u003cunknown\u003e","path":"\u003cunknown\u003e","port":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","query":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"type":"\u003cunknown\u003e"},"redirect":[{"host":"\u003cunknown\u003e","path":"\u003cunknown\u003e","port":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","query":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"type":"\u003cunknown\u003e"},{"_dynamic":"unknown for_each","_template":{"fixed_response":[{"content_type":"\u003cunknown\u003e","message_body":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"type":"\u003cunknown\u003e"},"fixed_response":[{"content_type":"\u003cunknown\u003e","message_body":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"type":"\u003cunknown\u003e"},{"_dynamic":"unknown for_each","_template":{"target_group_arn":"\u003cunknown\u003e","type":"\u003cunknown\u003e"},"target_group_arn":"\u003cunknown\u003e","type":"\u003cunknown\u003e"},{"_dynamic":"unknown for_each","_template":{"forward":[{"stickiness":[{"duration":"\u003cunknown\u003e","enabled":"\u003cunknown\u003e"}],"target_group":[{"_dynamic":"unknown for_each","_template":{"arn":"\u003cunknown\u003e","weight":"\u003cunknown\u003e"},"arn":"\u003cunknown\u003e","weight":"\u003cunknown\u003e"}]}],"type":"forward"},"forward":[{"stickiness":[{"duration":"\u003cunknown\u003e","enabled":"\u003cunknown\u003e"}],"target_group":[{"_dynamic":"unknown for_each","arn":"\u003cunknown\u003e","weight":"\u003cunknown\u003e"}]}],"type":"\u003cunknown\u003e"}],"condition":[{"_dynamic":"unknown for_each","_template":{"path_pattern":[{"values":"\u003cunknown\u003e"}]},"path_pattern":[{"values":"\u003cunknown\u003e"}]},{"_dynamic":"unknown for_each","_template":{"host_header":[{"values":"\u003cunknown\u003e"}]},"host_header":[{"values":"\u003cunknown\u003e"}]},{"_dynamic":"unknown for_each","_template":{"http_header":[{"_dynamic":"unknown for_each","_template":{"http_header_name":"\u003cunknown\u003e","values":"\u003cunknown\u003e"},"http_header_name":"\u003cunknown\u003e","values":"\u003cunknown\u003e"}]},"http_header":[{"_dynamic":"unknown for_each","http_header_name":"\u003cunknown\u003e","values":"\u003cunknown\u003e"}]},{"_dynamic":"unknown for_each","_template":{"http_request_method":[{"values":"\u003cunknown\u003e"}]},"http_request_method":[{"values":"\u003cunknown\u003e"}]},{"_dynamic":"unknown for_each","_template":{"query_string":[{"_dynamic":"unknown for_each","_template":{"key":"\u003cunknown\u003e","value":"\u003cunknown\u003e"},"key":"\u003cunknown\u003e","value":"\u003cunknown\u003e"}]},"query_string":[{"_dynamic":"unknown for_each","key":"\u003cunknown\u003e","value":"\u003cunknown\u003e"}]},{"_dynamic":"unknown for_each","_template":{"source_ip":[{"values":"\u003cunknown\u003e"}]},"source_ip":[{"values":"\u003cunknown\u003e"}]}],"listener_arn":"\u003cunknown\u003e","priority":"\u003cunknown\u003e","tags":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":427,"end_line":622}},{"id":"module.retail_app_ecs.module.alb.aws_lb_listener_rule.https_listener_rule","mode":"managed","provider":"aws","source_type":"aws_lb_listener_rule","name":"https_listener_rule","module_path":["retail_app_ecs","alb"],"category":"network","kind":"load_balancer_rule","facet_of":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_https","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"action":[{"_dynamic":"unknown for_each","_template":{"authenticate_cognito":[{"authentication_request_extra_params":"\u003cunknown\u003e","on_unauthenticated_request":"\u003cunknown\u003e","scope":"\u003cunknown\u003e","session_cookie_name":"\u003cunknown\u003e","session_timeout":"\u003cunknown\u003e","user_pool_arn":"\u003cunknown\u003e","user_pool_client_id":"\u003cunknown\u003e","user_pool_domain":"\u003cunknown\u003e"}],"type":"\u003cunknown\u003e"},"authenticate_cognito":[{"authentication_request_extra_params":"\u003cunknown\u003e","on_unauthenticated_request":"\u003cunknown\u003e","scope":"\u003cunknown\u003e","session_cookie_name":"\u003cunknown\u003e","session_timeout":"\u003cunknown\u003e","user_pool_arn":"\u003cunknown\u003e","user_pool_client_id":"\u003cunknown\u003e","user_pool_domain":"\u003cunknown\u003e"}],"type":"\u003cunknown\u003e"},{"_dynamic":"unknown for_each","_template":{"authenticate_oidc":[{"authentication_request_extra_params":"\u003cunknown\u003e","authorization_endpoint":"\u003cunknown\u003e","client_id":"\u003cunknown\u003e","client_secret":"\u003cunknown\u003e","issuer":"\u003cunknown\u003e","on_unauthenticated_request":"\u003cunknown\u003e","scope":"\u003cunknown\u003e","session_cookie_name":"\u003cunknown\u003e","session_timeout":"\u003cunknown\u003e","token_endpoint":"\u003cunknown\u003e","user_info_endpoint":"\u003cunknown\u003e"}],"type":"\u003cunknown\u003e"},"authenticate_oidc":[{"authentication_request_extra_params":"\u003cunknown\u003e","authorization_endpoint":"\u003cunknown\u003e","client_id":"\u003cunknown\u003e","client_secret":"\u003cunknown\u003e","issuer":"\u003cunknown\u003e","on_unauthenticated_request":"\u003cunknown\u003e","scope":"\u003cunknown\u003e","session_cookie_name":"\u003cunknown\u003e","session_timeout":"\u003cunknown\u003e","token_endpoint":"\u003cunknown\u003e","user_info_endpoint":"\u003cunknown\u003e"}],"type":"\u003cunknown\u003e"},{"_dynamic":"unknown for_each","_template":{"redirect":[{"host":"\u003cunknown\u003e","path":"\u003cunknown\u003e","port":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","query":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"type":"\u003cunknown\u003e"},"redirect":[{"host":"\u003cunknown\u003e","path":"\u003cunknown\u003e","port":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","query":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"type":"\u003cunknown\u003e"},{"_dynamic":"unknown for_each","_template":{"fixed_response":[{"content_type":"\u003cunknown\u003e","message_body":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"type":"\u003cunknown\u003e"},"fixed_response":[{"content_type":"\u003cunknown\u003e","message_body":"\u003cunknown\u003e","status_code":"\u003cunknown\u003e"}],"type":"\u003cunknown\u003e"},{"_dynamic":"unknown for_each","_template":{"target_group_arn":"\u003cunknown\u003e","type":"\u003cunknown\u003e"},"target_group_arn":"\u003cunknown\u003e","type":"\u003cunknown\u003e"},{"_dynamic":"unknown for_each","_template":{"forward":[{"stickiness":[{"duration":"\u003cunknown\u003e","enabled":"\u003cunknown\u003e"}],"target_group":[{"_dynamic":"unknown for_each","_template":{"arn":"\u003cunknown\u003e","weight":"\u003cunknown\u003e"},"arn":"\u003cunknown\u003e","weight":"\u003cunknown\u003e"}]}],"type":"forward"},"forward":[{"stickiness":[{"duration":"\u003cunknown\u003e","enabled":"\u003cunknown\u003e"}],"target_group":[{"_dynamic":"unknown for_each","arn":"\u003cunknown\u003e","weight":"\u003cunknown\u003e"}]}],"type":"\u003cunknown\u003e"}],"condition":[{"_dynamic":"unknown for_each","_template":{"path_pattern":[{"values":"\u003cunknown\u003e"}]},"path_pattern":[{"values":"\u003cunknown\u003e"}]},{"_dynamic":"unknown for_each","_template":{"host_header":[{"values":"\u003cunknown\u003e"}]},"host_header":[{"values":"\u003cunknown\u003e"}]},{"_dynamic":"unknown for_each","_template":{"http_header":[{"_dynamic":"unknown for_each","_template":{"http_header_name":"\u003cunknown\u003e","values":"\u003cunknown\u003e"},"http_header_name":"\u003cunknown\u003e","values":"\u003cunknown\u003e"}]},"http_header":[{"_dynamic":"unknown for_each","http_header_name":"\u003cunknown\u003e","values":"\u003cunknown\u003e"}]},{"_dynamic":"unknown for_each","_template":{"http_request_method":[{"values":"\u003cunknown\u003e"}]},"http_request_method":[{"values":"\u003cunknown\u003e"}]},{"_dynamic":"unknown for_each","_template":{"query_string":[{"_dynamic":"unknown for_each","_template":{"key":"\u003cunknown\u003e","value":"\u003cunknown\u003e"},"key":"\u003cunknown\u003e","value":"\u003cunknown\u003e"}]},"query_string":[{"_dynamic":"unknown for_each","key":"\u003cunknown\u003e","value":"\u003cunknown\u003e"}]},{"_dynamic":"unknown for_each","_template":{"source_ip":[{"values":"\u003cunknown\u003e"}]},"source_ip":[{"values":"\u003cunknown\u003e"}]}],"listener_arn":"\u003cunknown\u003e","priority":"\u003cunknown\u003e","tags":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":180,"end_line":425}},{"id":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","mode":"managed","provider":"aws","source_type":"aws_lb_target_group","name":"main","module_path":["retail_app_ecs","alb"],"category":"network","kind":"load_balancer_target_pool","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"connection_termination":"\u003cunknown\u003e","deregistration_delay":"\u003cunknown\u003e","health_check":[{"_dynamic":"unknown for_each","_template":{"enabled":"\u003cunknown\u003e","healthy_threshold":"\u003cunknown\u003e","interval":"\u003cunknown\u003e","matcher":"\u003cunknown\u003e","path":"\u003cunknown\u003e","port":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","timeout":"\u003cunknown\u003e","unhealthy_threshold":"\u003cunknown\u003e"},"enabled":"\u003cunknown\u003e","healthy_threshold":"\u003cunknown\u003e","interval":"\u003cunknown\u003e","matcher":"\u003cunknown\u003e","path":"\u003cunknown\u003e","port":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","timeout":"\u003cunknown\u003e","unhealthy_threshold":"\u003cunknown\u003e"}],"ip_address_type":"\u003cunknown\u003e","lambda_multi_value_headers_enabled":"\u003cunknown\u003e","load_balancing_algorithm_type":"\u003cunknown\u003e","load_balancing_cross_zone_enabled":"\u003cunknown\u003e","name":"\u003cunknown\u003e","name_prefix":"\u003cunknown\u003e","port":"\u003cunknown\u003e","preserve_client_ip":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","protocol_version":"\u003cunknown\u003e","proxy_protocol_v2":"\u003cunknown\u003e","slow_start":"\u003cunknown\u003e","stickiness":[{"_dynamic":"unknown for_each","_template":{"cookie_duration":"\u003cunknown\u003e","cookie_name":"\u003cunknown\u003e","enabled":"\u003cunknown\u003e","type":"\u003cunknown\u003e"},"cookie_duration":"\u003cunknown\u003e","cookie_name":"\u003cunknown\u003e","enabled":"\u003cunknown\u003e","type":"\u003cunknown\u003e"}],"tags":"\u003cunknown\u003e","target_type":"\u003cunknown\u003e","vpc_id":"\u003cunknown\u003e"},"unknown":["connection_termination","deregistration_delay","health_check","ip_address_type","lambda_multi_value_headers_enabled","load_balancing_algorithm_type","load_balancing_cross_zone_enabled","name","name_prefix","port","preserve_client_ip","protocol","protocol_version","proxy_protocol_v2","slow_start","stickiness","tags","target_type","vpc_id"],"unknown_causes":{"connection_termination":"unknown-iteration","deregistration_delay":"unknown-iteration","health_check":"unknown-iteration","ip_address_type":"unknown-iteration","lambda_multi_value_headers_enabled":"unknown-iteration","load_balancing_algorithm_type":"unknown-iteration","load_balancing_cross_zone_enabled":"unknown-iteration","name":"unknown-iteration","name_prefix":"unknown-iteration","port":"unknown-iteration","preserve_client_ip":"unknown-iteration","protocol":"unknown-iteration","protocol_version":"unknown-iteration","proxy_protocol_v2":"unknown-iteration","slow_start":"unknown-iteration","stickiness":"unknown-iteration","tags":"unknown-iteration","target_type":"unknown-iteration","vpc_id":"runtime-data"},"instance_attrs":[{"deregistration_delay":"30","health_check":[{"enabled":true,"healthy_threshold":2,"interval":30,"path":"/actuator/health","port":"traffic-port","protocol":"HTTP","timeout":5,"unhealthy_threshold":3}],"lambda_multi_value_headers_enabled":false,"name":"ui-application","port":8080,"protocol":"HTTP","proxy_protocol_v2":false,"tags":{"Name":"ui-application"},"target_type":"ip","vpc_id":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"vpc_id":["environment_name"]},"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":65,"end_line":126}},{"id":"module.retail_app_ecs.module.alb.aws_lb_target_group_attachment.this","mode":"managed","provider":"aws","source_type":"aws_lb_target_group_attachment","name":"this","module_path":["retail_app_ecs","alb"],"category":"network","kind":"load_balancer_target","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"availability_zone":"\u003cunknown\u003e","port":"\u003cunknown\u003e","target_group_arn":"\u003cunknown\u003e","target_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":169,"end_line":178}},{"id":"module.retail_app_ecs.module.alb.aws_security_group.this","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"this","module_path":["retail_app_ecs","alb"],"category":"network","kind":"firewall_group","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"name_prefix":"retail-store-ecs-ui-","tags":{"Name":"retail-store-ecs-ui"},"vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"vpc_id":"runtime-data"},"instance_attrs":[{"name_prefix":"retail-store-ecs-ui-","tags":{"Name":"retail-store-ecs-ui"},"vpc_id":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"name_prefix":["environment_name"],"tags":["environment_name"],"vpc_id":["environment_name"]},"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":807,"end_line":824}},{"id":"module.retail_app_ecs.module.alb.aws_security_group_rule.this","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"this","module_path":["retail_app_ecs","alb"],"category":"network","kind":"firewall_rule","facet_of":"module.retail_app_ecs.module.alb.aws_security_group.this","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_blocks":"\u003cunknown\u003e","description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","ipv6_cidr_blocks":"\u003cunknown\u003e","prefix_list_ids":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","self":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":826,"end_line":843}},{"id":"module.retail_app_ecs.module.alb.aws_wafv2_web_acl_association.this","mode":"managed","provider":"aws","source_type":"aws_wafv2_web_acl_association","name":"this","module_path":["retail_app_ecs","alb"],"category":"network","kind":"web_application_firewall_attachment","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"resource_arn":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb/main.tf","line":845,"end_line":849}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"this","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_group","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"UI ALB security group","name":"retail-store-ecs-ui","revoke_rules_on_delete":false,"tags":{"Name":"retail-store-ecs-ui"},"timeouts":[{"create":"10m","delete":"15m"}],"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"name":["environment_name"],"tags":["environment_name"],"vpc_id":["environment_name"]},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":13,"end_line":32}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"this_name_prefix","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_group","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"UI ALB security group","name_prefix":"retail-store-ecs-ui-","revoke_rules_on_delete":false,"tags":{"Name":"retail-store-ecs-ui"},"timeouts":[{"create":"10m","delete":"15m"}],"vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"vpc_id":"runtime-data"},"instance_attrs":[{"description":"UI ALB security group","name_prefix":"retail-store-ecs-ui-","revoke_rules_on_delete":false,"tags":{"Name":"retail-store-ecs-ui"},"timeouts":[{"create":"10m","delete":"15m"}],"vpc_id":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"name_prefix":["environment_name"],"tags":["environment_name"],"vpc_id":["environment_name"]},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":37,"end_line":60}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_rules","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"computed_egress_rules","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_blocks":["0.0.0.0/0"],"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","ipv6_cidr_blocks":["::/0"],"prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"egress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":459,"end_line":473}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_with_cidr_blocks","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"computed_egress_with_cidr_blocks","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_blocks":"\u003cunknown\u003e","description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"egress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":606,"end_line":654}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_with_ipv6_cidr_blocks","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"computed_egress_with_ipv6_cidr_blocks","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","ipv6_cidr_blocks":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"egress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":696,"end_line":744}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_with_self","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"computed_egress_with_self","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","self":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"egress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":779,"end_line":808}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_with_source_security_group_id","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"computed_egress_with_source_security_group_id","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"egress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":523,"end_line":564}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_rules","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"computed_ingress_rules","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_blocks":["0.0.0.0/0"],"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","ipv6_cidr_blocks":[],"prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"ingress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":83,"end_line":97}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_with_cidr_blocks","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"computed_ingress_with_cidr_blocks","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_blocks":"\u003cunknown\u003e","description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"ingress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":230,"end_line":278}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_with_ipv6_cidr_blocks","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"computed_ingress_with_ipv6_cidr_blocks","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","ipv6_cidr_blocks":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"ingress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":320,"end_line":368}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_with_self","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"computed_ingress_with_self","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","self":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"ingress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":403,"end_line":432}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_with_source_security_group_id","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"computed_ingress_with_source_security_group_id","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"ingress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":147,"end_line":188}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"egress_rules","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","facet_of":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"cidr_blocks":["0.0.0.0/0"],"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","ipv6_cidr_blocks":["::/0"],"prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"egress"},"unknown":["description","from_port","protocol","security_group_id","to_port"],"unknown_causes":{"description":"unknown-iteration","from_port":"unknown-iteration","protocol":"unknown-iteration","security_group_id":"provider-computed","to_port":"unknown-iteration"},"instance_attrs":[{"cidr_blocks":["0.0.0.0/0"],"description":"All protocols","from_port":-1,"ipv6_cidr_blocks":["::/0"],"prefix_list_ids":[],"protocol":"-1","security_group_id":"\u003cunknown\u003e","to_port":-1,"type":"egress"}],"instance_keys":["0"],"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":442,"end_line":456}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_with_cidr_blocks","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"egress_with_cidr_blocks","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_blocks":"\u003cunknown\u003e","description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"egress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":567,"end_line":603}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_with_ipv6_cidr_blocks","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"egress_with_ipv6_cidr_blocks","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","ipv6_cidr_blocks":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"egress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":657,"end_line":693}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_with_self","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"egress_with_self","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","self":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"egress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":747,"end_line":776}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_with_source_security_group_id","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"egress_with_source_security_group_id","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"egress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":479,"end_line":520}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"ingress_rules","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","facet_of":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"cidr_blocks":["0.0.0.0/0"],"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","ipv6_cidr_blocks":[],"prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"ingress"},"unknown":["description","from_port","protocol","security_group_id","to_port"],"unknown_causes":{"description":"unknown-iteration","from_port":"unknown-iteration","protocol":"unknown-iteration","security_group_id":"provider-computed","to_port":"unknown-iteration"},"instance_attrs":[{"cidr_blocks":["0.0.0.0/0"],"description":"HTTP","from_port":80,"ipv6_cidr_blocks":[],"prefix_list_ids":[],"protocol":"tcp","security_group_id":"\u003cunknown\u003e","to_port":80,"type":"ingress"}],"instance_keys":["0"],"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":66,"end_line":80}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_with_cidr_blocks","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"ingress_with_cidr_blocks","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_blocks":"\u003cunknown\u003e","description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"ingress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":191,"end_line":227}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_with_ipv6_cidr_blocks","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"ingress_with_ipv6_cidr_blocks","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","ipv6_cidr_blocks":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"ingress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":281,"end_line":317}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_with_self","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"ingress_with_self","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","self":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"ingress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":371,"end_line":400}},{"id":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_with_source_security_group_id","mode":"managed","provider":"aws","source_type":"aws_security_group_rule","name":"ingress_with_source_security_group_id","module_path":["retail_app_ecs","alb_sg"],"category":"network","kind":"firewall_rule","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"\u003cunknown\u003e","from_port":"\u003cunknown\u003e","prefix_list_ids":[],"protocol":"\u003cunknown\u003e","security_group_id":"\u003cunknown\u003e","source_security_group_id":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e","type":"ingress"},"provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","line":103,"end_line":144}},{"id":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","mode":"managed","provider":"aws","source_type":"aws_ecs_service","name":"this","module_path":["retail_app_ecs","carts_service"],"category":"compute","kind":"container_service","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"cluster":"\u003cunknown\u003e","desired_count":1,"enable_execute_command":true,"launch_type":"FARGATE","name":"carts","network_configuration":[{"assign_public_ip":false,"security_groups":["\u003cunknown\u003e"],"subnets":"\u003cunknown\u003e"}],"service_connect_configuration":[{"enabled":true,"namespace":"\u003cunknown\u003e","service":[{"client_alias":[{"dns_name":"carts","port":80}],"discovery_name":"carts","port_name":"carts-service"}]}],"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"task_definition":"\u003cunknown\u003e","wait_for_steady_state":true},"unknown":["cluster","network_configuration.security_groups","network_configuration.subnets","service_connect_configuration.namespace","task_definition"],"unknown_causes":{"cluster":"provider-computed","network_configuration.security_groups":"provider-computed","network_configuration.subnets":"runtime-data","service_connect_configuration.namespace":"provider-computed","task_definition":"provider-computed"},"attr_variables":{"network_configuration[0].subnets":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":136,"end_line":175}},{"id":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","mode":"managed","provider":"aws","source_type":"aws_ecs_task_definition","name":"this","module_path":["retail_app_ecs","carts_service"],"category":"compute","kind":"container_task","facet_of":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"container_definitions":"\u003cunknown\u003e","cpu":"1024","execution_role_arn":"\u003cunknown\u003e","family":"retail-store-ecs-carts","memory":"2048","network_mode":"awsvpc","requires_compatibilities":["FARGATE"],"task_role_arn":"\u003cunknown\u003e"},"unknown":["container_definitions","execution_role_arn","task_role_arn"],"unknown_causes":{"container_definitions":"runtime-data","execution_role_arn":"provider-computed","task_role_arn":"provider-computed"},"attr_variables":{"container_definitions":["container_image_overrides","environment_name","opentelemetry_enabled"],"family":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":125,"end_line":134}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_agent","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"cloudwatch_agent","module_path":["retail_app_ecs","carts_service"],"category":"identity","kind":"iam_policy","multiplicity":"count","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"attrs":{"description":"CloudWatch Agent policy for carts","name":"retail-store-ecs-carts-cloudwatch-agent","policy":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":69,"end_line":102}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_logs","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"cloudwatch_logs","module_path":["retail_app_ecs","carts_service"],"category":"identity","kind":"iam_policy","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"CloudWatch Logs policy for carts","name":"retail-store-ecs-carts-cloudwatch-logs","policy":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"unknown":["policy"],"unknown_causes":{"policy":"runtime-data"},"attr_variables":{"name":["environment_name"],"policy":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":37,"end_line":62}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_policy.ecs_exec","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"ecs_exec","module_path":["retail_app_ecs","carts_service"],"category":"identity","kind":"iam_policy","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"ECS exec policy","name":"retail-store-ecs-carts-exec","path":"/","policy":"{\"Statement\":[{\"Action\":[\"ssmmessages:CreateControlChannel\",\"ssmmessages:CreateDataChannel\",\"ssmmessages:OpenControlChannel\",\"ssmmessages:OpenDataChannel\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}],\"Version\":\"2012-10-17\"}","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":116,"end_line":137}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","mode":"managed","provider":"aws","source_type":"aws_iam_role","name":"task_execution_role","module_path":["retail_app_ecs","carts_service"],"category":"identity","kind":"iam_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"assume_role_policy":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"ecs-tasks.amazonaws.com\"\n      }\n    }\n  ]\n}","name":"retail-store-ecs-carts-te","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":14,"end_line":18}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","mode":"managed","provider":"aws","source_type":"aws_iam_role","name":"task_role","module_path":["retail_app_ecs","carts_service"],"category":"identity","kind":"iam_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"assume_role_policy":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"ecs-tasks.amazonaws.com\"\n      }\n    }\n  ]\n}","name":"retail-store-ecs-carts-task","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":31,"end_line":35}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_agent","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"cloudwatch_agent","module_path":["retail_app_ecs","carts_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","multiplicity":"count","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":104,"end_line":108}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_logs","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"cloudwatch_logs","module_path":["retail_app_ecs","carts_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"unknown":["policy_arn","role"],"unknown_causes":{"policy_arn":"provider-computed","role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":64,"end_line":67}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.ecs_exec","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"ecs_exec","module_path":["retail_app_ecs","carts_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"unknown":["policy_arn","role"],"unknown_causes":{"policy_arn":"provider-computed","role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":139,"end_line":142}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_execution_role_additional","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_execution_role_additional","module_path":["retail_app_ecs","carts_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":25,"end_line":29}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_execution_role_policy","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_execution_role_policy","module_path":["retail_app_ecs","carts_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy","role":"\u003cunknown\u003e"},"unknown":["role"],"unknown_causes":{"role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":20,"end_line":23}},{"id":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_role_additional","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_role_additional","module_path":["retail_app_ecs","carts_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"unknown":["policy_arn","role"],"unknown_causes":{"policy_arn":"unknown-iteration","role":"provider-computed"},"instance_attrs":[{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"policy_arn":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":110,"end_line":114}},{"id":"module.retail_app_ecs.module.carts_service.aws_security_group.this","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"this","module_path":["retail_app_ecs","carts_service"],"category":"network","kind":"firewall_group","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"egress":[{"cidr_blocks":["0.0.0.0/0"],"from_port":0,"protocol":"-1","to_port":0}],"ingress":[{"cidr_blocks":["0.0.0.0/0"],"from_port":8080,"protocol":"tcp","to_port":8080}],"name":"retail-store-ecs-carts-task","vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"vpc_id":"runtime-data"},"attr_variables":{"name":["environment_name"],"vpc_id":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/sg.tf","line":1,"end_line":18}},{"id":"module.retail_app_ecs.module.carts_service.data.aws_caller_identity.current","mode":"data","provider":"aws","source_type":"aws_caller_identity","name":"current","module_path":["retail_app_ecs","carts_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":1,"end_line":1}},{"id":"module.retail_app_ecs.module.carts_service.data.aws_iam_policy_document.assume_role_policy","mode":"data","provider":"aws","source_type":"aws_iam_policy_document","name":"assume_role_policy","module_path":["retail_app_ecs","carts_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"statement":[{"actions":["sts:AssumeRole"],"principals":[{"identifiers":["ecs-tasks.amazonaws.com"],"type":"Service"}]}]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":3,"end_line":12}},{"id":"module.retail_app_ecs.module.carts_service.data.aws_region.current","mode":"data","provider":"aws","source_type":"aws_region","name":"current","module_path":["retail_app_ecs","carts_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":123,"end_line":123}},{"id":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","mode":"managed","provider":"aws","source_type":"aws_ecs_service","name":"this","module_path":["retail_app_ecs","catalog_service"],"category":"compute","kind":"container_service","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"cluster":"\u003cunknown\u003e","desired_count":1,"enable_execute_command":true,"launch_type":"FARGATE","name":"catalog","network_configuration":[{"assign_public_ip":false,"security_groups":["\u003cunknown\u003e"],"subnets":"\u003cunknown\u003e"}],"service_connect_configuration":[{"enabled":true,"namespace":"\u003cunknown\u003e","service":[{"client_alias":[{"dns_name":"catalog","port":80}],"discovery_name":"catalog","port_name":"catalog-service"}]}],"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"task_definition":"\u003cunknown\u003e","wait_for_steady_state":true},"unknown":["cluster","network_configuration.security_groups","network_configuration.subnets","service_connect_configuration.namespace","task_definition"],"unknown_causes":{"cluster":"provider-computed","network_configuration.security_groups":"provider-computed","network_configuration.subnets":"runtime-data","service_connect_configuration.namespace":"provider-computed","task_definition":"provider-computed"},"attr_variables":{"network_configuration[0].subnets":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":136,"end_line":175}},{"id":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","mode":"managed","provider":"aws","source_type":"aws_ecs_task_definition","name":"this","module_path":["retail_app_ecs","catalog_service"],"category":"compute","kind":"container_task","facet_of":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"container_definitions":"\u003cunknown\u003e","cpu":"1024","execution_role_arn":"\u003cunknown\u003e","family":"retail-store-ecs-catalog","memory":"2048","network_mode":"awsvpc","requires_compatibilities":["FARGATE"],"task_role_arn":"\u003cunknown\u003e"},"unknown":["container_definitions","execution_role_arn","task_role_arn"],"unknown_causes":{"container_definitions":"runtime-data","execution_role_arn":"provider-computed","task_role_arn":"provider-computed"},"attr_variables":{"container_definitions":["container_image_overrides","environment_name","opentelemetry_enabled"],"family":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":125,"end_line":134}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_agent","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"cloudwatch_agent","module_path":["retail_app_ecs","catalog_service"],"category":"identity","kind":"iam_policy","multiplicity":"count","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"attrs":{"description":"CloudWatch Agent policy for catalog","name":"retail-store-ecs-catalog-cloudwatch-agent","policy":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":69,"end_line":102}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_logs","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"cloudwatch_logs","module_path":["retail_app_ecs","catalog_service"],"category":"identity","kind":"iam_policy","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"CloudWatch Logs policy for catalog","name":"retail-store-ecs-catalog-cloudwatch-logs","policy":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"unknown":["policy"],"unknown_causes":{"policy":"runtime-data"},"attr_variables":{"name":["environment_name"],"policy":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":37,"end_line":62}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.ecs_exec","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"ecs_exec","module_path":["retail_app_ecs","catalog_service"],"category":"identity","kind":"iam_policy","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"ECS exec policy","name":"retail-store-ecs-catalog-exec","path":"/","policy":"{\"Statement\":[{\"Action\":[\"ssmmessages:CreateControlChannel\",\"ssmmessages:CreateDataChannel\",\"ssmmessages:OpenControlChannel\",\"ssmmessages:OpenDataChannel\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}],\"Version\":\"2012-10-17\"}","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":116,"end_line":137}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","mode":"managed","provider":"aws","source_type":"aws_iam_role","name":"task_execution_role","module_path":["retail_app_ecs","catalog_service"],"category":"identity","kind":"iam_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"assume_role_policy":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"ecs-tasks.amazonaws.com\"\n      }\n    }\n  ]\n}","name":"retail-store-ecs-catalog-te","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":14,"end_line":18}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","mode":"managed","provider":"aws","source_type":"aws_iam_role","name":"task_role","module_path":["retail_app_ecs","catalog_service"],"category":"identity","kind":"iam_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"assume_role_policy":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"ecs-tasks.amazonaws.com\"\n      }\n    }\n  ]\n}","name":"retail-store-ecs-catalog-task","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":31,"end_line":35}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_agent","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"cloudwatch_agent","module_path":["retail_app_ecs","catalog_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","multiplicity":"count","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":104,"end_line":108}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_logs","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"cloudwatch_logs","module_path":["retail_app_ecs","catalog_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"unknown":["policy_arn","role"],"unknown_causes":{"policy_arn":"provider-computed","role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":64,"end_line":67}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.ecs_exec","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"ecs_exec","module_path":["retail_app_ecs","catalog_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"unknown":["policy_arn","role"],"unknown_causes":{"policy_arn":"provider-computed","role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":139,"end_line":142}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_additional","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_execution_role_additional","module_path":["retail_app_ecs","catalog_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"unknown":["policy_arn","role"],"unknown_causes":{"policy_arn":"unknown-iteration","role":"provider-computed"},"instance_attrs":[{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"}],"instance_keys":["0"],"provenance":{"file":"../../lib/ecs/service/iam.tf","line":25,"end_line":29}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_policy","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_execution_role_policy","module_path":["retail_app_ecs","catalog_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy","role":"\u003cunknown\u003e"},"unknown":["role"],"unknown_causes":{"role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":20,"end_line":23}},{"id":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_role_additional","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_role_additional","module_path":["retail_app_ecs","catalog_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":110,"end_line":114}},{"id":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"this","module_path":["retail_app_ecs","catalog_service"],"category":"network","kind":"firewall_group","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"egress":[{"cidr_blocks":["0.0.0.0/0"],"from_port":0,"protocol":"-1","to_port":0}],"ingress":[{"cidr_blocks":["0.0.0.0/0"],"from_port":8080,"protocol":"tcp","to_port":8080}],"name":"retail-store-ecs-catalog-task","vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"vpc_id":"runtime-data"},"attr_variables":{"name":["environment_name"],"vpc_id":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/sg.tf","line":1,"end_line":18}},{"id":"module.retail_app_ecs.module.catalog_service.data.aws_caller_identity.current","mode":"data","provider":"aws","source_type":"aws_caller_identity","name":"current","module_path":["retail_app_ecs","catalog_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":1,"end_line":1}},{"id":"module.retail_app_ecs.module.catalog_service.data.aws_iam_policy_document.assume_role_policy","mode":"data","provider":"aws","source_type":"aws_iam_policy_document","name":"assume_role_policy","module_path":["retail_app_ecs","catalog_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"statement":[{"actions":["sts:AssumeRole"],"principals":[{"identifiers":["ecs-tasks.amazonaws.com"],"type":"Service"}]}]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":3,"end_line":12}},{"id":"module.retail_app_ecs.module.catalog_service.data.aws_region.current","mode":"data","provider":"aws","source_type":"aws_region","name":"current","module_path":["retail_app_ecs","catalog_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":123,"end_line":123}},{"id":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","mode":"managed","provider":"aws","source_type":"aws_ecs_service","name":"this","module_path":["retail_app_ecs","checkout_service"],"category":"compute","kind":"container_service","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"cluster":"\u003cunknown\u003e","desired_count":1,"enable_execute_command":true,"launch_type":"FARGATE","name":"checkout","network_configuration":[{"assign_public_ip":false,"security_groups":["\u003cunknown\u003e"],"subnets":"\u003cunknown\u003e"}],"service_connect_configuration":[{"enabled":true,"namespace":"\u003cunknown\u003e","service":[{"client_alias":[{"dns_name":"checkout","port":80}],"discovery_name":"checkout","port_name":"checkout-service"}]}],"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"task_definition":"\u003cunknown\u003e","wait_for_steady_state":true},"unknown":["cluster","network_configuration.security_groups","network_configuration.subnets","service_connect_configuration.namespace","task_definition"],"unknown_causes":{"cluster":"provider-computed","network_configuration.security_groups":"provider-computed","network_configuration.subnets":"runtime-data","service_connect_configuration.namespace":"provider-computed","task_definition":"provider-computed"},"attr_variables":{"network_configuration[0].subnets":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":136,"end_line":175}},{"id":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","mode":"managed","provider":"aws","source_type":"aws_ecs_task_definition","name":"this","module_path":["retail_app_ecs","checkout_service"],"category":"compute","kind":"container_task","facet_of":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"container_definitions":"\u003cunknown\u003e","cpu":"1024","execution_role_arn":"\u003cunknown\u003e","family":"retail-store-ecs-checkout","memory":"2048","network_mode":"awsvpc","requires_compatibilities":["FARGATE"],"task_role_arn":"\u003cunknown\u003e"},"unknown":["container_definitions","execution_role_arn","task_role_arn"],"unknown_causes":{"container_definitions":"runtime-data","execution_role_arn":"provider-computed","task_role_arn":"provider-computed"},"attr_variables":{"container_definitions":["container_image_overrides","environment_name","opentelemetry_enabled"],"family":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":125,"end_line":134}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_agent","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"cloudwatch_agent","module_path":["retail_app_ecs","checkout_service"],"category":"identity","kind":"iam_policy","multiplicity":"count","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"attrs":{"description":"CloudWatch Agent policy for checkout","name":"retail-store-ecs-checkout-cloudwatch-agent","policy":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":69,"end_line":102}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_logs","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"cloudwatch_logs","module_path":["retail_app_ecs","checkout_service"],"category":"identity","kind":"iam_policy","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"CloudWatch Logs policy for checkout","name":"retail-store-ecs-checkout-cloudwatch-logs","policy":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"unknown":["policy"],"unknown_causes":{"policy":"runtime-data"},"attr_variables":{"name":["environment_name"],"policy":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":37,"end_line":62}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.ecs_exec","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"ecs_exec","module_path":["retail_app_ecs","checkout_service"],"category":"identity","kind":"iam_policy","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"ECS exec policy","name":"retail-store-ecs-checkout-exec","path":"/","policy":"{\"Statement\":[{\"Action\":[\"ssmmessages:CreateControlChannel\",\"ssmmessages:CreateDataChannel\",\"ssmmessages:OpenControlChannel\",\"ssmmessages:OpenDataChannel\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}],\"Version\":\"2012-10-17\"}","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":116,"end_line":137}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","mode":"managed","provider":"aws","source_type":"aws_iam_role","name":"task_execution_role","module_path":["retail_app_ecs","checkout_service"],"category":"identity","kind":"iam_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"assume_role_policy":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"ecs-tasks.amazonaws.com\"\n      }\n    }\n  ]\n}","name":"retail-store-ecs-checkout-te","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":14,"end_line":18}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","mode":"managed","provider":"aws","source_type":"aws_iam_role","name":"task_role","module_path":["retail_app_ecs","checkout_service"],"category":"identity","kind":"iam_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"assume_role_policy":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"ecs-tasks.amazonaws.com\"\n      }\n    }\n  ]\n}","name":"retail-store-ecs-checkout-task","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":31,"end_line":35}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_agent","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"cloudwatch_agent","module_path":["retail_app_ecs","checkout_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","multiplicity":"count","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":104,"end_line":108}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_logs","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"cloudwatch_logs","module_path":["retail_app_ecs","checkout_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"unknown":["policy_arn","role"],"unknown_causes":{"policy_arn":"provider-computed","role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":64,"end_line":67}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.ecs_exec","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"ecs_exec","module_path":["retail_app_ecs","checkout_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"unknown":["policy_arn","role"],"unknown_causes":{"policy_arn":"provider-computed","role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":139,"end_line":142}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_execution_role_additional","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_execution_role_additional","module_path":["retail_app_ecs","checkout_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":25,"end_line":29}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_execution_role_policy","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_execution_role_policy","module_path":["retail_app_ecs","checkout_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy","role":"\u003cunknown\u003e"},"unknown":["role"],"unknown_causes":{"role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":20,"end_line":23}},{"id":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_role_additional","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_role_additional","module_path":["retail_app_ecs","checkout_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"unknown":["policy_arn","role"],"unknown_causes":{"policy_arn":"unknown-iteration","role":"provider-computed"},"instance_attrs":[{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"policy_arn":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":110,"end_line":114}},{"id":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"this","module_path":["retail_app_ecs","checkout_service"],"category":"network","kind":"firewall_group","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"egress":[{"cidr_blocks":["0.0.0.0/0"],"from_port":0,"protocol":"-1","to_port":0}],"ingress":[{"cidr_blocks":["0.0.0.0/0"],"from_port":8080,"protocol":"tcp","to_port":8080}],"name":"retail-store-ecs-checkout-task","vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"vpc_id":"runtime-data"},"attr_variables":{"name":["environment_name"],"vpc_id":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/sg.tf","line":1,"end_line":18}},{"id":"module.retail_app_ecs.module.checkout_service.data.aws_caller_identity.current","mode":"data","provider":"aws","source_type":"aws_caller_identity","name":"current","module_path":["retail_app_ecs","checkout_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":1,"end_line":1}},{"id":"module.retail_app_ecs.module.checkout_service.data.aws_iam_policy_document.assume_role_policy","mode":"data","provider":"aws","source_type":"aws_iam_policy_document","name":"assume_role_policy","module_path":["retail_app_ecs","checkout_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"statement":[{"actions":["sts:AssumeRole"],"principals":[{"identifiers":["ecs-tasks.amazonaws.com"],"type":"Service"}]}]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":3,"end_line":12}},{"id":"module.retail_app_ecs.module.checkout_service.data.aws_region.current","mode":"data","provider":"aws","source_type":"aws_region","name":"current","module_path":["retail_app_ecs","checkout_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":123,"end_line":123}},{"id":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","mode":"managed","provider":"aws","source_type":"aws_ecs_service","name":"this","module_path":["retail_app_ecs","orders_service"],"category":"compute","kind":"container_service","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"cluster":"\u003cunknown\u003e","desired_count":1,"enable_execute_command":true,"launch_type":"FARGATE","name":"orders","network_configuration":[{"assign_public_ip":false,"security_groups":["\u003cunknown\u003e"],"subnets":"\u003cunknown\u003e"}],"service_connect_configuration":[{"enabled":true,"namespace":"\u003cunknown\u003e","service":[{"client_alias":[{"dns_name":"orders","port":80}],"discovery_name":"orders","port_name":"orders-service"}]}],"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"task_definition":"\u003cunknown\u003e","wait_for_steady_state":true},"unknown":["cluster","network_configuration.security_groups","network_configuration.subnets","service_connect_configuration.namespace","task_definition"],"unknown_causes":{"cluster":"provider-computed","network_configuration.security_groups":"provider-computed","network_configuration.subnets":"runtime-data","service_connect_configuration.namespace":"provider-computed","task_definition":"provider-computed"},"attr_variables":{"network_configuration[0].subnets":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":136,"end_line":175}},{"id":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","mode":"managed","provider":"aws","source_type":"aws_ecs_task_definition","name":"this","module_path":["retail_app_ecs","orders_service"],"category":"compute","kind":"container_task","facet_of":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"container_definitions":"\u003cunknown\u003e","cpu":"1024","execution_role_arn":"\u003cunknown\u003e","family":"retail-store-ecs-orders","memory":"2048","network_mode":"awsvpc","requires_compatibilities":["FARGATE"],"task_role_arn":"\u003cunknown\u003e"},"unknown":["container_definitions","execution_role_arn","task_role_arn"],"unknown_causes":{"container_definitions":"runtime-data","execution_role_arn":"provider-computed","task_role_arn":"provider-computed"},"attr_variables":{"container_definitions":["container_image_overrides","opentelemetry_enabled"],"family":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":125,"end_line":134}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_agent","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"cloudwatch_agent","module_path":["retail_app_ecs","orders_service"],"category":"identity","kind":"iam_policy","multiplicity":"count","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"attrs":{"description":"CloudWatch Agent policy for orders","name":"retail-store-ecs-orders-cloudwatch-agent","policy":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":69,"end_line":102}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_logs","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"cloudwatch_logs","module_path":["retail_app_ecs","orders_service"],"category":"identity","kind":"iam_policy","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"CloudWatch Logs policy for orders","name":"retail-store-ecs-orders-cloudwatch-logs","policy":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"unknown":["policy"],"unknown_causes":{"policy":"runtime-data"},"attr_variables":{"name":["environment_name"],"policy":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":37,"end_line":62}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_policy.ecs_exec","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"ecs_exec","module_path":["retail_app_ecs","orders_service"],"category":"identity","kind":"iam_policy","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"ECS exec policy","name":"retail-store-ecs-orders-exec","path":"/","policy":"{\"Statement\":[{\"Action\":[\"ssmmessages:CreateControlChannel\",\"ssmmessages:CreateDataChannel\",\"ssmmessages:OpenControlChannel\",\"ssmmessages:OpenDataChannel\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}],\"Version\":\"2012-10-17\"}","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":116,"end_line":137}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","mode":"managed","provider":"aws","source_type":"aws_iam_role","name":"task_execution_role","module_path":["retail_app_ecs","orders_service"],"category":"identity","kind":"iam_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"assume_role_policy":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"ecs-tasks.amazonaws.com\"\n      }\n    }\n  ]\n}","name":"retail-store-ecs-orders-te","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":14,"end_line":18}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","mode":"managed","provider":"aws","source_type":"aws_iam_role","name":"task_role","module_path":["retail_app_ecs","orders_service"],"category":"identity","kind":"iam_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"assume_role_policy":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"ecs-tasks.amazonaws.com\"\n      }\n    }\n  ]\n}","name":"retail-store-ecs-orders-task","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":31,"end_line":35}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_agent","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"cloudwatch_agent","module_path":["retail_app_ecs","orders_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","multiplicity":"count","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":104,"end_line":108}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_logs","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"cloudwatch_logs","module_path":["retail_app_ecs","orders_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"unknown":["policy_arn","role"],"unknown_causes":{"policy_arn":"provider-computed","role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":64,"end_line":67}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.ecs_exec","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"ecs_exec","module_path":["retail_app_ecs","orders_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"unknown":["policy_arn","role"],"unknown_causes":{"policy_arn":"provider-computed","role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":139,"end_line":142}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_additional","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_execution_role_additional","module_path":["retail_app_ecs","orders_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"unknown":["policy_arn","role"],"unknown_causes":{"policy_arn":"unknown-iteration","role":"provider-computed"},"instance_attrs":[{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"}],"instance_keys":["0"],"provenance":{"file":"../../lib/ecs/service/iam.tf","line":25,"end_line":29}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_policy","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_execution_role_policy","module_path":["retail_app_ecs","orders_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy","role":"\u003cunknown\u003e"},"unknown":["role"],"unknown_causes":{"role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":20,"end_line":23}},{"id":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_role_additional","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_role_additional","module_path":["retail_app_ecs","orders_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":110,"end_line":114}},{"id":"module.retail_app_ecs.module.orders_service.aws_security_group.this","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"this","module_path":["retail_app_ecs","orders_service"],"category":"network","kind":"firewall_group","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"egress":[{"cidr_blocks":["0.0.0.0/0"],"from_port":0,"protocol":"-1","to_port":0}],"ingress":[{"cidr_blocks":["0.0.0.0/0"],"from_port":8080,"protocol":"tcp","to_port":8080}],"name":"retail-store-ecs-orders-task","vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"vpc_id":"runtime-data"},"attr_variables":{"name":["environment_name"],"vpc_id":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/sg.tf","line":1,"end_line":18}},{"id":"module.retail_app_ecs.module.orders_service.data.aws_caller_identity.current","mode":"data","provider":"aws","source_type":"aws_caller_identity","name":"current","module_path":["retail_app_ecs","orders_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":1,"end_line":1}},{"id":"module.retail_app_ecs.module.orders_service.data.aws_iam_policy_document.assume_role_policy","mode":"data","provider":"aws","source_type":"aws_iam_policy_document","name":"assume_role_policy","module_path":["retail_app_ecs","orders_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"statement":[{"actions":["sts:AssumeRole"],"principals":[{"identifiers":["ecs-tasks.amazonaws.com"],"type":"Service"}]}]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":3,"end_line":12}},{"id":"module.retail_app_ecs.module.orders_service.data.aws_region.current","mode":"data","provider":"aws","source_type":"aws_region","name":"current","module_path":["retail_app_ecs","orders_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":123,"end_line":123}},{"id":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","mode":"managed","provider":"aws","source_type":"aws_ecs_service","name":"this","module_path":["retail_app_ecs","ui_service"],"category":"compute","kind":"container_service","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"cluster":"\u003cunknown\u003e","desired_count":1,"enable_execute_command":true,"launch_type":"FARGATE","load_balancer":[{"_dynamic":"unknown for_each","_template":{"container_name":"ui-service","container_port":8080,"target_group_arn":"\u003cunknown\u003e"},"container_name":"\u003cunknown\u003e","container_port":"\u003cunknown\u003e","target_group_arn":"\u003cunknown\u003e"}],"name":"ui","network_configuration":[{"assign_public_ip":false,"security_groups":["\u003cunknown\u003e"],"subnets":"\u003cunknown\u003e"}],"service_connect_configuration":[{"enabled":true,"namespace":"\u003cunknown\u003e","service":[{"client_alias":[{"dns_name":"ui","port":80}],"discovery_name":"ui","port_name":"ui-service"}]}],"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"task_definition":"\u003cunknown\u003e","wait_for_steady_state":true},"unknown":["cluster","load_balancer","network_configuration.security_groups","network_configuration.subnets","service_connect_configuration.namespace","task_definition"],"unknown_causes":{"cluster":"provider-computed","load_balancer":"provider-computed","network_configuration.security_groups":"provider-computed","network_configuration.subnets":"runtime-data","service_connect_configuration.namespace":"provider-computed","task_definition":"provider-computed"},"attr_variables":{"load_balancer.container_name":["environment_name"],"load_balancer.container_port":["environment_name"],"load_balancer.target_group_arn":["environment_name"],"network_configuration[0].subnets":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":136,"end_line":175}},{"id":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","mode":"managed","provider":"aws","source_type":"aws_ecs_task_definition","name":"this","module_path":["retail_app_ecs","ui_service"],"category":"compute","kind":"container_task","facet_of":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"container_definitions":"\u003cunknown\u003e","cpu":"1024","execution_role_arn":"\u003cunknown\u003e","family":"retail-store-ecs-ui","memory":"2048","network_mode":"awsvpc","requires_compatibilities":["FARGATE"],"task_role_arn":"\u003cunknown\u003e"},"unknown":["container_definitions","execution_role_arn","task_role_arn"],"unknown_causes":{"container_definitions":"runtime-data","execution_role_arn":"provider-computed","task_role_arn":"provider-computed"},"attr_variables":{"container_definitions":["container_image_overrides","environment_name","opentelemetry_enabled"],"family":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":125,"end_line":134}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_agent","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"cloudwatch_agent","module_path":["retail_app_ecs","ui_service"],"category":"identity","kind":"iam_policy","multiplicity":"count","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"attrs":{"description":"CloudWatch Agent policy for ui","name":"retail-store-ecs-ui-cloudwatch-agent","policy":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":69,"end_line":102}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_logs","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"cloudwatch_logs","module_path":["retail_app_ecs","ui_service"],"category":"identity","kind":"iam_policy","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"CloudWatch Logs policy for ui","name":"retail-store-ecs-ui-cloudwatch-logs","policy":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"unknown":["policy"],"unknown_causes":{"policy":"runtime-data"},"attr_variables":{"name":["environment_name"],"policy":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":37,"end_line":62}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_policy.ecs_exec","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"ecs_exec","module_path":["retail_app_ecs","ui_service"],"category":"identity","kind":"iam_policy","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"description":"ECS exec policy","name":"retail-store-ecs-ui-exec","path":"/","policy":"{\"Statement\":[{\"Action\":[\"ssmmessages:CreateControlChannel\",\"ssmmessages:CreateDataChannel\",\"ssmmessages:OpenControlChannel\",\"ssmmessages:OpenDataChannel\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}],\"Version\":\"2012-10-17\"}","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":116,"end_line":137}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","mode":"managed","provider":"aws","source_type":"aws_iam_role","name":"task_execution_role","module_path":["retail_app_ecs","ui_service"],"category":"identity","kind":"iam_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"assume_role_policy":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"ecs-tasks.amazonaws.com\"\n      }\n    }\n  ]\n}","name":"retail-store-ecs-ui-te","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":14,"end_line":18}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","mode":"managed","provider":"aws","source_type":"aws_iam_role","name":"task_role","module_path":["retail_app_ecs","ui_service"],"category":"identity","kind":"iam_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"assume_role_policy":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"ecs-tasks.amazonaws.com\"\n      }\n    }\n  ]\n}","name":"retail-store-ecs-ui-task","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":31,"end_line":35}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_agent","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"cloudwatch_agent","module_path":["retail_app_ecs","ui_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","multiplicity":"count","enabled":false,"instances":0,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.opentelemetry_enabled ? 1 : 0","variables":["var.opentelemetry_enabled"]},"attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":104,"end_line":108}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_logs","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"cloudwatch_logs","module_path":["retail_app_ecs","ui_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"unknown":["policy_arn","role"],"unknown_causes":{"policy_arn":"provider-computed","role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":64,"end_line":67}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.ecs_exec","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"ecs_exec","module_path":["retail_app_ecs","ui_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"unknown":["policy_arn","role"],"unknown_causes":{"policy_arn":"provider-computed","role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":139,"end_line":142}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.task_execution_role_additional","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_execution_role_additional","module_path":["retail_app_ecs","ui_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":25,"end_line":29}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.task_execution_role_policy","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_execution_role_policy","module_path":["retail_app_ecs","ui_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"policy_arn":"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy","role":"\u003cunknown\u003e"},"unknown":["role"],"unknown_causes":{"role":"provider-computed"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":20,"end_line":23}},{"id":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.task_role_additional","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"task_role_additional","module_path":["retail_app_ecs","ui_service"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":110,"end_line":114}},{"id":"module.retail_app_ecs.module.ui_service.aws_security_group.this","mode":"managed","provider":"aws","source_type":"aws_security_group","name":"this","module_path":["retail_app_ecs","ui_service"],"category":"network","kind":"firewall_group","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"egress":[{"cidr_blocks":["0.0.0.0/0"],"from_port":0,"protocol":"-1","to_port":0}],"ingress":[{"cidr_blocks":["0.0.0.0/0"],"from_port":8080,"protocol":"tcp","to_port":8080}],"name":"retail-store-ecs-ui-task","vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"vpc_id":"runtime-data"},"attr_variables":{"name":["environment_name"],"vpc_id":["environment_name"]},"provenance":{"file":"../../lib/ecs/service/sg.tf","line":1,"end_line":18}},{"id":"module.retail_app_ecs.module.ui_service.data.aws_caller_identity.current","mode":"data","provider":"aws","source_type":"aws_caller_identity","name":"current","module_path":["retail_app_ecs","ui_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":1,"end_line":1}},{"id":"module.retail_app_ecs.module.ui_service.data.aws_iam_policy_document.assume_role_policy","mode":"data","provider":"aws","source_type":"aws_iam_policy_document","name":"assume_role_policy","module_path":["retail_app_ecs","ui_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"statement":[{"actions":["sts:AssumeRole"],"principals":[{"identifiers":["ecs-tasks.amazonaws.com"],"type":"Service"}]}]},"provenance":{"file":"../../lib/ecs/service/iam.tf","line":3,"end_line":12}},{"id":"module.retail_app_ecs.module.ui_service.data.aws_region.current","mode":"data","provider":"aws","source_type":"aws_region","name":"current","module_path":["retail_app_ecs","ui_service"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"../../lib/ecs/service/ecs.tf","line":123,"end_line":123}},{"id":"module.retail_app_ecs.random_id.eventbridge_suffix","mode":"managed","provider":"random","source_type":"random_id","name":"eventbridge_suffix","module_path":["retail_app_ecs"],"category":"support","kind":"generated_value","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"byte_length":8},"provenance":{"file":"../../lib/ecs/eventbridge.tf","line":4,"end_line":6}},{"id":"module.retail_app_ecs.random_string.random_catalog_secret","mode":"managed","provider":"random","source_type":"random_string","name":"random_catalog_secret","module_path":["retail_app_ecs"],"category":"support","kind":"generated_value","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"length":4,"special":false},"provenance":{"file":"../../lib/ecs/catalog.tf","line":60,"end_line":63}},{"id":"module.retail_app_ecs.random_string.random_mq_secret","mode":"managed","provider":"random","source_type":"random_string","name":"random_mq_secret","module_path":["retail_app_ecs"],"category":"support","kind":"generated_value","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"length":4,"special":false},"provenance":{"file":"../../lib/ecs/common.tf","line":6,"end_line":9}},{"id":"module.retail_app_ecs.random_string.random_orders_secret","mode":"managed","provider":"random","source_type":"random_string","name":"random_orders_secret","module_path":["retail_app_ecs"],"category":"support","kind":"generated_value","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"length":4,"special":false},"provenance":{"file":"../../lib/ecs/orders.tf","line":63,"end_line":66}},{"id":"module.vpc.data.aws_availability_zones.available","mode":"data","provider":"aws","source_type":"aws_availability_zones","name":"available","module_path":["vpc"],"multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"state":"available"},"provenance":{"file":"../../lib/vpc/vpc.tf","line":7,"end_line":9}},{"id":"module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log","mode":"managed","provider":"aws","source_type":"aws_cloudwatch_log_group","name":"flow_log","module_path":["vpc","vpc"],"category":"observability","kind":"log_group","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"name":"\u003cunknown\u003e","skip_destroy":false,"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/vpc-flow-logs.tf","line":65,"end_line":75}},{"id":"module.vpc.module.vpc.aws_customer_gateway.this","mode":"managed","provider":"aws","source_type":"aws_customer_gateway","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"vpn_peer","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"bgp_asn":"\u003cunknown\u003e","device_name":"\u003cunknown\u003e","ip_address":"\u003cunknown\u003e","tags":{"Name":"\u003cunknown\u003e","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"type":"ipsec.1"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1165,"end_line":1182}},{"id":"module.vpc.module.vpc.aws_db_subnet_group.database","mode":"managed","provider":"aws","source_type":"aws_db_subnet_group","name":"database","module_path":["vpc","vpc"],"category":"network","kind":"database_subnet_group","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"Database subnet group for retail-store-ecs","name":"retail-store-ecs","subnet_ids":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"description":["environment_name"],"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":414,"end_line":428}},{"id":"module.vpc.module.vpc.aws_default_network_acl.this","mode":"managed","provider":"aws","source_type":"aws_default_network_acl","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"default_network_acl","facet_of":"module.vpc.module.vpc.aws_vpc.this","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"default_network_acl_id":"\u003cunknown\u003e","egress":[{"action":"allow","cidr_block":"0.0.0.0/0","from_port":0,"protocol":"-1","rule_no":100,"to_port":0},{"action":"allow","from_port":0,"ipv6_cidr_block":"::/0","protocol":"-1","rule_no":101,"to_port":0}],"ingress":[{"action":"allow","cidr_block":"0.0.0.0/0","from_port":0,"protocol":"-1","rule_no":100,"to_port":0},{"action":"allow","from_port":0,"ipv6_cidr_block":"::/0","protocol":"-1","rule_no":101,"to_port":0}],"tags":{"Name":"retail-store-ecs-default","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"unknown":["default_network_acl_id"],"unknown_causes":{"default_network_acl_id":"provider-computed"},"instance_attrs":[{"default_network_acl_id":"\u003cunknown\u003e","egress":[{"action":"allow","cidr_block":"0.0.0.0/0","from_port":0,"protocol":"-1","rule_no":100,"to_port":0},{"action":"allow","from_port":0,"ipv6_cidr_block":"::/0","protocol":"-1","rule_no":101,"to_port":0}],"ingress":[{"action":"allow","cidr_block":"0.0.0.0/0","from_port":0,"protocol":"-1","rule_no":100,"to_port":0},{"action":"allow","from_port":0,"ipv6_cidr_block":"::/0","protocol":"-1","rule_no":101,"to_port":0}],"tags":{"Name":"retail-store-ecs-default","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}}],"instance_keys":["0"],"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1311,"end_line":1358}},{"id":"module.vpc.module.vpc.aws_default_route_table.default","mode":"managed","provider":"aws","source_type":"aws_default_route_table","name":"default","module_path":["vpc","vpc"],"category":"network","kind":"default_route_table","facet_of":"module.vpc.module.vpc.aws_vpc.this","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"default_route_table_id":"\u003cunknown\u003e","propagating_vgws":[],"tags":{"Name":"retail-store-ecs-default","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{"create":"5m","update":"5m"}]},"unknown":["default_route_table_id"],"unknown_causes":{"default_route_table_id":"provider-computed"},"instance_attrs":[{"default_route_table_id":"\u003cunknown\u003e","propagating_vgws":[],"tags":{"Name":"retail-store-ecs-default","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"timeouts":[{"create":"5m","update":"5m"}]}],"instance_keys":["0"],"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1364,"end_line":1399}},{"id":"module.vpc.module.vpc.aws_default_security_group.this","mode":"managed","provider":"aws","source_type":"aws_default_security_group","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"default_firewall_group","facet_of":"module.vpc.module.vpc.aws_vpc.this","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"tags":{"Name":"retail-store-ecs-default","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"vpc_id":"provider-computed"},"instance_attrs":[{"tags":{"Name":"retail-store-ecs-default","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1265,"end_line":1305}},{"id":"module.vpc.module.vpc.aws_default_vpc.this","mode":"managed","provider":"aws","source_type":"aws_default_vpc","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"virtual_network","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"enable_dns_hostnames":true,"enable_dns_support":true,"tags":{"Name":"default","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1252,"end_line":1263}},{"id":"module.vpc.module.vpc.aws_egress_only_internet_gateway.this","mode":"managed","provider":"aws","source_type":"aws_egress_only_internet_gateway","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"internet_gateway","facet_of":"module.vpc.module.vpc.aws_vpc.this","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"tags":{"Name":"retail-store-ecs","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1063,"end_line":1073}},{"id":"module.vpc.module.vpc.aws_eip.nat","mode":"managed","provider":"aws","source_type":"aws_eip","name":"nat","module_path":["vpc","vpc"],"category":"network","kind":"public_ip","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"domain":"vpc","tags":{"Name":"\u003cunknown\u003e","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"unknown":["tags"],"unknown_causes":{"tags":"runtime-data"},"instance_attrs":[{"domain":"vpc","tags":{"Name":"\u003cunknown\u003e","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}}],"instance_keys":["0"],"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1092,"end_line":1109}},{"id":"module.vpc.module.vpc.aws_elasticache_subnet_group.elasticache","mode":"managed","provider":"aws","source_type":"aws_elasticache_subnet_group","name":"elasticache","module_path":["vpc","vpc"],"category":"network","kind":"cache_subnet_group","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"ElastiCache subnet group for retail-store-ecs","name":"retail-store-ecs","subnet_ids":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"description":["environment_name"],"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":733,"end_line":745}},{"id":"module.vpc.module.vpc.aws_flow_log.this","mode":"managed","provider":"aws","source_type":"aws_flow_log","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"flow_log","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"iam_role_arn":"","log_destination":"","log_destination_type":"cloud-watch-logs","max_aggregation_interval":600,"tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"traffic_type":"ALL","vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/vpc-flow-logs.tf","line":36,"end_line":59}},{"id":"module.vpc.module.vpc.aws_iam_policy.vpc_flow_log_cloudwatch","mode":"managed","provider":"aws","source_type":"aws_iam_policy","name":"vpc_flow_log_cloudwatch","module_path":["vpc","vpc"],"category":"identity","kind":"iam_policy","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"name_prefix":"vpc-flow-log-to-cloudwatch-","policy":"\u003cunknown\u003e","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/vpc-flow-logs.tf","line":122,"end_line":129}},{"id":"module.vpc.module.vpc.aws_iam_role.vpc_flow_log_cloudwatch","mode":"managed","provider":"aws","source_type":"aws_iam_role","name":"vpc_flow_log_cloudwatch","module_path":["vpc","vpc"],"category":"identity","kind":"iam_role","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"assume_role_policy":"\u003cunknown\u003e","name_prefix":"vpc-flow-log-role-","tags":{"created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/vpc-flow-logs.tf","line":77,"end_line":87}},{"id":"module.vpc.module.vpc.aws_iam_role_policy_attachment.vpc_flow_log_cloudwatch","mode":"managed","provider":"aws","source_type":"aws_iam_role_policy_attachment","name":"vpc_flow_log_cloudwatch","module_path":["vpc","vpc"],"category":"identity","kind":"iam_policy_attachment","facet_of":"module.vpc.module.vpc.aws_iam_role.vpc_flow_log_cloudwatch","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"policy_arn":"\u003cunknown\u003e","role":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/vpc-flow-logs.tf","line":115,"end_line":120}},{"id":"module.vpc.module.vpc.aws_internet_gateway.this","mode":"managed","provider":"aws","source_type":"aws_internet_gateway","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"internet_gateway","multiplicity":"count","enabled":true,"instances":-1,"presence":"CONDITIONAL","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_public_subnets \u0026\u0026 var.create_igw ? 1 : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":1},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"attrs":{"tags":{"Name":"retail-store-ecs","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"count":"runtime-data","vpc_id":"provider-computed"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1051,"end_line":1061}},{"id":"module.vpc.module.vpc.aws_nat_gateway.this","mode":"managed","provider":"aws","source_type":"aws_nat_gateway","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"nat_gateway","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"allocation_id":"\u003cunknown\u003e","subnet_id":"\u003cunknown\u003e","tags":{"Name":"\u003cunknown\u003e","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"unknown":["allocation_id","subnet_id","tags"],"unknown_causes":{"allocation_id":"provider-computed","subnet_id":"provider-computed","tags":"runtime-data"},"instance_attrs":[{"allocation_id":"\u003cunknown\u003e","subnet_id":"\u003cunknown\u003e","tags":{"Name":"\u003cunknown\u003e","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}}],"instance_keys":["0"],"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1111,"end_line":1135}},{"id":"module.vpc.module.vpc.aws_network_acl.database","mode":"managed","provider":"aws","source_type":"aws_network_acl","name":"database","module_path":["vpc","vpc"],"category":"network","kind":"network_acl","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"subnet_ids":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs-db","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":513,"end_line":524}},{"id":"module.vpc.module.vpc.aws_network_acl.elasticache","mode":"managed","provider":"aws","source_type":"aws_network_acl","name":"elasticache","module_path":["vpc","vpc"],"category":"network","kind":"network_acl","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"subnet_ids":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs-elasticache","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":780,"end_line":791}},{"id":"module.vpc.module.vpc.aws_network_acl.intra","mode":"managed","provider":"aws","source_type":"aws_network_acl","name":"intra","module_path":["vpc","vpc"],"category":"network","kind":"network_acl","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"subnet_ids":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs-intra","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":898,"end_line":909}},{"id":"module.vpc.module.vpc.aws_network_acl.outpost","mode":"managed","provider":"aws","source_type":"aws_network_acl","name":"outpost","module_path":["vpc","vpc"],"category":"network","kind":"network_acl","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"subnet_ids":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs-outpost","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1000,"end_line":1011}},{"id":"module.vpc.module.vpc.aws_network_acl.private","mode":"managed","provider":"aws","source_type":"aws_network_acl","name":"private","module_path":["vpc","vpc"],"category":"network","kind":"network_acl","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"subnet_ids":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs-private","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":331,"end_line":342}},{"id":"module.vpc.module.vpc.aws_network_acl.public","mode":"managed","provider":"aws","source_type":"aws_network_acl","name":"public","module_path":["vpc","vpc"],"category":"network","kind":"network_acl","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"subnet_ids":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs-public","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":212,"end_line":223}},{"id":"module.vpc.module.vpc.aws_network_acl.redshift","mode":"managed","provider":"aws","source_type":"aws_network_acl","name":"redshift","module_path":["vpc","vpc"],"category":"network","kind":"network_acl","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"subnet_ids":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs-redshift","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":650,"end_line":661}},{"id":"module.vpc.module.vpc.aws_network_acl_rule.database_inbound","mode":"managed","provider":"aws","source_type":"aws_network_acl_rule","name":"database_inbound","module_path":["vpc","vpc"],"category":"network","kind":"network_acl_rule","facet_of":"module.vpc.module.vpc.aws_network_acl.database","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","egress":false,"from_port":"\u003cunknown\u003e","icmp_code":"\u003cunknown\u003e","icmp_type":"\u003cunknown\u003e","ipv6_cidr_block":"\u003cunknown\u003e","network_acl_id":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","rule_action":"\u003cunknown\u003e","rule_number":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":526,"end_line":541}},{"id":"module.vpc.module.vpc.aws_network_acl_rule.database_outbound","mode":"managed","provider":"aws","source_type":"aws_network_acl_rule","name":"database_outbound","module_path":["vpc","vpc"],"category":"network","kind":"network_acl_rule","facet_of":"module.vpc.module.vpc.aws_network_acl.database","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","egress":true,"from_port":"\u003cunknown\u003e","icmp_code":"\u003cunknown\u003e","icmp_type":"\u003cunknown\u003e","ipv6_cidr_block":"\u003cunknown\u003e","network_acl_id":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","rule_action":"\u003cunknown\u003e","rule_number":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":543,"end_line":558}},{"id":"module.vpc.module.vpc.aws_network_acl_rule.elasticache_inbound","mode":"managed","provider":"aws","source_type":"aws_network_acl_rule","name":"elasticache_inbound","module_path":["vpc","vpc"],"category":"network","kind":"network_acl_rule","facet_of":"module.vpc.module.vpc.aws_network_acl.elasticache","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","egress":false,"from_port":"\u003cunknown\u003e","icmp_code":"\u003cunknown\u003e","icmp_type":"\u003cunknown\u003e","ipv6_cidr_block":"\u003cunknown\u003e","network_acl_id":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","rule_action":"\u003cunknown\u003e","rule_number":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":793,"end_line":808}},{"id":"module.vpc.module.vpc.aws_network_acl_rule.elasticache_outbound","mode":"managed","provider":"aws","source_type":"aws_network_acl_rule","name":"elasticache_outbound","module_path":["vpc","vpc"],"category":"network","kind":"network_acl_rule","facet_of":"module.vpc.module.vpc.aws_network_acl.elasticache","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","egress":true,"from_port":"\u003cunknown\u003e","icmp_code":"\u003cunknown\u003e","icmp_type":"\u003cunknown\u003e","ipv6_cidr_block":"\u003cunknown\u003e","network_acl_id":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","rule_action":"\u003cunknown\u003e","rule_number":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":810,"end_line":825}},{"id":"module.vpc.module.vpc.aws_network_acl_rule.intra_inbound","mode":"managed","provider":"aws","source_type":"aws_network_acl_rule","name":"intra_inbound","module_path":["vpc","vpc"],"category":"network","kind":"network_acl_rule","facet_of":"module.vpc.module.vpc.aws_network_acl.intra","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","egress":false,"from_port":"\u003cunknown\u003e","icmp_code":"\u003cunknown\u003e","icmp_type":"\u003cunknown\u003e","ipv6_cidr_block":"\u003cunknown\u003e","network_acl_id":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","rule_action":"\u003cunknown\u003e","rule_number":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":911,"end_line":926}},{"id":"module.vpc.module.vpc.aws_network_acl_rule.intra_outbound","mode":"managed","provider":"aws","source_type":"aws_network_acl_rule","name":"intra_outbound","module_path":["vpc","vpc"],"category":"network","kind":"network_acl_rule","facet_of":"module.vpc.module.vpc.aws_network_acl.intra","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","egress":true,"from_port":"\u003cunknown\u003e","icmp_code":"\u003cunknown\u003e","icmp_type":"\u003cunknown\u003e","ipv6_cidr_block":"\u003cunknown\u003e","network_acl_id":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","rule_action":"\u003cunknown\u003e","rule_number":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":928,"end_line":943}},{"id":"module.vpc.module.vpc.aws_network_acl_rule.outpost_inbound","mode":"managed","provider":"aws","source_type":"aws_network_acl_rule","name":"outpost_inbound","module_path":["vpc","vpc"],"category":"network","kind":"network_acl_rule","facet_of":"module.vpc.module.vpc.aws_network_acl.outpost","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","egress":false,"from_port":"\u003cunknown\u003e","icmp_code":"\u003cunknown\u003e","icmp_type":"\u003cunknown\u003e","ipv6_cidr_block":"\u003cunknown\u003e","network_acl_id":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","rule_action":"\u003cunknown\u003e","rule_number":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1013,"end_line":1028}},{"id":"module.vpc.module.vpc.aws_network_acl_rule.outpost_outbound","mode":"managed","provider":"aws","source_type":"aws_network_acl_rule","name":"outpost_outbound","module_path":["vpc","vpc"],"category":"network","kind":"network_acl_rule","facet_of":"module.vpc.module.vpc.aws_network_acl.outpost","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","egress":true,"from_port":"\u003cunknown\u003e","icmp_code":"\u003cunknown\u003e","icmp_type":"\u003cunknown\u003e","ipv6_cidr_block":"\u003cunknown\u003e","network_acl_id":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","rule_action":"\u003cunknown\u003e","rule_number":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1030,"end_line":1045}},{"id":"module.vpc.module.vpc.aws_network_acl_rule.private_inbound","mode":"managed","provider":"aws","source_type":"aws_network_acl_rule","name":"private_inbound","module_path":["vpc","vpc"],"category":"network","kind":"network_acl_rule","facet_of":"module.vpc.module.vpc.aws_network_acl.private","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","egress":false,"from_port":"\u003cunknown\u003e","icmp_code":"\u003cunknown\u003e","icmp_type":"\u003cunknown\u003e","ipv6_cidr_block":"\u003cunknown\u003e","network_acl_id":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","rule_action":"\u003cunknown\u003e","rule_number":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":344,"end_line":359}},{"id":"module.vpc.module.vpc.aws_network_acl_rule.private_outbound","mode":"managed","provider":"aws","source_type":"aws_network_acl_rule","name":"private_outbound","module_path":["vpc","vpc"],"category":"network","kind":"network_acl_rule","facet_of":"module.vpc.module.vpc.aws_network_acl.private","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","egress":true,"from_port":"\u003cunknown\u003e","icmp_code":"\u003cunknown\u003e","icmp_type":"\u003cunknown\u003e","ipv6_cidr_block":"\u003cunknown\u003e","network_acl_id":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","rule_action":"\u003cunknown\u003e","rule_number":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":361,"end_line":376}},{"id":"module.vpc.module.vpc.aws_network_acl_rule.public_inbound","mode":"managed","provider":"aws","source_type":"aws_network_acl_rule","name":"public_inbound","module_path":["vpc","vpc"],"category":"network","kind":"network_acl_rule","facet_of":"module.vpc.module.vpc.aws_network_acl.public","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","egress":false,"from_port":"\u003cunknown\u003e","icmp_code":"\u003cunknown\u003e","icmp_type":"\u003cunknown\u003e","ipv6_cidr_block":"\u003cunknown\u003e","network_acl_id":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","rule_action":"\u003cunknown\u003e","rule_number":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":225,"end_line":240}},{"id":"module.vpc.module.vpc.aws_network_acl_rule.public_outbound","mode":"managed","provider":"aws","source_type":"aws_network_acl_rule","name":"public_outbound","module_path":["vpc","vpc"],"category":"network","kind":"network_acl_rule","facet_of":"module.vpc.module.vpc.aws_network_acl.public","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","egress":true,"from_port":"\u003cunknown\u003e","icmp_code":"\u003cunknown\u003e","icmp_type":"\u003cunknown\u003e","ipv6_cidr_block":"\u003cunknown\u003e","network_acl_id":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","rule_action":"\u003cunknown\u003e","rule_number":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":242,"end_line":257}},{"id":"module.vpc.module.vpc.aws_network_acl_rule.redshift_inbound","mode":"managed","provider":"aws","source_type":"aws_network_acl_rule","name":"redshift_inbound","module_path":["vpc","vpc"],"category":"network","kind":"network_acl_rule","facet_of":"module.vpc.module.vpc.aws_network_acl.redshift","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","egress":false,"from_port":"\u003cunknown\u003e","icmp_code":"\u003cunknown\u003e","icmp_type":"\u003cunknown\u003e","ipv6_cidr_block":"\u003cunknown\u003e","network_acl_id":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","rule_action":"\u003cunknown\u003e","rule_number":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":663,"end_line":678}},{"id":"module.vpc.module.vpc.aws_network_acl_rule.redshift_outbound","mode":"managed","provider":"aws","source_type":"aws_network_acl_rule","name":"redshift_outbound","module_path":["vpc","vpc"],"category":"network","kind":"network_acl_rule","facet_of":"module.vpc.module.vpc.aws_network_acl.redshift","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","egress":true,"from_port":"\u003cunknown\u003e","icmp_code":"\u003cunknown\u003e","icmp_type":"\u003cunknown\u003e","ipv6_cidr_block":"\u003cunknown\u003e","network_acl_id":"\u003cunknown\u003e","protocol":"\u003cunknown\u003e","rule_action":"\u003cunknown\u003e","rule_number":"\u003cunknown\u003e","to_port":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":680,"end_line":695}},{"id":"module.vpc.module.vpc.aws_redshift_subnet_group.redshift","mode":"managed","provider":"aws","source_type":"aws_redshift_subnet_group","name":"redshift","module_path":["vpc","vpc"],"category":"data","kind":"db_subnet_group","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"description":"Redshift subnet group for retail-store-ecs","name":"retail-store-ecs","subnet_ids":"\u003cunknown\u003e","tags":{"Name":"retail-store-ecs","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"description":["environment_name"],"name":["environment_name"],"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":596,"end_line":608}},{"id":"module.vpc.module.vpc.aws_route.database_dns64_nat_gateway","mode":"managed","provider":"aws","source_type":"aws_route","name":"database_dns64_nat_gateway","module_path":["vpc","vpc"],"category":"network","kind":"route","facet_of":"module.vpc.module.vpc.aws_route_table.database","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"destination_ipv6_cidr_block":"64:ff9b::/96","nat_gateway_id":"\u003cunknown\u003e","route_table_id":"\u003cunknown\u003e","timeouts":[{"create":"5m"}]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":481,"end_line":491}},{"id":"module.vpc.module.vpc.aws_route.database_internet_gateway","mode":"managed","provider":"aws","source_type":"aws_route","name":"database_internet_gateway","module_path":["vpc","vpc"],"category":"network","kind":"route","facet_of":"module.vpc.module.vpc.aws_route_table.database","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"destination_cidr_block":"0.0.0.0/0","gateway_id":"\u003cunknown\u003e","route_table_id":"\u003cunknown\u003e","timeouts":[{"create":"5m"}]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":457,"end_line":467}},{"id":"module.vpc.module.vpc.aws_route.database_ipv6_egress","mode":"managed","provider":"aws","source_type":"aws_route","name":"database_ipv6_egress","module_path":["vpc","vpc"],"category":"network","kind":"route","facet_of":"module.vpc.module.vpc.aws_route_table.database","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"destination_ipv6_cidr_block":"::/0","egress_only_gateway_id":"\u003cunknown\u003e","route_table_id":"\u003cunknown\u003e","timeouts":[{"create":"5m"}]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":493,"end_line":503}},{"id":"module.vpc.module.vpc.aws_route.database_nat_gateway","mode":"managed","provider":"aws","source_type":"aws_route","name":"database_nat_gateway","module_path":["vpc","vpc"],"category":"network","kind":"route","facet_of":"module.vpc.module.vpc.aws_route_table.database","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"destination_cidr_block":"0.0.0.0/0","nat_gateway_id":"\u003cunknown\u003e","route_table_id":"\u003cunknown\u003e","timeouts":[{"create":"5m"}]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":469,"end_line":479}},{"id":"module.vpc.module.vpc.aws_route.private_dns64_nat_gateway","mode":"managed","provider":"aws","source_type":"aws_route","name":"private_dns64_nat_gateway","module_path":["vpc","vpc"],"category":"network","kind":"route","facet_of":"module.vpc.module.vpc.aws_route_table.private","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"destination_ipv6_cidr_block":"64:ff9b::/96","nat_gateway_id":"\u003cunknown\u003e","route_table_id":"\u003cunknown\u003e","timeouts":[{"create":"5m"}]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1149,"end_line":1159}},{"id":"module.vpc.module.vpc.aws_route.private_ipv6_egress","mode":"managed","provider":"aws","source_type":"aws_route","name":"private_ipv6_egress","module_path":["vpc","vpc"],"category":"network","kind":"route","facet_of":"module.vpc.module.vpc.aws_route_table.private","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"destination_ipv6_cidr_block":"::/0","egress_only_gateway_id":"\u003cunknown\u003e","route_table_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1075,"end_line":1081}},{"id":"module.vpc.module.vpc.aws_route.private_nat_gateway","mode":"managed","provider":"aws","source_type":"aws_route","name":"private_nat_gateway","module_path":["vpc","vpc"],"category":"network","kind":"route","facet_of":"module.vpc.module.vpc.aws_route_table.private","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"destination_cidr_block":"0.0.0.0/0","nat_gateway_id":"\u003cunknown\u003e","route_table_id":"\u003cunknown\u003e","timeouts":[{"create":"5m"}]},"unknown":["nat_gateway_id","route_table_id"],"unknown_causes":{"nat_gateway_id":"unknown-iteration","route_table_id":"unknown-iteration"},"instance_attrs":[{"destination_cidr_block":"0.0.0.0/0","nat_gateway_id":"\u003cunknown\u003e","route_table_id":"\u003cunknown\u003e","timeouts":[{"create":"5m"}]}],"instance_keys":["0"],"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1137,"end_line":1147}},{"id":"module.vpc.module.vpc.aws_route.public_internet_gateway","mode":"managed","provider":"aws","source_type":"aws_route","name":"public_internet_gateway","module_path":["vpc","vpc"],"category":"network","kind":"route","facet_of":"module.vpc.module.vpc.aws_route_table.public","multiplicity":"count","enabled":true,"instances":-1,"presence":"CONDITIONAL","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_public_subnets \u0026\u0026 var.create_igw ? local.num_public_route_tables : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":1},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"attrs":{"destination_cidr_block":"0.0.0.0/0","gateway_id":"\u003cunknown\u003e","route_table_id":"\u003cunknown\u003e","timeouts":[{"create":"5m"}]},"unknown":["gateway_id","route_table_id"],"unknown_causes":{"count":"runtime-data","gateway_id":"provider-computed","route_table_id":"unknown-iteration:runtime-data"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":188,"end_line":198}},{"id":"module.vpc.module.vpc.aws_route.public_internet_gateway_ipv6","mode":"managed","provider":"aws","source_type":"aws_route","name":"public_internet_gateway_ipv6","module_path":["vpc","vpc"],"category":"network","kind":"route","facet_of":"module.vpc.module.vpc.aws_route_table.public","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"destination_ipv6_cidr_block":"::/0","gateway_id":"\u003cunknown\u003e","route_table_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":200,"end_line":206}},{"id":"module.vpc.module.vpc.aws_route_table.database","mode":"managed","provider":"aws","source_type":"aws_route_table","name":"database","module_path":["vpc","vpc"],"category":"network","kind":"route_table","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"tags":{"Name":"retail-store-ecs-db","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":430,"end_line":445}},{"id":"module.vpc.module.vpc.aws_route_table.elasticache","mode":"managed","provider":"aws","source_type":"aws_route_table","name":"elasticache","module_path":["vpc","vpc"],"category":"network","kind":"route_table","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"tags":{"Name":"retail-store-ecs-elasticache","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":747,"end_line":757}},{"id":"module.vpc.module.vpc.aws_route_table.intra","mode":"managed","provider":"aws","source_type":"aws_route_table","name":"intra","module_path":["vpc","vpc"],"category":"network","kind":"route_table","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"tags":{"Name":"retail-store-ecs-intra","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":866,"end_line":881}},{"id":"module.vpc.module.vpc.aws_route_table.private","mode":"managed","provider":"aws","source_type":"aws_route_table","name":"private","module_path":["vpc","vpc"],"category":"network","kind":"route_table","multiplicity":"count","enabled":true,"instances":-1,"presence":"CONDITIONAL","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_private_subnets \u0026\u0026 local.max_subnet_length \u003e 0 ? local.nat_gateway_count : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":1},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"attrs":{"tags":{"Name":"retail-store-ecs-private","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"count":"runtime-data","vpc_id":"provider-computed"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":296,"end_line":311}},{"id":"module.vpc.module.vpc.aws_route_table.public","mode":"managed","provider":"aws","source_type":"aws_route_table","name":"public","module_path":["vpc","vpc"],"category":"network","kind":"route_table","multiplicity":"count","enabled":true,"instances":-1,"presence":"CONDITIONAL","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_public_subnets ? local.num_public_route_tables : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":1},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"attrs":{"tags":{"Name":"retail-store-ecs-public","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"unknown":["vpc_id"],"unknown_causes":{"count":"runtime-data","vpc_id":"provider-computed"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":164,"end_line":179}},{"id":"module.vpc.module.vpc.aws_route_table.redshift","mode":"managed","provider":"aws","source_type":"aws_route_table","name":"redshift","module_path":["vpc","vpc"],"category":"network","kind":"route_table","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"tags":{"Name":"retail-store-ecs-redshift","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":610,"end_line":620}},{"id":"module.vpc.module.vpc.aws_route_table_association.database","mode":"managed","provider":"aws","source_type":"aws_route_table_association","name":"database","module_path":["vpc","vpc"],"category":"network","kind":"route_table_association","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"route_table_id":"\u003cunknown\u003e","subnet_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":447,"end_line":455}},{"id":"module.vpc.module.vpc.aws_route_table_association.elasticache","mode":"managed","provider":"aws","source_type":"aws_route_table_association","name":"elasticache","module_path":["vpc","vpc"],"category":"network","kind":"route_table_association","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"route_table_id":"\u003cunknown\u003e","subnet_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":759,"end_line":770}},{"id":"module.vpc.module.vpc.aws_route_table_association.intra","mode":"managed","provider":"aws","source_type":"aws_route_table_association","name":"intra","module_path":["vpc","vpc"],"category":"network","kind":"route_table_association","facet_of":"module.vpc.module.vpc.aws_route_table.intra","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"route_table_id":"\u003cunknown\u003e","subnet_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":883,"end_line":888}},{"id":"module.vpc.module.vpc.aws_route_table_association.outpost","mode":"managed","provider":"aws","source_type":"aws_route_table_association","name":"outpost","module_path":["vpc","vpc"],"category":"network","kind":"route_table_association","facet_of":"module.vpc.module.vpc.aws_route_table.private","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"route_table_id":"\u003cunknown\u003e","subnet_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":982,"end_line":990}},{"id":"module.vpc.module.vpc.aws_route_table_association.private","mode":"managed","provider":"aws","source_type":"aws_route_table_association","name":"private","module_path":["vpc","vpc"],"category":"network","kind":"route_table_association","facet_of":"module.vpc.module.vpc.aws_route_table.private","multiplicity":"count","enabled":true,"instances":-1,"presence":"CONDITIONAL","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_private_subnets ? local.len_private_subnets : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":3},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"attrs":{"route_table_id":"\u003cunknown\u003e","subnet_id":"\u003cunknown\u003e"},"unknown":["route_table_id","subnet_id"],"unknown_causes":{"count":"runtime-data","route_table_id":"provider-computed","subnet_id":"unknown-iteration:runtime-data"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":313,"end_line":321}},{"id":"module.vpc.module.vpc.aws_route_table_association.public","mode":"managed","provider":"aws","source_type":"aws_route_table_association","name":"public","module_path":["vpc","vpc"],"category":"network","kind":"route_table_association","facet_of":"module.vpc.module.vpc.aws_route_table.public","multiplicity":"count","enabled":true,"instances":-1,"presence":"CONDITIONAL","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_public_subnets ? local.len_public_subnets : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":3},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"attrs":{"route_table_id":"\u003cunknown\u003e","subnet_id":"\u003cunknown\u003e"},"unknown":["route_table_id","subnet_id"],"unknown_causes":{"count":"runtime-data","route_table_id":"provider-computed","subnet_id":"unknown-iteration:runtime-data"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":181,"end_line":186}},{"id":"module.vpc.module.vpc.aws_route_table_association.redshift","mode":"managed","provider":"aws","source_type":"aws_route_table_association","name":"redshift","module_path":["vpc","vpc"],"category":"network","kind":"route_table_association","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"route_table_id":"\u003cunknown\u003e","subnet_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":622,"end_line":630}},{"id":"module.vpc.module.vpc.aws_route_table_association.redshift_public","mode":"managed","provider":"aws","source_type":"aws_route_table_association","name":"redshift_public","module_path":["vpc","vpc"],"category":"network","kind":"route_table_association","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"route_table_id":"\u003cunknown\u003e","subnet_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":632,"end_line":640}},{"id":"module.vpc.module.vpc.aws_subnet.database","mode":"managed","provider":"aws","source_type":"aws_subnet","name":"database","module_path":["vpc","vpc"],"category":"network","kind":"subnet","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"assign_ipv6_address_on_creation":false,"availability_zone":"\u003cunknown\u003e","availability_zone_id":"\u003cunknown\u003e","cidr_block":"\u003cunknown\u003e","enable_dns64":false,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"ipv6_native":false,"tags":{"Name":"\u003cunknown\u003e","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":387,"end_line":412}},{"id":"module.vpc.module.vpc.aws_subnet.elasticache","mode":"managed","provider":"aws","source_type":"aws_subnet","name":"elasticache","module_path":["vpc","vpc"],"category":"network","kind":"subnet","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"assign_ipv6_address_on_creation":false,"availability_zone":"\u003cunknown\u003e","availability_zone_id":"\u003cunknown\u003e","cidr_block":"\u003cunknown\u003e","enable_dns64":false,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"ipv6_native":false,"tags":{"Name":"\u003cunknown\u003e","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":706,"end_line":731}},{"id":"module.vpc.module.vpc.aws_subnet.intra","mode":"managed","provider":"aws","source_type":"aws_subnet","name":"intra","module_path":["vpc","vpc"],"category":"network","kind":"subnet","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"assign_ipv6_address_on_creation":false,"availability_zone":"\u003cunknown\u003e","availability_zone_id":"\u003cunknown\u003e","cidr_block":"\u003cunknown\u003e","enable_dns64":false,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"ipv6_native":false,"tags":{"Name":"\u003cunknown\u003e","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":835,"end_line":860}},{"id":"module.vpc.module.vpc.aws_subnet.outpost","mode":"managed","provider":"aws","source_type":"aws_subnet","name":"outpost","module_path":["vpc","vpc"],"category":"network","kind":"subnet","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"assign_ipv6_address_on_creation":false,"cidr_block":"\u003cunknown\u003e","enable_dns64":false,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"ipv6_native":false,"map_customer_owned_ip_on_launch":false,"tags":{"Name":"\u003cunknown\u003e","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":953,"end_line":980}},{"id":"module.vpc.module.vpc.aws_subnet.private","mode":"managed","provider":"aws","source_type":"aws_subnet","name":"private","module_path":["vpc","vpc"],"category":"network","kind":"subnet","multiplicity":"count","enabled":true,"instances":-1,"presence":"CONDITIONAL","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_private_subnets ? local.len_private_subnets : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":3},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"attrs":{"assign_ipv6_address_on_creation":false,"availability_zone":"\u003cunknown\u003e","availability_zone_id":"\u003cunknown\u003e","cidr_block":"\u003cunknown\u003e","enable_dns64":false,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"ipv6_native":false,"tags":"\u003cunknown\u003e","vpc_id":"\u003cunknown\u003e"},"unknown":["availability_zone","availability_zone_id","cidr_block","tags","vpc_id"],"unknown_causes":{"availability_zone":"unknown-iteration:runtime-data","availability_zone_id":"unknown-iteration:runtime-data","cidr_block":"unknown-iteration:runtime-data","count":"runtime-data","tags":"unknown-iteration:runtime-data","vpc_id":"provider-computed"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":267,"end_line":293}},{"id":"module.vpc.module.vpc.aws_subnet.public","mode":"managed","provider":"aws","source_type":"aws_subnet","name":"public","module_path":["vpc","vpc"],"category":"network","kind":"subnet","multiplicity":"count","enabled":true,"instances":-1,"presence":"CONDITIONAL","presence_cause":{"kind":"runtime-data","where":"count","expr":"local.create_public_subnets \u0026\u0026 (!var.one_nat_gateway_per_az || local.len_public_subnets \u003e= length(var.azs)) ? local.len_public_subnets : 0","decided_by":["module.vpc.data.aws_availability_zones.available"],"instances_bound":{"min":0,"max":3},"source_constraint":{"cause":"POSSIBLE_SOURCE_ERROR","function":"slice","end_index":3,"list_min_length":0,"detail":"slice(list, start, 3) fails in Terraform and OpenTofu when the list has fewer than 3 elements, and nothing proves any length of the list: the count is an interval over lengths the source may not be valid for, not an exact number; a plan that succeeds settles it"}},"attrs":{"assign_ipv6_address_on_creation":false,"availability_zone":"\u003cunknown\u003e","availability_zone_id":"\u003cunknown\u003e","cidr_block":"\u003cunknown\u003e","enable_dns64":false,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"ipv6_native":false,"map_public_ip_on_launch":false,"tags":"\u003cunknown\u003e","vpc_id":"\u003cunknown\u003e"},"unknown":["availability_zone","availability_zone_id","cidr_block","tags","vpc_id"],"unknown_causes":{"availability_zone":"unknown-iteration:runtime-data","availability_zone_id":"unknown-iteration:runtime-data","cidr_block":"unknown-iteration:runtime-data","count":"runtime-data","tags":"unknown-iteration:runtime-data","vpc_id":"provider-computed"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":131,"end_line":158}},{"id":"module.vpc.module.vpc.aws_subnet.redshift","mode":"managed","provider":"aws","source_type":"aws_subnet","name":"redshift","module_path":["vpc","vpc"],"category":"network","kind":"subnet","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"assign_ipv6_address_on_creation":false,"availability_zone":"\u003cunknown\u003e","availability_zone_id":"\u003cunknown\u003e","cidr_block":"\u003cunknown\u003e","enable_dns64":false,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"ipv6_native":false,"tags":{"Name":"\u003cunknown\u003e","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":569,"end_line":594}},{"id":"module.vpc.module.vpc.aws_vpc.this","mode":"managed","provider":"aws","source_type":"aws_vpc","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"virtual_network","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"cidr_block":"10.0.0.0/16","enable_dns_hostnames":true,"enable_dns_support":true,"instance_tenancy":"default","tags":{"Name":"retail-store-ecs","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"instance_attrs":[{"cidr_block":"10.0.0.0/16","enable_dns_hostnames":true,"enable_dns_support":true,"instance_tenancy":"default","tags":{"Name":"retail-store-ecs","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}}],"instance_keys":["0"],"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":28,"end_line":51}},{"id":"module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","mode":"managed","provider":"aws","source_type":"aws_vpc_block_public_access_exclusion","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"network_exposure_exclusion","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"internet_gateway_exclusion_mode":"\u003cunknown\u003e","subnet_id":"\u003cunknown\u003e","tags":"\u003cunknown\u003e","vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":68,"end_line":93}},{"id":"module.vpc.module.vpc.aws_vpc_block_public_access_options.this","mode":"managed","provider":"aws","source_type":"aws_vpc_block_public_access_options","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"account_setting","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":62,"end_line":66}},{"id":"module.vpc.module.vpc.aws_vpc_dhcp_options.this","mode":"managed","provider":"aws","source_type":"aws_vpc_dhcp_options","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"dhcp_options","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"domain_name":"","domain_name_servers":["AmazonProvidedDNS"],"netbios_name_servers":[],"netbios_node_type":"","ntp_servers":[],"tags":{"Name":"retail-store-ecs","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"}},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":99,"end_line":114}},{"id":"module.vpc.module.vpc.aws_vpc_dhcp_options_association.this","mode":"managed","provider":"aws","source_type":"aws_vpc_dhcp_options_association","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"dhcp_options_attachment","facet_of":"module.vpc.module.vpc.aws_vpc_dhcp_options.this","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"dhcp_options_id":"\u003cunknown\u003e","vpc_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":116,"end_line":121}},{"id":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","mode":"managed","provider":"aws","source_type":"aws_vpc_ipv4_cidr_block_association","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"address_range","facet_of":"module.vpc.module.vpc.aws_vpc.this","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"cidr_block":"\u003cunknown\u003e","vpc_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":53,"end_line":60}},{"id":"module.vpc.module.vpc.aws_vpn_gateway.this","mode":"managed","provider":"aws","source_type":"aws_vpn_gateway","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"vpn_gateway","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"amazon_side_asn":"64512","tags":{"Name":"retail-store-ecs","created-by":"retail-store-sample-app","environment-name":"retail-store-ecs"},"vpc_id":"\u003cunknown\u003e"},"attr_variables":{"tags":["environment_name"]},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1188,"end_line":1200}},{"id":"module.vpc.module.vpc.aws_vpn_gateway_attachment.this","mode":"managed","provider":"aws","source_type":"aws_vpn_gateway_attachment","name":"this","module_path":["vpc","vpc"],"category":"network","kind":"vpn_gateway_attachment","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"vpc_id":"\u003cunknown\u003e","vpn_gateway_id":""},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1202,"end_line":1207}},{"id":"module.vpc.module.vpc.aws_vpn_gateway_route_propagation.intra","mode":"managed","provider":"aws","source_type":"aws_vpn_gateway_route_propagation","name":"intra","module_path":["vpc","vpc"],"category":"network","kind":"route","facet_of":"module.vpc.module.vpc.aws_route_table.intra","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"route_table_id":"\u003cunknown\u003e","vpn_gateway_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1235,"end_line":1246}},{"id":"module.vpc.module.vpc.aws_vpn_gateway_route_propagation.private","mode":"managed","provider":"aws","source_type":"aws_vpn_gateway_route_propagation","name":"private","module_path":["vpc","vpc"],"category":"network","kind":"route","facet_of":"module.vpc.module.vpc.aws_route_table.private","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"route_table_id":"\u003cunknown\u003e","vpn_gateway_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1222,"end_line":1233}},{"id":"module.vpc.module.vpc.aws_vpn_gateway_route_propagation.public","mode":"managed","provider":"aws","source_type":"aws_vpn_gateway_route_propagation","name":"public","module_path":["vpc","vpc"],"category":"network","kind":"route","facet_of":"module.vpc.module.vpc.aws_route_table.public","multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"route_table_id":"\u003cunknown\u003e","vpn_gateway_id":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/vpc.vpc/main.tf","line":1209,"end_line":1220}},{"id":"module.vpc.module.vpc.data.aws_caller_identity.current","mode":"data","provider":"aws","source_type":"aws_caller_identity","name":"current","module_path":["vpc","vpc"],"multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{},"provenance":{"file":".terraform/modules/vpc.vpc/vpc-flow-logs.tf","line":6,"end_line":9}},{"id":"module.vpc.module.vpc.data.aws_iam_policy_document.flow_log_cloudwatch_assume_role","mode":"data","provider":"aws","source_type":"aws_iam_policy_document","name":"flow_log_cloudwatch_assume_role","module_path":["vpc","vpc"],"multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"statement":[{"actions":["sts:AssumeRole"],"effect":"Allow","principals":[{"identifiers":["vpc-flow-logs.amazonaws.com"],"type":"Service"}],"sid":"AWSVPCFlowLogsAssumeRole"}]},"provenance":{"file":".terraform/modules/vpc.vpc/vpc-flow-logs.tf","line":89,"end_line":113}},{"id":"module.vpc.module.vpc.data.aws_iam_policy_document.vpc_flow_log_cloudwatch","mode":"data","provider":"aws","source_type":"aws_iam_policy_document","name":"vpc_flow_log_cloudwatch","module_path":["vpc","vpc"],"multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"statement":[{"actions":["logs:CreateLogStream","logs:DescribeLogGroups","logs:DescribeLogStreams","logs:PutLogEvents"],"effect":"Allow","resources":"\u003cunknown\u003e","sid":"AWSVPCFlowLogsPushToCloudWatch"}]},"provenance":{"file":".terraform/modules/vpc.vpc/vpc-flow-logs.tf","line":131,"end_line":148}},{"id":"module.vpc.module.vpc.data.aws_partition.current","mode":"data","provider":"aws","source_type":"aws_partition","name":"current","module_path":["vpc","vpc"],"multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{},"provenance":{"file":".terraform/modules/vpc.vpc/vpc-flow-logs.tf","line":11,"end_line":14}},{"id":"module.vpc.module.vpc.data.aws_region.current","mode":"data","provider":"aws","source_type":"aws_region","name":"current","module_path":["vpc","vpc"],"multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{},"provenance":{"file":".terraform/modules/vpc.vpc/vpc-flow-logs.tf","line":1,"end_line":4}}],"edges":[{"from":"module.dependencies.aws_iam_policy.carts_dynamo","to":"module.dependencies.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.dependencies.aws_iam_policy.carts_dynamo","to":"module.dependencies.data.aws_partition.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.dependencies.aws_iam_policy.carts_dynamo","to":"module.dependencies.data.aws_region.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.dependencies.aws_iam_policy.carts_dynamo","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","type":"DEPENDS_ON","via":"policy","fanout":3},{"from":"module.dependencies.aws_iam_policy.carts_dynamo","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","type":"DEPENDS_ON","via":"policy","fanout":3},{"from":"module.dependencies.aws_iam_policy.carts_dynamo","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","type":"DEPENDS_ON","via":"policy","fanout":3},{"from":"module.dependencies.aws_mq_broker.mq","to":"module.dependencies.aws_security_group.mq","type":"ATTACHED_TO","via":"security_groups"},{"from":"module.dependencies.aws_mq_broker.mq","to":"module.dependencies.random_password.mq_password","type":"DEPENDS_ON","via":"user.password"},{"from":"module.dependencies.aws_mq_broker.mq","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPLOYED_IN","via":"subnet_ids"},{"from":"module.dependencies.aws_security_group.catalog_opensearch_sg","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.dependencies.aws_security_group.mq","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.dependencies.aws_security_group_rule.allow_https_from_client","to":"module.dependencies.aws_security_group.catalog_opensearch_sg","type":"ATTACHED_TO","via":"security_group_id"},{"from":"module.dependencies.aws_security_group_rule.allow_https_from_client","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","type":"ATTACHED_TO","via":"source_security_group_id"},{"from":"module.dependencies.aws_security_group_rule.mq","to":"module.dependencies.aws_security_group.mq","type":"ATTACHED_TO","via":"security_group_id"},{"from":"module.dependencies.aws_security_group_rule.mq","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","type":"ATTACHED_TO","via":"source_security_group_id"},{"from":"module.dependencies.aws_security_group_rule.mq","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","type":"DEPENDS_ON","via":"count"},{"from":"module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_resource_policy.this","to":"module.dependencies.module.catalog_opensearch.data.aws_iam_policy_document.cloudwatch","type":"DEPENDS_ON","via":"policy_document"},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","to":"module.dependencies.aws_security_group.catalog_opensearch_sg","type":"DEPENDS_ON","via":"vpc_options","fanout":2},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","to":"module.dependencies.module.catalog_opensearch.aws_security_group.this","type":"ATTACHED_TO","via":"vpc_options.security_group_ids"},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","to":"module.dependencies.random_string.catalog_opensearch_master","type":"DEPENDS_ON","via":"advanced_security_options"},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPENDS_ON","via":"vpc_options","fanout":2},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this","to":"module.dependencies.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"access_policies","fanout":2},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this","to":"module.dependencies.data.aws_region.current","type":"DEPENDS_ON","via":"access_policies","fanout":2},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this","to":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","type":"DEPENDS_ON","via":"domain_name"},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain_saml_options.this","to":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","type":"DEPENDS_ON","via":"domain_name"},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_outbound_connection.this","to":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","type":"DEPENDS_ON","via":"local_domain_info.domain_name"},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_outbound_connection.this","to":"module.dependencies.module.catalog_opensearch.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"local_domain_info.owner_id"},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_outbound_connection.this","to":"module.dependencies.module.catalog_opensearch.data.aws_region.current","type":"DEPENDS_ON","via":"local_domain_info.region"},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_package_association.this","to":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","type":"DEPENDS_ON","via":"domain_name"},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_vpc_endpoint.this","to":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","type":"DEPENDS_ON","via":"domain_arn"},{"from":"module.dependencies.module.catalog_opensearch.aws_security_group.this","to":"module.dependencies.aws_security_group.catalog_opensearch_sg","type":"DEPENDS_ON","via":"count","fanout":2},{"from":"module.dependencies.module.catalog_opensearch.aws_security_group.this","to":"module.dependencies.module.catalog_opensearch.data.aws_subnet.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.dependencies.module.catalog_opensearch.aws_security_group.this","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPENDS_ON","via":"count","fanout":2},{"from":"module.dependencies.module.catalog_opensearch.aws_vpc_security_group_egress_rule.this","to":"module.dependencies.aws_security_group.catalog_opensearch_sg","type":"DEPENDS_ON","via":"for_each","fanout":2},{"from":"module.dependencies.module.catalog_opensearch.aws_vpc_security_group_egress_rule.this","to":"module.dependencies.module.catalog_opensearch.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id"},{"from":"module.dependencies.module.catalog_opensearch.aws_vpc_security_group_egress_rule.this","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPENDS_ON","via":"for_each","fanout":2},{"from":"module.dependencies.module.catalog_opensearch.aws_vpc_security_group_ingress_rule.this","to":"module.dependencies.aws_security_group.catalog_opensearch_sg","type":"DEPENDS_ON","via":"for_each","fanout":2},{"from":"module.dependencies.module.catalog_opensearch.aws_vpc_security_group_ingress_rule.this","to":"module.dependencies.module.catalog_opensearch.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id"},{"from":"module.dependencies.module.catalog_opensearch.aws_vpc_security_group_ingress_rule.this","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPENDS_ON","via":"for_each","fanout":2},{"from":"module.dependencies.module.catalog_opensearch.data.aws_iam_policy_document.cloudwatch","to":"module.dependencies.module.catalog_opensearch.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"statement.condition.values"},{"from":"module.dependencies.module.catalog_opensearch.data.aws_iam_policy_document.cloudwatch","to":"module.dependencies.module.catalog_opensearch.data.aws_partition.current","type":"DEPENDS_ON","via":"statement.resources"},{"from":"module.dependencies.module.catalog_opensearch.data.aws_iam_policy_document.cloudwatch","to":"module.dependencies.module.catalog_opensearch.data.aws_region.current","type":"DEPENDS_ON","via":"statement.condition.values","fanout":3},{"from":"module.dependencies.module.catalog_opensearch.data.aws_iam_session_context.current","to":"module.dependencies.module.catalog_opensearch.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"arn"},{"from":"module.dependencies.module.catalog_opensearch.data.aws_subnet.this","to":"module.dependencies.aws_security_group.catalog_opensearch_sg","type":"DEPENDS_ON","via":"id","fanout":2},{"from":"module.dependencies.module.catalog_opensearch.data.aws_subnet.this","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPENDS_ON","via":"id","fanout":2},{"from":"module.dependencies.module.catalog_rds.aws_appautoscaling_policy.this","to":"module.dependencies.module.catalog_rds.aws_appautoscaling_target.this","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"module.dependencies.module.catalog_rds.aws_appautoscaling_policy.this","to":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","type":"DEPENDS_ON","via":"resource_id"},{"from":"module.dependencies.module.catalog_rds.aws_appautoscaling_target.this","to":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","type":"DEPENDS_ON","via":"resource_id"},{"from":"module.dependencies.module.catalog_rds.aws_db_subnet_group.this","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPLOYED_IN","via":"subnet_ids"},{"from":"module.dependencies.module.catalog_rds.aws_iam_role.rds_enhanced_monitoring","to":"module.dependencies.module.catalog_rds.data.aws_iam_policy_document.monitoring_rds_assume_role","type":"DEPENDS_ON","via":"assume_role_policy"},{"from":"module.dependencies.module.catalog_rds.aws_iam_role_policy_attachment.rds_enhanced_monitoring","to":"module.dependencies.module.catalog_rds.aws_iam_role.rds_enhanced_monitoring","type":"ASSUMES_ROLE","via":"role"},{"from":"module.dependencies.module.catalog_rds.aws_iam_role_policy_attachment.rds_enhanced_monitoring","to":"module.dependencies.module.catalog_rds.data.aws_partition.current","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","to":"module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","to":"module.dependencies.module.catalog_rds.aws_db_subnet_group.this","type":"DEPLOYED_IN","via":"db_subnet_group_name"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","to":"module.dependencies.module.catalog_rds.aws_rds_cluster_parameter_group.this","type":"DEPENDS_ON","via":"db_cluster_parameter_group_name"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","to":"module.dependencies.module.catalog_rds.aws_security_group.this","type":"ATTACHED_TO","via":"vpc_security_group_ids"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","to":"module.dependencies.random_string.catalog_db_master","type":"DEPENDS_ON","via":"master_password"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster_endpoint.this","to":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","type":"DEPENDS_ON","via":"cluster_identifier"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster_endpoint.this","to":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","to":"module.dependencies.module.catalog_rds.aws_db_parameter_group.this","type":"DEPENDS_ON","via":"db_parameter_group_name"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","to":"module.dependencies.module.catalog_rds.aws_db_subnet_group.this","type":"DEPLOYED_IN","via":"db_subnet_group_name"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","to":"module.dependencies.module.catalog_rds.aws_iam_role.rds_enhanced_monitoring","type":"ASSUMES_ROLE","via":"monitoring_role_arn"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","to":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","type":"DEPENDS_ON","via":"cluster_identifier"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster_role_association.this","to":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","type":"DEPENDS_ON","via":"db_cluster_identifier"},{"from":"module.dependencies.module.catalog_rds.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.dependencies.module.catalog_rds.aws_security_group_rule.cidr_ingress","to":"module.dependencies.module.catalog_rds.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id"},{"from":"module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress","to":"module.dependencies.module.catalog_rds.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id"},{"from":"module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","type":"ATTACHED_TO","via":"source_security_group_id"},{"from":"module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","type":"DEPENDS_ON","via":"count"},{"from":"module.dependencies.module.catalog_rds.aws_security_group_rule.egress","to":"module.dependencies.module.catalog_rds.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id"},{"from":"module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu","to":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","type":"DEPENDS_ON","via":"alarm_name"},{"from":"module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory","to":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","type":"DEPENDS_ON","via":"alarm_name"},{"from":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","to":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_parameter_group.default","type":"DEPENDS_ON","via":"parameter_group_name"},{"from":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","to":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_subnet_group.default","type":"DEPLOYED_IN","via":"subnet_group_name"},{"from":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","to":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","type":"ATTACHED_TO","via":"security_group_ids"},{"from":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_subnet_group.default","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPENDS_ON","via":"count"},{"from":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_subnet_group.default","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPLOYED_IN","via":"subnet_ids"},{"from":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","to":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","type":"ATTACHED_TO","via":"security_group_id"},{"from":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","to":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","to":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","to":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","type":"DEPENDS_ON","via":"for_each"},{"from":"module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default","to":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","type":"DEPENDS_ON","via":"records"},{"from":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_policy.index_read_policy","to":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.index_read","type":"DEPENDS_ON","via":"name"},{"from":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_policy.index_write_policy","to":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.index_write","type":"DEPENDS_ON","via":"name"},{"from":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_policy.table_read_policy","to":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.table_read","type":"DEPENDS_ON","via":"name"},{"from":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_policy.table_write_policy","to":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.table_write","type":"DEPENDS_ON","via":"name"},{"from":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.index_read","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","type":"DEPENDS_ON","via":"resource_id"},{"from":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.index_read","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","type":"DEPENDS_ON","via":"resource_id"},{"from":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.index_write","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","type":"DEPENDS_ON","via":"resource_id"},{"from":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.index_write","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","type":"DEPENDS_ON","via":"resource_id"},{"from":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.table_read","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","type":"DEPENDS_ON","via":"resource_id"},{"from":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.table_read","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","type":"DEPENDS_ON","via":"resource_id"},{"from":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.table_write","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","type":"DEPENDS_ON","via":"resource_id"},{"from":"module.dependencies.module.dynamodb_carts.aws_appautoscaling_target.table_write","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","type":"DEPENDS_ON","via":"resource_id"},{"from":"module.dependencies.module.orders_rds.aws_appautoscaling_policy.this","to":"module.dependencies.module.orders_rds.aws_appautoscaling_target.this","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"module.dependencies.module.orders_rds.aws_appautoscaling_policy.this","to":"module.dependencies.module.orders_rds.aws_rds_cluster.this","type":"DEPENDS_ON","via":"resource_id"},{"from":"module.dependencies.module.orders_rds.aws_appautoscaling_target.this","to":"module.dependencies.module.orders_rds.aws_rds_cluster.this","type":"DEPENDS_ON","via":"resource_id"},{"from":"module.dependencies.module.orders_rds.aws_db_subnet_group.this","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPLOYED_IN","via":"subnet_ids"},{"from":"module.dependencies.module.orders_rds.aws_iam_role.rds_enhanced_monitoring","to":"module.dependencies.module.orders_rds.data.aws_iam_policy_document.monitoring_rds_assume_role","type":"DEPENDS_ON","via":"assume_role_policy"},{"from":"module.dependencies.module.orders_rds.aws_iam_role_policy_attachment.rds_enhanced_monitoring","to":"module.dependencies.module.orders_rds.aws_iam_role.rds_enhanced_monitoring","type":"ASSUMES_ROLE","via":"role"},{"from":"module.dependencies.module.orders_rds.aws_iam_role_policy_attachment.rds_enhanced_monitoring","to":"module.dependencies.module.orders_rds.data.aws_partition.current","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster.this","to":"module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster.this","to":"module.dependencies.module.orders_rds.aws_db_subnet_group.this","type":"DEPLOYED_IN","via":"db_subnet_group_name"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster.this","to":"module.dependencies.module.orders_rds.aws_rds_cluster_parameter_group.this","type":"DEPENDS_ON","via":"db_cluster_parameter_group_name"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster.this","to":"module.dependencies.module.orders_rds.aws_security_group.this","type":"ATTACHED_TO","via":"vpc_security_group_ids"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster.this","to":"module.dependencies.random_string.orders_db_master","type":"DEPENDS_ON","via":"master_password"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster_endpoint.this","to":"module.dependencies.module.orders_rds.aws_rds_cluster.this","type":"DEPENDS_ON","via":"cluster_identifier"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster_endpoint.this","to":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","to":"module.dependencies.module.orders_rds.aws_db_parameter_group.this","type":"DEPENDS_ON","via":"db_parameter_group_name"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","to":"module.dependencies.module.orders_rds.aws_db_subnet_group.this","type":"DEPLOYED_IN","via":"db_subnet_group_name"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","to":"module.dependencies.module.orders_rds.aws_iam_role.rds_enhanced_monitoring","type":"ASSUMES_ROLE","via":"monitoring_role_arn"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","to":"module.dependencies.module.orders_rds.aws_rds_cluster.this","type":"DEPENDS_ON","via":"cluster_identifier"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster_role_association.this","to":"module.dependencies.module.orders_rds.aws_rds_cluster.this","type":"DEPENDS_ON","via":"db_cluster_identifier"},{"from":"module.dependencies.module.orders_rds.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.dependencies.module.orders_rds.aws_security_group_rule.cidr_ingress","to":"module.dependencies.module.orders_rds.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id"},{"from":"module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress","to":"module.dependencies.module.orders_rds.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id"},{"from":"module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","type":"ATTACHED_TO","via":"source_security_group_id"},{"from":"module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","type":"DEPENDS_ON","via":"count"},{"from":"module.dependencies.module.orders_rds.aws_security_group_rule.egress","to":"module.dependencies.module.orders_rds.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id"},{"from":"module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events","to":"module.retail_app_ecs.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"event_pattern"},{"from":"module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events","to":"module.retail_app_ecs.data.aws_region.current","type":"DEPENDS_ON","via":"event_pattern"},{"from":"module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events","to":"module.retail_app_ecs.random_id.eventbridge_suffix","type":"DEPENDS_ON","via":"name"},{"from":"module.retail_app_ecs.aws_cloudwatch_event_target.ecs_events_target","to":"module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events","type":"DEPENDS_ON","via":"rule"},{"from":"module.retail_app_ecs.aws_cloudwatch_event_target.ecs_events_target","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights","type":"DEPENDS_ON","via":"arn"},{"from":"module.retail_app_ecs.aws_cloudwatch_event_target.ecs_events_target","to":"module.retail_app_ecs.random_id.eventbridge_suffix","type":"ROUTES_TO","via":"target_id"},{"from":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights","to":"module.retail_app_ecs.random_id.eventbridge_suffix","type":"DEPENDS_ON","via":"tags"},{"from":"module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights","type":"DEPENDS_ON","via":"policy_document"},{"from":"module.retail_app_ecs.aws_iam_policy.catalog_policy","to":"module.retail_app_ecs.data.aws_iam_policy_document.catalog_db_secret","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.aws_iam_policy.orders_policy","to":"module.retail_app_ecs.data.aws_iam_policy_document.orders_db_secret","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","to":"module.retail_app_ecs.aws_kms_key.cmk","type":"USES_KEY","via":"kms_key_id"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","to":"module.retail_app_ecs.random_string.random_catalog_secret","type":"DEPENDS_ON","via":"name"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","to":"module.retail_app_ecs.aws_kms_key.cmk","type":"USES_KEY","via":"kms_key_id"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","to":"module.retail_app_ecs.random_string.random_catalog_secret","type":"DEPENDS_ON","via":"name"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret.mq","to":"module.retail_app_ecs.random_string.random_mq_secret","type":"DEPENDS_ON","via":"name"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","to":"module.retail_app_ecs.random_string.random_orders_secret","type":"DEPENDS_ON","via":"name"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db","to":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","type":"DEPENDS_ON","via":"secret_string"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db","to":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","type":"DEPENDS_ON","via":"secret_id"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch","to":"module.dependencies.random_string.catalog_opensearch_master","type":"DEPENDS_ON","via":"secret_string"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch","to":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","type":"DEPENDS_ON","via":"secret_id"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret_version.mq","to":"module.dependencies.aws_mq_broker.mq","type":"DEPENDS_ON","via":"secret_string"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret_version.mq","to":"module.dependencies.random_password.mq_password","type":"DEPENDS_ON","via":"secret_string"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret_version.mq","to":"module.retail_app_ecs.aws_secretsmanager_secret.mq","type":"DEPENDS_ON","via":"secret_id"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db","to":"module.dependencies.module.orders_rds.aws_rds_cluster.this","type":"DEPENDS_ON","via":"secret_string"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db","to":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","type":"DEPENDS_ON","via":"secret_id"},{"from":"module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPENDS_ON","via":"vpc"},{"from":"module.retail_app_ecs.data.aws_iam_policy_document.catalog_db_secret","to":"module.retail_app_ecs.aws_kms_key.cmk","type":"DEPENDS_ON","via":"statement.resources"},{"from":"module.retail_app_ecs.data.aws_iam_policy_document.catalog_db_secret","to":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","type":"DEPENDS_ON","via":"statement.resources"},{"from":"module.retail_app_ecs.data.aws_iam_policy_document.catalog_db_secret","to":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","type":"DEPENDS_ON","via":"statement.resources"},{"from":"module.retail_app_ecs.data.aws_iam_policy_document.orders_db_secret","to":"module.retail_app_ecs.aws_kms_key.cmk","type":"DEPENDS_ON","via":"statement.resources"},{"from":"module.retail_app_ecs.data.aws_iam_policy_document.orders_db_secret","to":"module.retail_app_ecs.aws_secretsmanager_secret.mq","type":"DEPENDS_ON","via":"statement.resources"},{"from":"module.retail_app_ecs.data.aws_iam_policy_document.orders_db_secret","to":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","type":"DEPENDS_ON","via":"statement.resources"},{"from":"module.retail_app_ecs.module.alb.aws_lambda_permission.lb","to":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","type":"DEPENDS_ON","via":"source_arn"},{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.retail_app_ecs.module.alb.aws_security_group.this","type":"ATTACHED_TO","via":"security_groups"},{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_groups","fanout":2},{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_groups","fanout":2},{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.vpc.module.vpc.aws_subnet.public","type":"DEPLOYED_IN","via":"subnets"},{"from":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp","to":"module.retail_app_ecs.module.alb.aws_lb.this","type":"ROUTES_TO","via":"load_balancer_arn"},{"from":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp","to":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","type":"DEPENDS_ON","via":"default_action.forward.target_group.arn"},{"from":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp","to":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","type":"ROUTES_TO","via":"default_action.target_group_arn"},{"from":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_https","to":"module.retail_app_ecs.module.alb.aws_lb.this","type":"ROUTES_TO","via":"load_balancer_arn"},{"from":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_https","to":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","type":"ROUTES_TO","via":"default_action.target_group_arn"},{"from":"module.retail_app_ecs.module.alb.aws_lb_listener_certificate.https_listener","to":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_https","type":"DEPENDS_ON","via":"listener_arn"},{"from":"module.retail_app_ecs.module.alb.aws_lb_listener_rule.http_tcp_listener_rule","to":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp","type":"DEPENDS_ON","via":"listener_arn"},{"from":"module.retail_app_ecs.module.alb.aws_lb_listener_rule.http_tcp_listener_rule","to":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","type":"DEPENDS_ON","via":"action.forward.target_group.arn"},{"from":"module.retail_app_ecs.module.alb.aws_lb_listener_rule.http_tcp_listener_rule","to":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","type":"ROUTES_TO","via":"action.target_group_arn"},{"from":"module.retail_app_ecs.module.alb.aws_lb_listener_rule.https_listener_rule","to":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_https","type":"DEPENDS_ON","via":"listener_arn"},{"from":"module.retail_app_ecs.module.alb.aws_lb_listener_rule.https_listener_rule","to":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","type":"DEPENDS_ON","via":"action.forward.target_group.arn"},{"from":"module.retail_app_ecs.module.alb.aws_lb_listener_rule.https_listener_rule","to":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","type":"ROUTES_TO","via":"action.target_group_arn"},{"from":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.retail_app_ecs.module.alb.aws_lb_target_group_attachment.this","to":"module.retail_app_ecs.module.alb.aws_lambda_permission.lb","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"module.retail_app_ecs.module.alb.aws_lb_target_group_attachment.this","to":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","type":"ROUTES_TO","via":"target_group_arn"},{"from":"module.retail_app_ecs.module.alb.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.retail_app_ecs.module.alb.aws_security_group_rule.this","to":"module.retail_app_ecs.module.alb.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id"},{"from":"module.retail_app_ecs.module.alb.aws_wafv2_web_acl_association.this","to":"module.retail_app_ecs.module.alb.aws_lb.this","type":"DEPENDS_ON","via":"resource_arn"},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_rules","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_rules","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_with_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_with_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_with_ipv6_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_with_ipv6_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_with_self","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_with_self","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_with_source_security_group_id","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_egress_with_source_security_group_id","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_rules","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_rules","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_with_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_with_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_with_ipv6_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_with_ipv6_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_with_self","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_with_self","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_with_source_security_group_id","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.computed_ingress_with_source_security_group_id","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_with_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_with_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_with_ipv6_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_with_ipv6_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_with_self","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_with_self","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_with_source_security_group_id","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_with_source_security_group_id","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_with_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_with_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_with_ipv6_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_with_ipv6_cidr_blocks","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_with_self","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_with_self","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_with_source_security_group_id","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_with_source_security_group_id","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"ATTACHED_TO","via":"security_group_id","fanout":2},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster","type":"DEPENDS_ON","via":"cluster"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this","type":"DEPENDS_ON","via":"service_connect_configuration.namespace"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","type":"DEPENDS_ON","via":"task_definition"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.carts_service.aws_security_group.this","type":"ATTACHED_TO","via":"network_configuration.security_groups"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPLOYED_IN","via":"network_configuration.subnets"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","type":"DEPENDS_ON","via":"container_definitions","fanout":5},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","type":"DEPENDS_ON","via":"container_definitions","fanout":5},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","type":"DEPENDS_ON","via":"container_definitions","fanout":5},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"container_definitions","fanout":5},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"execution_role_arn"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"task_role_arn"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.carts_service.data.aws_region.current","type":"DEPENDS_ON","via":"container_definitions","fanout":5},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.module.carts_service.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.module.carts_service.data.aws_region.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.module.carts_service.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.module.carts_service.data.aws_region.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.module.carts_service.data.aws_iam_policy_document.assume_role_policy","type":"DEPENDS_ON","via":"assume_role_policy"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","to":"module.retail_app_ecs.module.carts_service.data.aws_iam_policy_document.assume_role_policy","type":"DEPENDS_ON","via":"assume_role_policy"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_agent","to":"module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_agent","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_agent","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_logs","to":"module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_logs","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_logs","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.ecs_exec","to":"module.retail_app_ecs.module.carts_service.aws_iam_policy.ecs_exec","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.ecs_exec","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_execution_role_additional","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_execution_role_policy","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_role_additional","to":"module.dependencies.aws_iam_policy.carts_dynamo","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_role_additional","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.carts_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster","type":"DEPENDS_ON","via":"cluster"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this","type":"DEPENDS_ON","via":"service_connect_configuration.namespace"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","type":"DEPENDS_ON","via":"task_definition"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","type":"ATTACHED_TO","via":"network_configuration.security_groups"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPLOYED_IN","via":"network_configuration.subnets"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","to":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","type":"DEPENDS_ON","via":"container_definitions","fanout":5},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"container_definitions","fanout":5},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db","type":"DEPENDS_ON","via":"container_definitions","fanout":5},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch","type":"DEPENDS_ON","via":"container_definitions","fanout":5},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"execution_role_arn"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"task_role_arn"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.catalog_service.data.aws_region.current","type":"DEPENDS_ON","via":"container_definitions","fanout":5},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.module.catalog_service.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.module.catalog_service.data.aws_region.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.module.catalog_service.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.module.catalog_service.data.aws_region.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.module.catalog_service.data.aws_iam_policy_document.assume_role_policy","type":"DEPENDS_ON","via":"assume_role_policy"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","to":"module.retail_app_ecs.module.catalog_service.data.aws_iam_policy_document.assume_role_policy","type":"DEPENDS_ON","via":"assume_role_policy"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_agent","to":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_agent","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_agent","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_logs","to":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_logs","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_logs","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.ecs_exec","to":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.ecs_exec","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.ecs_exec","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_additional","to":"module.retail_app_ecs.aws_iam_policy.catalog_policy","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_additional","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_policy","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_role_additional","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster","type":"DEPENDS_ON","via":"cluster"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this","type":"DEPENDS_ON","via":"service_connect_configuration.namespace"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","type":"DEPENDS_ON","via":"task_definition"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","type":"ATTACHED_TO","via":"network_configuration.security_groups"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPLOYED_IN","via":"network_configuration.subnets"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","to":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","type":"DEPENDS_ON","via":"container_definitions","fanout":4},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"container_definitions","fanout":4},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"execution_role_arn"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"task_role_arn"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.checkout_service.data.aws_region.current","type":"DEPENDS_ON","via":"container_definitions","fanout":4},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","type":"DEPENDS_ON","via":"container_definitions","fanout":4},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.module.checkout_service.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.module.checkout_service.data.aws_region.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.module.checkout_service.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.module.checkout_service.data.aws_region.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.module.checkout_service.data.aws_iam_policy_document.assume_role_policy","type":"DEPENDS_ON","via":"assume_role_policy"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","to":"module.retail_app_ecs.module.checkout_service.data.aws_iam_policy_document.assume_role_policy","type":"DEPENDS_ON","via":"assume_role_policy"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_agent","to":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_agent","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_agent","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_logs","to":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_logs","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_logs","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.ecs_exec","to":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.ecs_exec","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.ecs_exec","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_execution_role_additional","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_execution_role_policy","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_role_additional","to":"module.dependencies.aws_iam_policy.carts_dynamo","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_role_additional","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster","type":"DEPENDS_ON","via":"cluster"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this","type":"DEPENDS_ON","via":"service_connect_configuration.namespace"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","type":"DEPENDS_ON","via":"task_definition"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","type":"ATTACHED_TO","via":"network_configuration.security_groups"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPLOYED_IN","via":"network_configuration.subnets"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"container_definitions","fanout":4},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.aws_secretsmanager_secret_version.mq","type":"DEPENDS_ON","via":"container_definitions","fanout":4},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db","type":"DEPENDS_ON","via":"container_definitions","fanout":4},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"execution_role_arn"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"task_role_arn"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.orders_service.data.aws_region.current","type":"DEPENDS_ON","via":"container_definitions","fanout":4},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.module.orders_service.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.module.orders_service.data.aws_region.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.module.orders_service.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.module.orders_service.data.aws_region.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.module.orders_service.data.aws_iam_policy_document.assume_role_policy","type":"DEPENDS_ON","via":"assume_role_policy"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","to":"module.retail_app_ecs.module.orders_service.data.aws_iam_policy_document.assume_role_policy","type":"DEPENDS_ON","via":"assume_role_policy"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_agent","to":"module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_agent","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_agent","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_logs","to":"module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_logs","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_logs","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.ecs_exec","to":"module.retail_app_ecs.module.orders_service.aws_iam_policy.ecs_exec","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.ecs_exec","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_additional","to":"module.retail_app_ecs.aws_iam_policy.orders_policy","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_additional","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_policy","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_role_additional","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.orders_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster","type":"DEPENDS_ON","via":"cluster"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this","type":"DEPENDS_ON","via":"service_connect_configuration.namespace"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","type":"DEPENDS_ON","via":"load_balancer"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","type":"ROUTES_TO","via":"load_balancer.target_group_arn"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","type":"DEPENDS_ON","via":"task_definition"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.ui_service.aws_security_group.this","type":"ATTACHED_TO","via":"network_configuration.security_groups"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPLOYED_IN","via":"network_configuration.subnets"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"container_definitions","fanout":6},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","type":"DEPENDS_ON","via":"container_definitions","fanout":6},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","type":"DEPENDS_ON","via":"container_definitions","fanout":6},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","type":"DEPENDS_ON","via":"container_definitions","fanout":6},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","type":"DEPENDS_ON","via":"container_definitions","fanout":6},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"execution_role_arn"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"task_role_arn"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.ui_service.data.aws_region.current","type":"DEPENDS_ON","via":"container_definitions","fanout":6},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.module.ui_service.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_agent","to":"module.retail_app_ecs.module.ui_service.data.aws_region.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.module.ui_service.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_logs","to":"module.retail_app_ecs.module.ui_service.data.aws_region.current","type":"DEPENDS_ON","via":"policy"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.module.ui_service.data.aws_iam_policy_document.assume_role_policy","type":"DEPENDS_ON","via":"assume_role_policy"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","to":"module.retail_app_ecs.module.ui_service.data.aws_iam_policy_document.assume_role_policy","type":"DEPENDS_ON","via":"assume_role_policy"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_agent","to":"module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_agent","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_agent","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_logs","to":"module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_logs","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_logs","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.ecs_exec","to":"module.retail_app_ecs.module.ui_service.aws_iam_policy.ecs_exec","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.ecs_exec","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.task_execution_role_additional","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.task_execution_role_policy","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.task_role_additional","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","type":"ASSUMES_ROLE","via":"role"},{"from":"module.retail_app_ecs.module.ui_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPENDS_ON","via":"name","fanout":2},{"from":"module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPENDS_ON","via":"name","fanout":2},{"from":"module.vpc.module.vpc.aws_db_subnet_group.database","to":"module.vpc.module.vpc.aws_subnet.database","type":"DEPLOYED_IN","via":"subnet_ids"},{"from":"module.vpc.module.vpc.aws_default_network_acl.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPENDS_ON","via":"default_network_acl_id"},{"from":"module.vpc.module.vpc.aws_default_route_table.default","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPENDS_ON","via":"default_route_table_id"},{"from":"module.vpc.module.vpc.aws_default_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.vpc.module.vpc.aws_egress_only_internet_gateway.this","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_egress_only_internet_gateway.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_egress_only_internet_gateway.this","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_eip.nat","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"tags"},{"from":"module.vpc.module.vpc.aws_eip.nat","to":"module.vpc.module.vpc.aws_internet_gateway.this","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"module.vpc.module.vpc.aws_elasticache_subnet_group.elasticache","to":"module.vpc.module.vpc.aws_subnet.elasticache","type":"DEPLOYED_IN","via":"subnet_ids"},{"from":"module.vpc.module.vpc.aws_flow_log.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_flow_log.this","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_iam_policy.vpc_flow_log_cloudwatch","to":"module.vpc.module.vpc.data.aws_iam_policy_document.vpc_flow_log_cloudwatch","type":"DEPENDS_ON","via":"policy"},{"from":"module.vpc.module.vpc.aws_iam_role.vpc_flow_log_cloudwatch","to":"module.vpc.module.vpc.data.aws_iam_policy_document.flow_log_cloudwatch_assume_role","type":"DEPENDS_ON","via":"assume_role_policy"},{"from":"module.vpc.module.vpc.aws_iam_role_policy_attachment.vpc_flow_log_cloudwatch","to":"module.vpc.module.vpc.aws_iam_policy.vpc_flow_log_cloudwatch","type":"DEPENDS_ON","via":"policy_arn"},{"from":"module.vpc.module.vpc.aws_iam_role_policy_attachment.vpc_flow_log_cloudwatch","to":"module.vpc.module.vpc.aws_iam_role.vpc_flow_log_cloudwatch","type":"ASSUMES_ROLE","via":"role"},{"from":"module.vpc.module.vpc.aws_internet_gateway.this","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_internet_gateway.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_internet_gateway.this","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"tags"},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.module.vpc.aws_eip.nat","type":"DEPENDS_ON","via":"allocation_id"},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.module.vpc.aws_internet_gateway.this","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.module.vpc.aws_subnet.public","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_network_acl.database","to":"module.vpc.module.vpc.aws_subnet.database","type":"DEPLOYED_IN","via":"subnet_ids"},{"from":"module.vpc.module.vpc.aws_network_acl.database","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_network_acl.database","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_network_acl.elasticache","to":"module.vpc.module.vpc.aws_subnet.elasticache","type":"DEPLOYED_IN","via":"subnet_ids"},{"from":"module.vpc.module.vpc.aws_network_acl.elasticache","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_network_acl.elasticache","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_network_acl.intra","to":"module.vpc.module.vpc.aws_subnet.intra","type":"DEPLOYED_IN","via":"subnet_ids"},{"from":"module.vpc.module.vpc.aws_network_acl.intra","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_network_acl.intra","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_network_acl.outpost","to":"module.vpc.module.vpc.aws_subnet.outpost","type":"DEPLOYED_IN","via":"subnet_ids"},{"from":"module.vpc.module.vpc.aws_network_acl.outpost","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_network_acl.outpost","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_network_acl.private","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_network_acl.private","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPLOYED_IN","via":"subnet_ids"},{"from":"module.vpc.module.vpc.aws_network_acl.private","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_network_acl.private","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_network_acl.public","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_network_acl.public","to":"module.vpc.module.vpc.aws_subnet.public","type":"DEPLOYED_IN","via":"subnet_ids"},{"from":"module.vpc.module.vpc.aws_network_acl.public","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_network_acl.public","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_network_acl.redshift","to":"module.vpc.module.vpc.aws_subnet.redshift","type":"DEPLOYED_IN","via":"subnet_ids"},{"from":"module.vpc.module.vpc.aws_network_acl.redshift","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_network_acl.redshift","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_network_acl_rule.database_inbound","to":"module.vpc.module.vpc.aws_network_acl.database","type":"DEPENDS_ON","via":"network_acl_id"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.database_outbound","to":"module.vpc.module.vpc.aws_network_acl.database","type":"DEPENDS_ON","via":"network_acl_id"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.elasticache_inbound","to":"module.vpc.module.vpc.aws_network_acl.elasticache","type":"DEPENDS_ON","via":"network_acl_id"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.elasticache_outbound","to":"module.vpc.module.vpc.aws_network_acl.elasticache","type":"DEPENDS_ON","via":"network_acl_id"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.intra_inbound","to":"module.vpc.module.vpc.aws_network_acl.intra","type":"DEPENDS_ON","via":"network_acl_id"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.intra_outbound","to":"module.vpc.module.vpc.aws_network_acl.intra","type":"DEPENDS_ON","via":"network_acl_id"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.outpost_inbound","to":"module.vpc.module.vpc.aws_network_acl.outpost","type":"DEPENDS_ON","via":"network_acl_id"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.outpost_outbound","to":"module.vpc.module.vpc.aws_network_acl.outpost","type":"DEPENDS_ON","via":"network_acl_id"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.private_inbound","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.private_inbound","to":"module.vpc.module.vpc.aws_network_acl.private","type":"DEPENDS_ON","via":"network_acl_id"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.private_outbound","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.private_outbound","to":"module.vpc.module.vpc.aws_network_acl.private","type":"DEPENDS_ON","via":"network_acl_id"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.public_inbound","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.public_inbound","to":"module.vpc.module.vpc.aws_network_acl.public","type":"DEPENDS_ON","via":"network_acl_id"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.public_outbound","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.public_outbound","to":"module.vpc.module.vpc.aws_network_acl.public","type":"DEPENDS_ON","via":"network_acl_id"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.redshift_inbound","to":"module.vpc.module.vpc.aws_network_acl.redshift","type":"DEPENDS_ON","via":"network_acl_id"},{"from":"module.vpc.module.vpc.aws_network_acl_rule.redshift_outbound","to":"module.vpc.module.vpc.aws_network_acl.redshift","type":"DEPENDS_ON","via":"network_acl_id"},{"from":"module.vpc.module.vpc.aws_redshift_subnet_group.redshift","to":"module.vpc.module.vpc.aws_subnet.redshift","type":"DEPLOYED_IN","via":"subnet_ids"},{"from":"module.vpc.module.vpc.aws_route.database_dns64_nat_gateway","to":"module.vpc.module.vpc.aws_nat_gateway.this","type":"DEPENDS_ON","via":"nat_gateway_id"},{"from":"module.vpc.module.vpc.aws_route.database_dns64_nat_gateway","to":"module.vpc.module.vpc.aws_route_table.database","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route.database_internet_gateway","to":"module.vpc.module.vpc.aws_internet_gateway.this","type":"DEPENDS_ON","via":"gateway_id"},{"from":"module.vpc.module.vpc.aws_route.database_internet_gateway","to":"module.vpc.module.vpc.aws_route_table.database","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route.database_ipv6_egress","to":"module.vpc.module.vpc.aws_egress_only_internet_gateway.this","type":"DEPENDS_ON","via":"egress_only_gateway_id"},{"from":"module.vpc.module.vpc.aws_route.database_ipv6_egress","to":"module.vpc.module.vpc.aws_route_table.database","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route.database_nat_gateway","to":"module.vpc.module.vpc.aws_nat_gateway.this","type":"DEPENDS_ON","via":"nat_gateway_id"},{"from":"module.vpc.module.vpc.aws_route.database_nat_gateway","to":"module.vpc.module.vpc.aws_route_table.database","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route.private_dns64_nat_gateway","to":"module.vpc.module.vpc.aws_nat_gateway.this","type":"DEPENDS_ON","via":"nat_gateway_id"},{"from":"module.vpc.module.vpc.aws_route.private_dns64_nat_gateway","to":"module.vpc.module.vpc.aws_route_table.private","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route.private_ipv6_egress","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_route.private_ipv6_egress","to":"module.vpc.module.vpc.aws_egress_only_internet_gateway.this","type":"DEPENDS_ON","via":"egress_only_gateway_id"},{"from":"module.vpc.module.vpc.aws_route.private_ipv6_egress","to":"module.vpc.module.vpc.aws_route_table.private","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route.private_nat_gateway","to":"module.vpc.module.vpc.aws_nat_gateway.this","type":"DEPENDS_ON","via":"nat_gateway_id"},{"from":"module.vpc.module.vpc.aws_route.private_nat_gateway","to":"module.vpc.module.vpc.aws_route_table.private","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route.public_internet_gateway","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_route.public_internet_gateway","to":"module.vpc.module.vpc.aws_internet_gateway.this","type":"DEPENDS_ON","via":"gateway_id"},{"from":"module.vpc.module.vpc.aws_route.public_internet_gateway","to":"module.vpc.module.vpc.aws_route_table.public","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route.public_internet_gateway_ipv6","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_route.public_internet_gateway_ipv6","to":"module.vpc.module.vpc.aws_internet_gateway.this","type":"DEPENDS_ON","via":"gateway_id"},{"from":"module.vpc.module.vpc.aws_route.public_internet_gateway_ipv6","to":"module.vpc.module.vpc.aws_route_table.public","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route_table.database","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_route_table.database","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_route_table.elasticache","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_route_table.elasticache","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_route_table.intra","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_route_table.intra","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_route_table.redshift","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_route_table.redshift","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_route_table_association.database","to":"module.vpc.module.vpc.aws_route_table.database","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.database","to":"module.vpc.module.vpc.aws_route_table.private","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.database","to":"module.vpc.module.vpc.aws_subnet.database","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.elasticache","to":"module.vpc.module.vpc.aws_route_table.elasticache","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.elasticache","to":"module.vpc.module.vpc.aws_route_table.private","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.elasticache","to":"module.vpc.module.vpc.aws_subnet.elasticache","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.intra","to":"module.vpc.module.vpc.aws_route_table.intra","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.intra","to":"module.vpc.module.vpc.aws_subnet.intra","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.outpost","to":"module.vpc.module.vpc.aws_route_table.private","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.outpost","to":"module.vpc.module.vpc.aws_subnet.outpost","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.private","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_route_table_association.private","to":"module.vpc.module.vpc.aws_route_table.private","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.private","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.public","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"count"},{"from":"module.vpc.module.vpc.aws_route_table_association.public","to":"module.vpc.module.vpc.aws_route_table.public","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.public","to":"module.vpc.module.vpc.aws_subnet.public","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.redshift","to":"module.vpc.module.vpc.aws_route_table.private","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.redshift","to":"module.vpc.module.vpc.aws_route_table.redshift","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.redshift","to":"module.vpc.module.vpc.aws_subnet.redshift","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.redshift_public","to":"module.vpc.module.vpc.aws_route_table.public","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.redshift_public","to":"module.vpc.module.vpc.aws_route_table.redshift","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_route_table_association.redshift_public","to":"module.vpc.module.vpc.aws_subnet.redshift","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_subnet.database","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"availability_zone_id"},{"from":"module.vpc.module.vpc.aws_subnet.database","to":"module.vpc.data.aws_availability_zones.available","type":"DEPLOYED_IN","via":"availability_zone"},{"from":"module.vpc.module.vpc.aws_subnet.database","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_subnet.database","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_subnet.elasticache","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"availability_zone_id"},{"from":"module.vpc.module.vpc.aws_subnet.elasticache","to":"module.vpc.data.aws_availability_zones.available","type":"DEPLOYED_IN","via":"availability_zone"},{"from":"module.vpc.module.vpc.aws_subnet.elasticache","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_subnet.elasticache","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_subnet.intra","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"availability_zone_id"},{"from":"module.vpc.module.vpc.aws_subnet.intra","to":"module.vpc.data.aws_availability_zones.available","type":"DEPLOYED_IN","via":"availability_zone"},{"from":"module.vpc.module.vpc.aws_subnet.intra","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_subnet.intra","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_subnet.outpost","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_subnet.outpost","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_subnet.private","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"availability_zone_id"},{"from":"module.vpc.module.vpc.aws_subnet.private","to":"module.vpc.data.aws_availability_zones.available","type":"DEPLOYED_IN","via":"availability_zone"},{"from":"module.vpc.module.vpc.aws_subnet.private","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_subnet.private","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_subnet.public","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"availability_zone_id"},{"from":"module.vpc.module.vpc.aws_subnet.public","to":"module.vpc.data.aws_availability_zones.available","type":"DEPLOYED_IN","via":"availability_zone"},{"from":"module.vpc.module.vpc.aws_subnet.public","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_subnet.public","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_subnet.redshift","to":"module.vpc.data.aws_availability_zones.available","type":"DEPENDS_ON","via":"availability_zone_id"},{"from":"module.vpc.module.vpc.aws_subnet.redshift","to":"module.vpc.data.aws_availability_zones.available","type":"DEPLOYED_IN","via":"availability_zone"},{"from":"module.vpc.module.vpc.aws_subnet.redshift","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_subnet.redshift","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","to":"module.vpc.module.vpc.aws_subnet.database","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","to":"module.vpc.module.vpc.aws_subnet.elasticache","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","to":"module.vpc.module.vpc.aws_subnet.intra","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","to":"module.vpc.module.vpc.aws_subnet.outpost","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","to":"module.vpc.module.vpc.aws_subnet.private","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","to":"module.vpc.module.vpc.aws_subnet.public","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","to":"module.vpc.module.vpc.aws_subnet.redshift","type":"DEPLOYED_IN","via":"subnet_id"},{"from":"module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_vpc_dhcp_options_association.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_vpc_dhcp_options_association.this","to":"module.vpc.module.vpc.aws_vpc_dhcp_options.this","type":"DEPENDS_ON","via":"dhcp_options_id"},{"from":"module.vpc.module.vpc.aws_vpc_dhcp_options_association.this","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id"},{"from":"module.vpc.module.vpc.aws_vpn_gateway.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_vpn_gateway.this","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_vpn_gateway_attachment.this","to":"module.vpc.module.vpc.aws_vpc.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_vpn_gateway_attachment.this","to":"module.vpc.module.vpc.aws_vpc_ipv4_cidr_block_association.this","type":"DEPLOYED_IN","via":"vpc_id","fanout":2},{"from":"module.vpc.module.vpc.aws_vpn_gateway_route_propagation.intra","to":"module.vpc.module.vpc.aws_route_table.intra","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_vpn_gateway_route_propagation.intra","to":"module.vpc.module.vpc.aws_vpn_gateway.this","type":"DEPENDS_ON","via":"vpn_gateway_id"},{"from":"module.vpc.module.vpc.aws_vpn_gateway_route_propagation.intra","to":"module.vpc.module.vpc.aws_vpn_gateway_attachment.this","type":"DEPENDS_ON","via":"vpn_gateway_id"},{"from":"module.vpc.module.vpc.aws_vpn_gateway_route_propagation.private","to":"module.vpc.module.vpc.aws_route_table.private","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_vpn_gateway_route_propagation.private","to":"module.vpc.module.vpc.aws_vpn_gateway.this","type":"DEPENDS_ON","via":"vpn_gateway_id"},{"from":"module.vpc.module.vpc.aws_vpn_gateway_route_propagation.private","to":"module.vpc.module.vpc.aws_vpn_gateway_attachment.this","type":"DEPENDS_ON","via":"vpn_gateway_id"},{"from":"module.vpc.module.vpc.aws_vpn_gateway_route_propagation.public","to":"module.vpc.module.vpc.aws_route_table.public","type":"DEPENDS_ON","via":"route_table_id"},{"from":"module.vpc.module.vpc.aws_vpn_gateway_route_propagation.public","to":"module.vpc.module.vpc.aws_vpn_gateway.this","type":"DEPENDS_ON","via":"vpn_gateway_id"},{"from":"module.vpc.module.vpc.aws_vpn_gateway_route_propagation.public","to":"module.vpc.module.vpc.aws_vpn_gateway_attachment.this","type":"DEPENDS_ON","via":"vpn_gateway_id"},{"from":"module.vpc.module.vpc.data.aws_iam_policy_document.vpc_flow_log_cloudwatch","to":"module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log","type":"DEPENDS_ON","via":"statement.resources","fanout":4},{"from":"module.vpc.module.vpc.data.aws_iam_policy_document.vpc_flow_log_cloudwatch","to":"module.vpc.module.vpc.data.aws_caller_identity.current","type":"DEPENDS_ON","via":"statement.resources","fanout":4},{"from":"module.vpc.module.vpc.data.aws_iam_policy_document.vpc_flow_log_cloudwatch","to":"module.vpc.module.vpc.data.aws_partition.current","type":"DEPENDS_ON","via":"statement.resources","fanout":4},{"from":"module.vpc.module.vpc.data.aws_iam_policy_document.vpc_flow_log_cloudwatch","to":"module.vpc.module.vpc.data.aws_region.current","type":"DEPENDS_ON","via":"statement.resources","fanout":4}],"diagnostics":[{"severity":"info","message":"unconsumed-lookup: module.dependencies.module.catalog_opensearch.data.aws_caller_identity.current (data source aws_caller_identity) is read by no enabled resource, provider block, output or check block of this scan, so no unit takes anything from it.","node_id":"module.dependencies.module.catalog_opensearch.data.aws_caller_identity.current","provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":7,"end_line":9}},{"severity":"info","message":"unconsumed-lookup: module.dependencies.module.catalog_opensearch.data.aws_iam_session_context.current (data source aws_iam_session_context) is read by no enabled resource, provider block, output or check block of this scan, so no unit takes anything from it.","node_id":"module.dependencies.module.catalog_opensearch.data.aws_iam_session_context.current","provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":10,"end_line":13}},{"severity":"info","message":"unconsumed-lookup: module.dependencies.module.catalog_opensearch.data.aws_partition.current (data source aws_partition) is read by no enabled resource, provider block, output or check block of this scan, so no unit takes anything from it.","node_id":"module.dependencies.module.catalog_opensearch.data.aws_partition.current","provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":4,"end_line":6}},{"severity":"info","message":"unconsumed-lookup: module.dependencies.module.catalog_opensearch.data.aws_region.current (data source aws_region) is read by no enabled resource, provider block, output or check block of this scan, so no unit takes anything from it.","node_id":"module.dependencies.module.catalog_opensearch.data.aws_region.current","provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/main.tf","line":1,"end_line":3}},{"severity":"info","message":"unconsumed-lookup: module.dependencies.module.catalog_rds.data.aws_iam_policy_document.monitoring_rds_assume_role (data source aws_iam_policy_document) is read by no enabled resource, provider block, output or check block of this scan, so no unit takes anything from it.","node_id":"module.dependencies.module.catalog_rds.data.aws_iam_policy_document.monitoring_rds_assume_role","provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":244,"end_line":253}},{"severity":"info","message":"unconsumed-lookup: module.dependencies.module.catalog_rds.data.aws_partition.current (data source aws_partition) is read by no enabled resource, provider block, output or check block of this scan, so no unit takes anything from it.","node_id":"module.dependencies.module.catalog_rds.data.aws_partition.current","provenance":{"file":".terraform/modules/dependencies.catalog_rds/main.tf","line":1,"end_line":1}},{"severity":"info","message":"unconsumed-lookup: module.dependencies.module.orders_rds.data.aws_iam_policy_document.monitoring_rds_assume_role (data source aws_iam_policy_document) is read by no enabled resource, provider block, output or check block of this scan, so no unit takes anything from it.","node_id":"module.dependencies.module.orders_rds.data.aws_iam_policy_document.monitoring_rds_assume_role","provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":244,"end_line":253}},{"severity":"info","message":"unconsumed-lookup: module.dependencies.module.orders_rds.data.aws_partition.current (data source aws_partition) is read by no enabled resource, provider block, output or check block of this scan, so no unit takes anything from it.","node_id":"module.dependencies.module.orders_rds.data.aws_partition.current","provenance":{"file":".terraform/modules/dependencies.orders_rds/main.tf","line":1,"end_line":1}},{"severity":"info","message":"unconsumed-lookup: module.retail_app_ecs.data.aws_caller_identity.current (data source aws_caller_identity) is read by no enabled resource, provider block, output or check block of this scan, so no unit takes anything from it.","node_id":"module.retail_app_ecs.data.aws_caller_identity.current","provenance":{"file":"../../lib/ecs/eventbridge.tf","line":1,"end_line":1}},{"severity":"info","message":"unconsumed-lookup: module.retail_app_ecs.data.aws_region.current (data source aws_region) is read by no enabled resource, provider block, output or check block of this scan, so no unit takes anything from it.","node_id":"module.retail_app_ecs.data.aws_region.current","provenance":{"file":"../../lib/ecs/eventbridge.tf","line":2,"end_line":2}}],"module_calls":[{"address":"module.dependencies","source":"../../lib/dependencies","source_kind":"local","dir":"../../lib/dependencies","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"main.tf","line":15,"end_line":27}},{"address":"module.dependencies.module.catalog_opensearch","parent":"module.dependencies","source":"terraform-aws-modules/opensearch/aws","source_kind":"registry","version_constraint":"1.5.0","version_resolved":"1.5.0","dir":".terraform/modules/dependencies.catalog_opensearch","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"../../lib/dependencies/catalog_opensearch.tf","line":34,"end_line":102}},{"address":"module.dependencies.module.catalog_rds","parent":"module.dependencies","source":"terraform-aws-modules/rds-aurora/aws","source_kind":"registry","version_constraint":"7.7.1","version_resolved":"7.7.1","dir":".terraform/modules/dependencies.catalog_rds","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"../../lib/dependencies/catalog_rds.tf","line":1,"end_line":36}},{"address":"module.dependencies.module.checkout_elasticache_redis","parent":"module.dependencies","source":"cloudposse/elasticache-redis/aws","source_kind":"registry","version_constraint":"0.53.0","version_resolved":"0.53.0","dir":".terraform/modules/dependencies.checkout_elasticache_redis","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"../../lib/dependencies/elasticache.tf","line":1,"end_line":13}},{"address":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","parent":"module.dependencies.module.checkout_elasticache_redis","source":"cloudposse/security-group/aws","source_kind":"registry","version_constraint":"1.0.1","version_resolved":"1.0.1","dir":".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf","line":33,"end_line":66}},{"address":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.module.this","parent":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","source":"cloudposse/label/null","source_kind":"registry","version_constraint":"0.25.0","version_resolved":"0.25.0","dir":".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group.this","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/context.tf","line":23,"end_line":46}},{"address":"module.dependencies.module.checkout_elasticache_redis.module.dns","parent":"module.dependencies.module.checkout_elasticache_redis","source":"cloudposse/route53-cluster-hostname/aws","source_kind":"registry","version_constraint":"0.12.2","version_resolved":"0.12.2","dir":".terraform/modules/dependencies.checkout_elasticache_redis.dns","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf","line":217,"end_line":228}},{"address":"module.dependencies.module.checkout_elasticache_redis.module.dns.module.this","parent":"module.dependencies.module.checkout_elasticache_redis.module.dns","source":"cloudposse/label/null","source_kind":"registry","version_constraint":"0.25.0","version_resolved":"0.25.0","dir":".terraform/modules/dependencies.checkout_elasticache_redis.dns.this","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis.dns/context.tf","line":23,"end_line":46}},{"address":"module.dependencies.module.checkout_elasticache_redis.module.this","parent":"module.dependencies.module.checkout_elasticache_redis","source":"cloudposse/label/null","source_kind":"registry","version_constraint":"0.25.0","version_resolved":"0.25.0","dir":".terraform/modules/dependencies.checkout_elasticache_redis.this","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis/context.tf","line":23,"end_line":46}},{"address":"module.dependencies.module.dynamodb_carts","parent":"module.dependencies","source":"terraform-aws-modules/dynamodb-table/aws","source_kind":"registry","version_constraint":"3.3.0","version_resolved":"3.3.0","dir":".terraform/modules/dependencies.dynamodb_carts","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"../../lib/dependencies/dynamodb.tf","line":1,"end_line":28}},{"address":"module.dependencies.module.orders_rds","parent":"module.dependencies","source":"terraform-aws-modules/rds-aurora/aws","source_kind":"registry","version_constraint":"7.7.1","version_resolved":"7.7.1","dir":".terraform/modules/dependencies.orders_rds","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"../../lib/dependencies/orders_rds.tf","line":1,"end_line":35}},{"address":"module.retail_app_ecs","source":"../../lib/ecs","source_kind":"local","dir":"../../lib/ecs","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"main.tf","line":29,"end_line":66}},{"address":"module.retail_app_ecs.module.alb","parent":"module.retail_app_ecs","source":"terraform-aws-modules/alb/aws","source_kind":"registry","version_constraint":"~\u003e 8.0","version_resolved":"8.7.0","dir":".terraform/modules/retail_app_ecs.alb","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"../../lib/ecs/alb.tf","line":16,"end_line":55}},{"address":"module.retail_app_ecs.module.alb_sg","parent":"module.retail_app_ecs","source":"terraform-aws-modules/security-group/aws","source_kind":"registry","version_constraint":"~\u003e 4.0","version_resolved":"4.17.2","dir":".terraform/modules/retail_app_ecs.alb_sg","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"../../lib/ecs/alb.tf","line":1,"end_line":14}},{"address":"module.retail_app_ecs.module.carts_service","parent":"module.retail_app_ecs","source":"./service","source_kind":"local","dir":"../../lib/ecs/service","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"../../lib/ecs/carts.tf","line":1,"end_line":24}},{"address":"module.retail_app_ecs.module.catalog_service","parent":"module.retail_app_ecs","source":"./service","source_kind":"local","dir":"../../lib/ecs/service","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"../../lib/ecs/catalog.tf","line":1,"end_line":34}},{"address":"module.retail_app_ecs.module.checkout_service","parent":"module.retail_app_ecs","source":"./service","source_kind":"local","dir":"../../lib/ecs/service","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"../../lib/ecs/checkout.tf","line":1,"end_line":24}},{"address":"module.retail_app_ecs.module.container_images","parent":"module.retail_app_ecs","source":"../images","source_kind":"local","dir":"../../lib/images","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"../../lib/ecs/main.tf","line":1,"end_line":5}},{"address":"module.retail_app_ecs.module.orders_service","parent":"module.retail_app_ecs","source":"./service","source_kind":"local","dir":"../../lib/ecs/service","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"../../lib/ecs/orders.tf","line":1,"end_line":36}},{"address":"module.retail_app_ecs.module.ui_service","parent":"module.retail_app_ecs","source":"./service","source_kind":"local","dir":"../../lib/ecs/service","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"../../lib/ecs/ui.tf","line":1,"end_line":25}},{"address":"module.tags","source":"../../lib/tags","source_kind":"local","dir":"../../lib/tags","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"main.tf","line":1,"end_line":5}},{"address":"module.vpc","source":"../../lib/vpc","source_kind":"local","dir":"../../lib/vpc","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"main.tf","line":7,"end_line":13}},{"address":"module.vpc.module.vpc","parent":"module.vpc","source":"terraform-aws-modules/vpc/aws","source_kind":"registry","version_constraint":"5.21.0","version_resolved":"5.21.0","dir":".terraform/modules/vpc.vpc","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"../../lib/vpc/vpc.tf","line":11,"end_line":39}}],"source_providers":[{"name":"aws","constraints":["\u003e= 3.0","\u003e= 3.29","\u003e= 4.18","\u003e= 4.30","\u003e= 4.59","\u003e= 5.64","\u003e= 5.79","~\u003e 5.0"],"tested":"5.100.0","status":"UNPINNED","note":"No lock file entry pins this provider, so the version a plan would use is not proven; the knowledge base was checked against one version only. Until the exact version is pinned (commit .terraform.lock.hcl), the units of this provider are capped at MEDIUM confidence and are not automation eligible.","identity":"DECLARED","identity_basis":"REQUIRED_PROVIDERS_SOURCE","identity_evidence":"PINNED_REGISTRY","version_provenance":"CONSTRAINT_ONLY","registry_address":"registry.terraform.io/hashicorp/aws","local_names":["aws"],"constraint_sources":[{"expr":"~\u003e 5.0","provenance":{"file":"versions.tf","line":5,"end_line":8}},{"expr":"~\u003e 5.0","module_path":"module.dependencies","provenance":{"file":"../../lib/dependencies/versions.tf","line":5,"end_line":8}},{"expr":"\u003e= 5.64","module_path":"module.dependencies.module.catalog_opensearch","provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/versions.tf","line":5,"end_line":8}},{"expr":"\u003e= 4.30","module_path":"module.dependencies.module.catalog_rds","provenance":{"file":".terraform/modules/dependencies.catalog_rds/versions.tf","line":5,"end_line":8}},{"expr":"\u003e= 4.18","module_path":"module.dependencies.module.checkout_elasticache_redis","provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis/versions.tf","line":5,"end_line":8}},{"expr":"\u003e= 3.0","module_path":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/versions.tf","line":5,"end_line":8}},{"expr":"\u003e= 3.0","module_path":"module.dependencies.module.checkout_elasticache_redis.module.dns","provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis.dns/versions.tf","line":5,"end_line":8}},{"expr":"\u003e= 4.59","module_path":"module.dependencies.module.dynamodb_carts","provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/versions.tf","line":5,"end_line":8}},{"expr":"\u003e= 4.30","module_path":"module.dependencies.module.orders_rds","provenance":{"file":".terraform/modules/dependencies.orders_rds/versions.tf","line":5,"end_line":8}},{"expr":"~\u003e 5.0","module_path":"module.retail_app_ecs","provenance":{"file":"../../lib/ecs/versions.tf","line":5,"end_line":8}},{"expr":"\u003e= 4.59","module_path":"module.retail_app_ecs.module.alb","provenance":{"file":".terraform/modules/retail_app_ecs.alb/versions.tf","line":5,"end_line":8}},{"expr":"\u003e= 3.29","module_path":"module.retail_app_ecs.module.alb_sg","provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/versions.tf","line":5,"end_line":8}},{"expr":"\u003e= 5.79","module_path":"module.vpc.module.vpc","provenance":{"file":".terraform/modules/vpc.vpc/versions.tf","line":5,"end_line":8}}],"declarations":[{"local_name":"aws","source":"hashicorp/aws","provenance":{"file":"versions.tf","line":5,"end_line":8}},{"module_path":"module.vpc.module.vpc","local_name":"aws","source":"hashicorp/aws","provenance":{"file":".terraform/modules/vpc.vpc/versions.tf","line":5,"end_line":8}},{"module_path":"module.dependencies","local_name":"aws","source":"hashicorp/aws","provenance":{"file":"../../lib/dependencies/versions.tf","line":5,"end_line":8}},{"module_path":"module.dependencies.module.catalog_opensearch","local_name":"aws","source":"hashicorp/aws","provenance":{"file":".terraform/modules/dependencies.catalog_opensearch/versions.tf","line":5,"end_line":8}},{"module_path":"module.dependencies.module.catalog_rds","local_name":"aws","source":"hashicorp/aws","provenance":{"file":".terraform/modules/dependencies.catalog_rds/versions.tf","line":5,"end_line":8}},{"module_path":"module.dependencies.module.dynamodb_carts","local_name":"aws","source":"hashicorp/aws","provenance":{"file":".terraform/modules/dependencies.dynamodb_carts/versions.tf","line":5,"end_line":8}},{"module_path":"module.dependencies.module.checkout_elasticache_redis","local_name":"aws","source":"hashicorp/aws","provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis/versions.tf","line":5,"end_line":8}},{"module_path":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","local_name":"aws","source":"hashicorp/aws","provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/versions.tf","line":5,"end_line":8}},{"module_path":"module.dependencies.module.checkout_elasticache_redis.module.dns","local_name":"aws","source":"hashicorp/aws","provenance":{"file":".terraform/modules/dependencies.checkout_elasticache_redis.dns/versions.tf","line":5,"end_line":8}},{"module_path":"module.dependencies.module.orders_rds","local_name":"aws","source":"hashicorp/aws","provenance":{"file":".terraform/modules/dependencies.orders_rds/versions.tf","line":5,"end_line":8}},{"module_path":"module.retail_app_ecs","local_name":"aws","source":"hashicorp/aws","provenance":{"file":"../../lib/ecs/versions.tf","line":5,"end_line":8}},{"module_path":"module.retail_app_ecs.module.alb_sg","local_name":"aws","source":"hashicorp/aws","provenance":{"file":".terraform/modules/retail_app_ecs.alb_sg/versions.tf","line":5,"end_line":8}},{"module_path":"module.retail_app_ecs.module.alb","local_name":"aws","source":"hashicorp/aws","provenance":{"file":".terraform/modules/retail_app_ecs.alb/versions.tf","line":5,"end_line":8}}]},{"name":"random","constraints":["\u003e= 2.2","~\u003e 3.7.0"],"status":"UNVERIFIED","note":"The knowledge base holds no pinned source schema of this provider, so its version cannot be checked (UNVERIFIED); the row records that the configuration uses it and changes no decision.","identity":"DECLARED","identity_basis":"REQUIRED_PROVIDERS_SOURCE","identity_evidence":"UNVERIFIED","version_provenance":"CONSTRAINT_ONLY","registry_address":"registry.terraform.io/hashicorp/random","local_names":["random"],"constraint_sources":[{"expr":"~\u003e 3.7.0","module_path":"module.dependencies","provenance":{"file":"../../lib/dependencies/versions.tf","line":10,"end_line":13}},{"expr":"\u003e= 2.2","module_path":"module.dependencies.module.catalog_rds","provenance":{"file":".terraform/modules/dependencies.catalog_rds/versions.tf","line":10,"end_line":13}},{"expr":"\u003e= 2.2","module_path":"module.dependencies.module.orders_rds","provenance":{"file":".terraform/modules/dependencies.orders_rds/versions.tf","line":10,"end_line":13}},{"expr":"~\u003e 3.7.0","module_path":"module.retail_app_ecs","provenance":{"file":"../../lib/ecs/versions.tf","line":10,"end_line":13}}],"declarations":[{"module_path":"module.dependencies","local_name":"random","source":"hashicorp/random","provenance":{"file":"../../lib/dependencies/versions.tf","line":10,"end_line":13}},{"module_path":"module.dependencies.module.catalog_rds","local_name":"random","source":"hashicorp/random","provenance":{"file":".terraform/modules/dependencies.catalog_rds/versions.tf","line":10,"end_line":13}},{"module_path":"module.dependencies.module.orders_rds","local_name":"random","source":"hashicorp/random","provenance":{"file":".terraform/modules/dependencies.orders_rds/versions.tf","line":10,"end_line":13}},{"module_path":"module.retail_app_ecs","local_name":"random","source":"hashicorp/random","provenance":{"file":"../../lib/ecs/versions.tf","line":10,"end_line":13}}]}],"provider_regions":[{"provider":"aws","set":false,"region_stated":false}]},"module_calls":[{"address":"module.dependencies.module.catalog_opensearch","source":"terraform-aws-modules/opensearch/aws","version_or_ref":"1.5.0","immutable_ref":true},{"address":"module.dependencies.module.catalog_rds","source":"terraform-aws-modules/rds-aurora/aws","version_or_ref":"7.7.1","immutable_ref":true},{"address":"module.dependencies.module.checkout_elasticache_redis","source":"cloudposse/elasticache-redis/aws","version_or_ref":"0.53.0","immutable_ref":true},{"address":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","source":"cloudposse/security-group/aws","version_or_ref":"1.0.1","immutable_ref":true},{"address":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.module.this","source":"cloudposse/label/null","version_or_ref":"0.25.0","immutable_ref":true},{"address":"module.dependencies.module.checkout_elasticache_redis.module.dns","source":"cloudposse/route53-cluster-hostname/aws","version_or_ref":"0.12.2","immutable_ref":true},{"address":"module.dependencies.module.checkout_elasticache_redis.module.dns.module.this","source":"cloudposse/label/null","version_or_ref":"0.25.0","immutable_ref":true},{"address":"module.dependencies.module.checkout_elasticache_redis.module.this","source":"cloudposse/label/null","version_or_ref":"0.25.0","immutable_ref":true},{"address":"module.dependencies.module.dynamodb_carts","source":"terraform-aws-modules/dynamodb-table/aws","version_or_ref":"3.3.0","immutable_ref":true},{"address":"module.dependencies.module.orders_rds","source":"terraform-aws-modules/rds-aurora/aws","version_or_ref":"7.7.1","immutable_ref":true},{"address":"module.retail_app_ecs.module.alb","source":"terraform-aws-modules/alb/aws","version_or_ref":"~\u003e 8.0","immutable_ref":false},{"address":"module.retail_app_ecs.module.alb_sg","source":"terraform-aws-modules/security-group/aws","version_or_ref":"~\u003e 4.0","immutable_ref":false},{"address":"module.vpc.module.vpc","source":"terraform-aws-modules/vpc/aws","version_or_ref":"5.21.0","immutable_ref":true}],"module_fetch":{"network_policy":"AUTO","managed_cache":"none","modules":[{"address":"module.dependencies.module.catalog_opensearch","from":"source_tree","version":"1.5.0","identity":"REGISTRY_VERSION"},{"address":"module.dependencies.module.catalog_rds","from":"source_tree","version":"7.7.1","identity":"REGISTRY_VERSION"},{"address":"module.dependencies.module.checkout_elasticache_redis","from":"source_tree","version":"0.53.0","identity":"REGISTRY_VERSION"},{"address":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","from":"source_tree","version":"1.0.1","identity":"REGISTRY_VERSION"},{"address":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.module.this","from":"source_tree","version":"0.25.0","identity":"REGISTRY_VERSION"},{"address":"module.dependencies.module.checkout_elasticache_redis.module.dns","from":"source_tree","version":"0.12.2","identity":"REGISTRY_VERSION"},{"address":"module.dependencies.module.checkout_elasticache_redis.module.dns.module.this","from":"source_tree","version":"0.25.0","identity":"REGISTRY_VERSION"},{"address":"module.dependencies.module.checkout_elasticache_redis.module.this","from":"source_tree","version":"0.25.0","identity":"REGISTRY_VERSION"},{"address":"module.dependencies.module.dynamodb_carts","from":"source_tree","version":"3.3.0","identity":"REGISTRY_VERSION"},{"address":"module.dependencies.module.orders_rds","from":"source_tree","version":"7.7.1","identity":"REGISTRY_VERSION"},{"address":"module.retail_app_ecs.module.alb","from":"source_tree","version":"8.7.0","identity":"REGISTRY_VERSION"},{"address":"module.retail_app_ecs.module.alb_sg","from":"source_tree","version":"4.17.2","identity":"REGISTRY_VERSION"},{"address":"module.vpc.module.vpc","from":"source_tree","version":"5.21.0","identity":"REGISTRY_VERSION"}]},"support_accounting":[{"node":"module.dependencies.aws_iam_policy.carts_dynamo","source_type":"aws_iam_policy","critical":[{"node":"module.dependencies.aws_iam_policy.carts_dynamo","attribute":"path","class":"CRITICAL","category":"identity-access","closure":"OPEN:not-applicable","by":"support.aws_iam_policy/sp-path-default:NOT_APPLICABLE"},{"node":"module.dependencies.aws_iam_policy.carts_dynamo","attribute":"policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.aws_iam_policy/sp-policy:REVIEW"}]},{"node":"module.dependencies.module.catalog_rds.aws_db_subnet_group.this","source_type":"aws_db_subnet_group","critical":[{"node":"module.dependencies.module.catalog_rds.aws_db_subnet_group.this","attribute":"subnet_ids","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"support.aws_db_subnet_group/sp-subnet-ids:REVIEW"}]},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_subnet_group.default","source_type":"aws_elasticache_subnet_group","critical":[{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_subnet_group.default","attribute":"subnet_ids","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"support.aws_elasticache_subnet_group/sp-subnet-ids:REVIEW"}]},{"node":"module.dependencies.module.orders_rds.aws_db_subnet_group.this","source_type":"aws_db_subnet_group","critical":[{"node":"module.dependencies.module.orders_rds.aws_db_subnet_group.this","attribute":"subnet_ids","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"support.aws_db_subnet_group/sp-subnet-ids:REVIEW"}]},{"node":"module.retail_app_ecs.aws_iam_policy.catalog_policy","source_type":"aws_iam_policy","critical":[{"node":"module.retail_app_ecs.aws_iam_policy.catalog_policy","attribute":"path","class":"CRITICAL","category":"identity-access","closure":"OPEN:not-applicable","by":"support.aws_iam_policy/sp-path-default:NOT_APPLICABLE"},{"node":"module.retail_app_ecs.aws_iam_policy.catalog_policy","attribute":"policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.aws_iam_policy/sp-doc-kms:REVIEW"}]},{"node":"module.retail_app_ecs.aws_iam_policy.orders_policy","source_type":"aws_iam_policy","critical":[{"node":"module.retail_app_ecs.aws_iam_policy.orders_policy","attribute":"path","class":"CRITICAL","category":"identity-access","closure":"OPEN:not-applicable","by":"support.aws_iam_policy/sp-path-default:NOT_APPLICABLE"},{"node":"module.retail_app_ecs.aws_iam_policy.orders_policy","attribute":"policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.aws_iam_policy/sp-doc-kms:REVIEW"}]},{"node":"module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this","source_type":"aws_service_discovery_private_dns_namespace","critical":[{"node":"module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this","attribute":"name","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"support.aws_service_discovery_private_dns_namespace/sp-name:REVIEW"},{"node":"module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this","attribute":"vpc","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"support.aws_service_discovery_private_dns_namespace/sp-vpc:REVIEW"}]},{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","source_type":"aws_lb_target_group","critical":[{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","attribute":"deregistration_delay","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"support.aws_lb_target_group/sp-deregistration-delay:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","attribute":"health_check.enabled","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"support.aws_lb_target_group/sp-health-check--enabled:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","attribute":"health_check.healthy_threshold","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"support.aws_lb_target_group/sp-health-check--healthy-threshold:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","attribute":"health_check.interval","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"support.aws_lb_target_group/sp-health-check--interval:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","attribute":"health_check.path","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"support.aws_lb_target_group/sp-health-check--path:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","attribute":"health_check.port","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"support.aws_lb_target_group/sp-health-check--port:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","attribute":"health_check.protocol","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"support.aws_lb_target_group/sp-health-check--protocol:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","attribute":"health_check.timeout","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"support.aws_lb_target_group/sp-health-check--timeout:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","attribute":"health_check.unhealthy_threshold","class":"CRITICAL","category":"availability-durability","closure":"CLOSED:REVIEW","by":"support.aws_lb_target_group/sp-health-check--unhealthy-threshold:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","attribute":"port","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"support.aws_lb_target_group/sp-port:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","attribute":"protocol","class":"CRITICAL","category":"encryption","closure":"CLOSED:REVIEW","by":"support.aws_lb_target_group/sp-protocol:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","attribute":"proxy_protocol_v2","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"support.aws_lb_target_group/sp-proxy-protocol-v2:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","attribute":"target_type","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"support.aws_lb_target_group/sp-target-type:REVIEW"},{"node":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","attribute":"vpc_id","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:REVIEW","by":"support.aws_lb_target_group/sp-vpc-id:REVIEW"}]},{"node":"module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_logs","source_type":"aws_iam_policy","critical":[{"node":"module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_logs","attribute":"policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.aws_iam_policy/sp-policy:REVIEW"}]},{"node":"module.retail_app_ecs.module.carts_service.aws_iam_policy.ecs_exec","source_type":"aws_iam_policy","critical":[{"node":"module.retail_app_ecs.module.carts_service.aws_iam_policy.ecs_exec","attribute":"path","class":"CRITICAL","category":"identity-access","closure":"OPEN:not-applicable","by":"support.aws_iam_policy/sp-path-default:NOT_APPLICABLE"},{"node":"module.retail_app_ecs.module.carts_service.aws_iam_policy.ecs_exec","attribute":"policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.aws_iam_policy/sp-policy:REVIEW"}]},{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_logs","source_type":"aws_iam_policy","critical":[{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_logs","attribute":"policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.aws_iam_policy/sp-policy:REVIEW"}]},{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.ecs_exec","source_type":"aws_iam_policy","critical":[{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.ecs_exec","attribute":"path","class":"CRITICAL","category":"identity-access","closure":"OPEN:not-applicable","by":"support.aws_iam_policy/sp-path-default:NOT_APPLICABLE"},{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_policy.ecs_exec","attribute":"policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.aws_iam_policy/sp-policy:REVIEW"}]},{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_logs","source_type":"aws_iam_policy","critical":[{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_logs","attribute":"policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.aws_iam_policy/sp-policy:REVIEW"}]},{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.ecs_exec","source_type":"aws_iam_policy","critical":[{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.ecs_exec","attribute":"path","class":"CRITICAL","category":"identity-access","closure":"OPEN:not-applicable","by":"support.aws_iam_policy/sp-path-default:NOT_APPLICABLE"},{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_policy.ecs_exec","attribute":"policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.aws_iam_policy/sp-policy:REVIEW"}]},{"node":"module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_logs","source_type":"aws_iam_policy","critical":[{"node":"module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_logs","attribute":"policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.aws_iam_policy/sp-policy:REVIEW"}]},{"node":"module.retail_app_ecs.module.orders_service.aws_iam_policy.ecs_exec","source_type":"aws_iam_policy","critical":[{"node":"module.retail_app_ecs.module.orders_service.aws_iam_policy.ecs_exec","attribute":"path","class":"CRITICAL","category":"identity-access","closure":"OPEN:not-applicable","by":"support.aws_iam_policy/sp-path-default:NOT_APPLICABLE"},{"node":"module.retail_app_ecs.module.orders_service.aws_iam_policy.ecs_exec","attribute":"policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.aws_iam_policy/sp-policy:REVIEW"}]},{"node":"module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_logs","source_type":"aws_iam_policy","critical":[{"node":"module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_logs","attribute":"policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.aws_iam_policy/sp-policy:REVIEW"}]},{"node":"module.retail_app_ecs.module.ui_service.aws_iam_policy.ecs_exec","source_type":"aws_iam_policy","critical":[{"node":"module.retail_app_ecs.module.ui_service.aws_iam_policy.ecs_exec","attribute":"path","class":"CRITICAL","category":"identity-access","closure":"OPEN:not-applicable","by":"support.aws_iam_policy/sp-path-default:NOT_APPLICABLE"},{"node":"module.retail_app_ecs.module.ui_service.aws_iam_policy.ecs_exec","attribute":"policy","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.aws_iam_policy/sp-policy:REVIEW"}]}],"target_lifecycle":{"units":[{"address":"module.retail_app_ecs.aws_ecs_cluster.cluster","lifecycle":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-10-08","recheck_after":"2027-01-06","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"production_suitability":"SUITABLE","upgrade_action":"NONE_PUBLISHED","migration_timing_risk":"UNKNOWN","note":"No expiry or EOL for 1.36 is stated in the pages read; the lifecycle table does not list it. An unpublished end is reported as such, not as safe."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target."},{"subject":"1.34","state":"EXPIRING","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"UPGRADE_BEFORE_EXPIRY","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]}},{"address":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","lifecycle":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-10-08","recheck_after":"2027-01-06","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"production_suitability":"SUITABLE","upgrade_action":"NONE_PUBLISHED","migration_timing_risk":"UNKNOWN","note":"No expiry or EOL for 1.36 is stated in the pages read; the lifecycle table does not list it. An unpublished end is reported as such, not as safe."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target."},{"subject":"1.34","state":"EXPIRING","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"UPGRADE_BEFORE_EXPIRY","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]}},{"address":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","lifecycle":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-10-08","recheck_after":"2027-01-06","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"production_suitability":"SUITABLE","upgrade_action":"NONE_PUBLISHED","migration_timing_risk":"UNKNOWN","note":"No expiry or EOL for 1.36 is stated in the pages read; the lifecycle table does not list it. An unpublished end is reported as such, not as safe."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target."},{"subject":"1.34","state":"EXPIRING","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"UPGRADE_BEFORE_EXPIRY","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]}},{"address":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","lifecycle":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-10-08","recheck_after":"2027-01-06","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"production_suitability":"SUITABLE","upgrade_action":"NONE_PUBLISHED","migration_timing_risk":"UNKNOWN","note":"No expiry or EOL for 1.36 is stated in the pages read; the lifecycle table does not list it. An unpublished end is reported as such, not as safe."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target."},{"subject":"1.34","state":"EXPIRING","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"UPGRADE_BEFORE_EXPIRY","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]}},{"address":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","lifecycle":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-10-08","recheck_after":"2027-01-06","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"production_suitability":"SUITABLE","upgrade_action":"NONE_PUBLISHED","migration_timing_risk":"UNKNOWN","note":"No expiry or EOL for 1.36 is stated in the pages read; the lifecycle table does not list it. An unpublished end is reported as such, not as safe."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target."},{"subject":"1.34","state":"EXPIRING","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"UPGRADE_BEFORE_EXPIRY","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]}},{"address":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","lifecycle":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-10-08","recheck_after":"2027-01-06","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"production_suitability":"SUITABLE","upgrade_action":"NONE_PUBLISHED","migration_timing_risk":"UNKNOWN","note":"No expiry or EOL for 1.36 is stated in the pages read; the lifecycle table does not list it. An unpublished end is reported as such, not as safe."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target."},{"subject":"1.34","state":"EXPIRING","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"UPGRADE_BEFORE_EXPIRY","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]}}]},"kernel":{"schema_version":"kernel-0.1","units":[{"address":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","semantic_fingerprint":"bda4946e10c3cf230753b6d8a77e70dc7d18729a15222b6a77ce441ebad29a8e","absent_claims":36,"claims":[{"unit":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","semantic":"capacity-mode","fact":{"state":"KNOWN","value":"stated"},"criticality":"NON_CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-2fdd43a9605d"},{"unit":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","semantic":"encryption-at-rest","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-2fdd43a9605d"},{"unit":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","semantic":"index-projection-and-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-2fdd43a9605d"},{"unit":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","semantic":"key-schema","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-2fdd43a9605d"},{"unit":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","semantic":"point-in-time-recovery","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-2fdd43a9605d"},{"unit":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","semantic":"secondary-indexes","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-2fdd43a9605d"},{"unit":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","semantic":"tc-dynamodb-table-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-2fdd43a9605d"},{"unit":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","semantic":"ttl","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-2fdd43a9605d"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","semantic_fingerprint":"689e6080b5d66148d1daf5df9d921b1be813ef73cd71398323c2175bd0131f26","absent_claims":32,"claims":[{"unit":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","semantic":"tc-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-e45d2e1b3202"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.aws_ecs_cluster.cluster","semantic_fingerprint":"cb95ab3259f7949c69bf8e48d0f09149464a83de483cdf7856b04f68e12619cb","absent_claims":122,"claims":[],"invariant_violations":[]},{"address":"module.retail_app_ecs.aws_kms_key.cmk","semantic_fingerprint":"a97eec34d97c1ad09628ece5c583dac74ec597155771cd7de037275b3f11bd2e","absent_claims":47,"claims":[{"unit":"module.retail_app_ecs.aws_kms_key.cmk","semantic":"deletion-window","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-7b60f884ef30"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","semantic_fingerprint":"56625deb15466b351b7b15f8b4631a87521308e6288f4bbbb661ff99072f333d","absent_claims":97,"claims":[{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","semantic":"facet-link-role","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","semantic":"iam-managed-ecs","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","semantic":"iam-trust-service-workload","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","semantic":"permissions","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","semantic":"tcfp-iam-role-policy-attachment--policy-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","semantic":"trust","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","semantic_fingerprint":"56625deb15466b351b7b15f8b4631a87521308e6288f4bbbb661ff99072f333d","absent_claims":97,"claims":[{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","semantic":"facet-link-role","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","semantic":"iam-managed-ecs","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","semantic":"iam-trust-service-workload","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","semantic":"permissions","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","semantic":"tcfp-iam-role-policy-attachment--policy-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","semantic":"trust","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","semantic_fingerprint":"56625deb15466b351b7b15f8b4631a87521308e6288f4bbbb661ff99072f333d","absent_claims":97,"claims":[{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","semantic":"facet-link-role","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","semantic":"iam-managed-ecs","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","semantic":"iam-trust-service-workload","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","semantic":"permissions","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","semantic":"tcfp-iam-role-policy-attachment--policy-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","semantic":"trust","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"}],"invariant_violations":[]},{"address":"module.vpc.module.vpc.aws_eip.nat","semantic_fingerprint":"b235d2492519155983afd326142a8f18457345e3a328ea3ae28f9c5de71d27a2","absent_claims":14,"claims":[{"unit":"module.vpc.module.vpc.aws_eip.nat","semantic":"public-address","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-1a83ada574f5"}],"invariant_violations":[]},{"address":"module.vpc.module.vpc.aws_vpc.this","semantic_fingerprint":"23aa7eefe07ee1fcf2a823fc38dacf3b1e6838159084c68355bdbcedd99b1ab1","absent_claims":80,"claims":[{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"address-space","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"default-nacl-rules","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"default-route-table","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"default-security-group-omitted-direction","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"default-tenancy","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"dns-settings","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"main-table-set","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"tcfp-default-network-acl--egress--action","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"tcfp-default-network-acl--egress--cidr-block","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"tcfp-default-network-acl--egress--from-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"tcfp-default-network-acl--egress--ipv6-cidr-block","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"tcfp-default-network-acl--egress--protocol","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"tcfp-default-network-acl--egress--rule-no","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"tcfp-default-network-acl--egress--to-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"tcfp-default-network-acl--ingress--action","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"tcfp-default-network-acl--ingress--cidr-block","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"tcfp-default-network-acl--ingress--from-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"tcfp-default-network-acl--ingress--ipv6-cidr-block","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"tcfp-default-network-acl--ingress--protocol","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"tcfp-default-network-acl--ingress--rule-no","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"},{"unit":"module.vpc.module.vpc.aws_vpc.this","semantic":"tcfp-default-network-acl--ingress--to-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-6994962787dd"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","semantic_fingerprint":"c0a7122b27ae758b9823b484fd62db42b951a4a75cf236a028a860175249e4a2","absent_claims":31,"claims":[{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","semantic":"customer-managed-key","fact":{"state":"KNOWN","value":"stated-by-reference"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-eae4310bd959"},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","semantic":"secret-value","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-eae4310bd959"},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","semantic":"tc-secretsmanager-secret-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-eae4310bd959"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.alb.aws_security_group.this","semantic_fingerprint":"6d44955567cf83f2b43ca097234983f972e6e0cbe67192be9c310db92444abf0","absent_claims":112,"claims":[{"unit":"module.retail_app_ecs.module.alb.aws_security_group.this","semantic":"egress-restriction","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.alb.aws_security_group.this","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.alb.aws_security_group.this","semantic":"security-group-vpc-membership","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.alb.aws_security_group.this","semantic":"stateful","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","semantic_fingerprint":"1f1a4f59293f51e76a52c6d0e75dd13c08b99b954f49aaec64b56781748cabcc","absent_claims":106,"claims":[{"unit":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","semantic":"revoke-rules-on-delete","fact":{"state":"KNOWN","value":"stated"},"criticality":"NON_CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","semantic":"rule-ports","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","semantic":"security-group-vpc-membership","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","semantic":"standalone-rule-empty-sources","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","semantic":"standalone-rule-other-sources","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","semantic":"standalone-rule-values","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","semantic":"stateful","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","semantic":"tcfp-security-group-rule--from-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","semantic":"tcfp-security-group-rule--to-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","semantic_fingerprint":"1d4414ccbcec01049fa79e354257fba0073b16b5082cc1c3208441593b0ba37e","absent_claims":97,"claims":[{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","semantic":"facet-link-role","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","semantic":"iam-managed-customer-policy","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","semantic":"iam-trust-service-workload","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","semantic":"linked-dependency:aws_dynamodb_table","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","semantic":"permissions","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","semantic":"tcfp-iam-role-policy-attachment--policy-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","semantic":"trust","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.carts_service.aws_security_group.this","semantic_fingerprint":"2aad1df8f27be96515b1918a7574c8b3c65f720f0f1e786b6eece13f0641b554","absent_claims":109,"claims":[{"unit":"module.retail_app_ecs.module.carts_service.aws_security_group.this","semantic":"egress-rule-protocol","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.carts_service.aws_security_group.this","semantic":"egress-sources","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.carts_service.aws_security_group.this","semantic":"ingress-sources","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"LEDGER","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.carts_service.aws_security_group.this","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.carts_service.aws_security_group.this","semantic":"rule-ports","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"LEDGER","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.carts_service.aws_security_group.this","semantic":"security-group-vpc-membership","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.carts_service.aws_security_group.this","semantic":"stateful","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","semantic_fingerprint":"80127f09dd10b14fd3837d998147dbd25ea7b4492d79efa505b186e4bad471c5","absent_claims":97,"claims":[{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","semantic":"facet-link-role","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","semantic":"iam-managed-customer-policy","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","semantic":"iam-trust-service-workload","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","semantic":"permissions","fact":{"state":"KNOWN","value":"stated-by-reference"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","semantic":"tcfp-iam-role-policy-attachment--policy-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","semantic":"trust","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","semantic_fingerprint":"2aad1df8f27be96515b1918a7574c8b3c65f720f0f1e786b6eece13f0641b554","absent_claims":109,"claims":[{"unit":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","semantic":"egress-rule-protocol","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","semantic":"egress-sources","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","semantic":"ingress-sources","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"LEDGER","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","semantic":"rule-ports","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"LEDGER","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","semantic":"security-group-vpc-membership","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","semantic":"stateful","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","semantic_fingerprint":"1d4414ccbcec01049fa79e354257fba0073b16b5082cc1c3208441593b0ba37e","absent_claims":97,"claims":[{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","semantic":"facet-link-role","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","semantic":"iam-managed-customer-policy","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","semantic":"iam-trust-service-workload","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","semantic":"linked-dependency:aws_dynamodb_table","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","semantic":"permissions","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","semantic":"tcfp-iam-role-policy-attachment--policy-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","semantic":"trust","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","semantic_fingerprint":"2aad1df8f27be96515b1918a7574c8b3c65f720f0f1e786b6eece13f0641b554","absent_claims":109,"claims":[{"unit":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","semantic":"egress-rule-protocol","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","semantic":"egress-sources","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","semantic":"ingress-sources","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"LEDGER","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","semantic":"rule-ports","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"LEDGER","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","semantic":"security-group-vpc-membership","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","semantic":"stateful","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","semantic_fingerprint":"80127f09dd10b14fd3837d998147dbd25ea7b4492d79efa505b186e4bad471c5","absent_claims":97,"claims":[{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","semantic":"facet-link-role","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","semantic":"iam-managed-customer-policy","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","semantic":"iam-trust-service-workload","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","semantic":"permissions","fact":{"state":"KNOWN","value":"stated-by-reference"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","semantic":"tcfp-iam-role-policy-attachment--policy-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","semantic":"trust","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.orders_service.aws_security_group.this","semantic_fingerprint":"2aad1df8f27be96515b1918a7574c8b3c65f720f0f1e786b6eece13f0641b554","absent_claims":109,"claims":[{"unit":"module.retail_app_ecs.module.orders_service.aws_security_group.this","semantic":"egress-rule-protocol","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.orders_service.aws_security_group.this","semantic":"egress-sources","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.orders_service.aws_security_group.this","semantic":"ingress-sources","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"LEDGER","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.orders_service.aws_security_group.this","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.orders_service.aws_security_group.this","semantic":"rule-ports","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"LEDGER","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.orders_service.aws_security_group.this","semantic":"security-group-vpc-membership","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.orders_service.aws_security_group.this","semantic":"stateful","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","semantic_fingerprint":"80127f09dd10b14fd3837d998147dbd25ea7b4492d79efa505b186e4bad471c5","absent_claims":97,"claims":[{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","semantic":"facet-link-role","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","semantic":"iam-managed-customer-policy","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","semantic":"iam-trust-service-workload","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","semantic":"permissions","fact":{"state":"KNOWN","value":"stated-by-reference"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","semantic":"tcfp-iam-role-policy-attachment--policy-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","semantic":"trust","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.ui_service.aws_security_group.this","semantic_fingerprint":"2aad1df8f27be96515b1918a7574c8b3c65f720f0f1e786b6eece13f0641b554","absent_claims":109,"claims":[{"unit":"module.retail_app_ecs.module.ui_service.aws_security_group.this","semantic":"egress-rule-protocol","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.ui_service.aws_security_group.this","semantic":"egress-sources","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.ui_service.aws_security_group.this","semantic":"ingress-sources","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"LEDGER","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.ui_service.aws_security_group.this","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.ui_service.aws_security_group.this","semantic":"rule-ports","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"LEDGER","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.ui_service.aws_security_group.this","semantic":"security-group-vpc-membership","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.retail_app_ecs.module.ui_service.aws_security_group.this","semantic":"stateful","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"}],"invariant_violations":[]},{"address":"module.vpc.module.vpc.aws_nat_gateway.this","semantic_fingerprint":"55176c731ce7536ad4e2df277ea3055f396627024f41ac173d12ba6bf0a814cf","absent_claims":4,"claims":[{"unit":"module.vpc.module.vpc.aws_nat_gateway.this","semantic":"fixed-egress-ip","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b23261b73c61"},{"unit":"module.vpc.module.vpc.aws_nat_gateway.this","semantic":"nat-placement","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b23261b73c61"},{"unit":"module.vpc.module.vpc.aws_nat_gateway.this","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b23261b73c61"},{"unit":"module.vpc.module.vpc.aws_nat_gateway.this","semantic":"outbound-nat","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-b23261b73c61"}],"invariant_violations":[]},{"address":"module.dependencies.aws_security_group.catalog_opensearch_sg","semantic_fingerprint":"6d4cd1fa839eded0769691249ec3d954b335b1a30f0f2c8b32688a6f6488ee23","absent_claims":108,"claims":[{"unit":"module.dependencies.aws_security_group.catalog_opensearch_sg","semantic":"egress-restriction","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.aws_security_group.catalog_opensearch_sg","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.aws_security_group.catalog_opensearch_sg","semantic":"security-group-vpc-membership","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.aws_security_group.catalog_opensearch_sg","semantic":"standalone-rule-not-generated","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.aws_security_group.catalog_opensearch_sg","semantic":"standalone-rule-remote-not-resolved","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.aws_security_group.catalog_opensearch_sg","semantic":"stateful","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.aws_security_group.catalog_opensearch_sg","semantic":"tcfp-security-group-rule--from-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.aws_security_group.catalog_opensearch_sg","semantic":"tcfp-security-group-rule--to-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"}],"invariant_violations":[]},{"address":"module.dependencies.aws_security_group.mq","semantic_fingerprint":"8c5ac3c5f55804f69f25c2911a56db44b78756dfdd530b0fe78803967e8443ed","absent_claims":109,"claims":[{"unit":"module.dependencies.aws_security_group.mq","semantic":"egress-restriction","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.aws_security_group.mq","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.aws_security_group.mq","semantic":"security-group-vpc-membership","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.aws_security_group.mq","semantic":"standalone-rule-not-generated","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.aws_security_group.mq","semantic":"stateful","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.aws_security_group.mq","semantic":"tcfp-security-group-rule--from-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.aws_security_group.mq","semantic":"tcfp-security-group-rule--to-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"}],"invariant_violations":[]},{"address":"module.dependencies.module.catalog_rds.aws_security_group.this","semantic_fingerprint":"0988ce4bd783f320cb27a723abdc4ff7a930dc76dfca16aa81f85e9191258678","absent_claims":108,"claims":[{"unit":"module.dependencies.module.catalog_rds.aws_security_group.this","semantic":"egress-restriction","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.catalog_rds.aws_security_group.this","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.catalog_rds.aws_security_group.this","semantic":"rule-ports","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.catalog_rds.aws_security_group.this","semantic":"security-group-vpc-membership","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.catalog_rds.aws_security_group.this","semantic":"standalone-rule-values","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.catalog_rds.aws_security_group.this","semantic":"stateful","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.catalog_rds.aws_security_group.this","semantic":"tcfp-security-group-rule--from-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.catalog_rds.aws_security_group.this","semantic":"tcfp-security-group-rule--to-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"}],"invariant_violations":[]},{"address":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","semantic_fingerprint":"1f1a4f59293f51e76a52c6d0e75dd13c08b99b954f49aaec64b56781748cabcc","absent_claims":106,"claims":[{"unit":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","semantic":"revoke-rules-on-delete","fact":{"state":"KNOWN","value":"stated"},"criticality":"NON_CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","semantic":"rule-ports","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","semantic":"security-group-vpc-membership","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","semantic":"standalone-rule-empty-sources","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","semantic":"standalone-rule-other-sources","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","semantic":"standalone-rule-values","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","semantic":"stateful","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","semantic":"tcfp-security-group-rule--from-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","semantic":"tcfp-security-group-rule--to-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"}],"invariant_violations":[]},{"address":"module.dependencies.module.orders_rds.aws_security_group.this","semantic_fingerprint":"0988ce4bd783f320cb27a723abdc4ff7a930dc76dfca16aa81f85e9191258678","absent_claims":108,"claims":[{"unit":"module.dependencies.module.orders_rds.aws_security_group.this","semantic":"egress-restriction","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.orders_rds.aws_security_group.this","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.orders_rds.aws_security_group.this","semantic":"rule-ports","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.orders_rds.aws_security_group.this","semantic":"security-group-vpc-membership","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.orders_rds.aws_security_group.this","semantic":"standalone-rule-values","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.orders_rds.aws_security_group.this","semantic":"stateful","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.orders_rds.aws_security_group.this","semantic":"tcfp-security-group-rule--from-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"},{"unit":"module.dependencies.module.orders_rds.aws_security_group.this","semantic":"tcfp-security-group-rule--to-port","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8e3ddd52d6aa"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.alb.aws_lb.this","semantic_fingerprint":"cdc26627bd247a8e3a49d1c58fb7006b08bf82033f0e6c127da5cdfd226a3892","absent_claims":115,"claims":[{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"client-restriction","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"cross-zone","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"deletion-protection","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"drop-invalid-headers","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"frontend-http2","fact":{"state":"KNOWN","value":"stated"},"criticality":"NON_CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"ip-address-type","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"lb-connection-timeouts","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"lb-routing-and-addressing","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"lb-subnets","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"lb-type","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"listener-protocol","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"listeners","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"network-exposure","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"LEDGER","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"request-handling","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"request-header-options","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"tc-lb-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"tcfp-lb-listener--default-action--target-group-arn","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"tcfp-lb-listener--default-action--type","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-09f8dd69c07b"},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","semantic":"tcfp-lb-listener--protocol","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-09f8dd69c07b"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic_fingerprint":"0007de0b310e51ad03559cc26e0a661447d81972d7e45db0156330d5891d29ab","absent_claims":107,"claims":[{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"linked-dependency:aws_dynamodb_table","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"service-connect-values","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"service-desired-count","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"service-discovery","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"service-execute-command","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"service-network-placement","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"service-public-ip-setting","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"service-task-definition","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"task-definition","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"td-container-definitions","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"td-container-image-registry","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"td-container-plaintext-secret-env","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"td-container-secret-references","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"td-execution-role-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"td-network-mode","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","semantic":"td-task-role-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"}],"invariant_violations":[]},{"address":"module.dependencies.aws_mq_broker.mq","semantic_fingerprint":"5d2c76197436286d4996d8662ca0176c6226d373a329952ecfcba9713c8512d2","absent_claims":30,"claims":[{"unit":"module.dependencies.aws_mq_broker.mq","semantic":"broker-network","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-27233f66625d"},{"unit":"module.dependencies.aws_mq_broker.mq","semantic":"broker-users","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-27233f66625d"},{"unit":"module.dependencies.aws_mq_broker.mq","semantic":"engine","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-27233f66625d"},{"unit":"module.dependencies.aws_mq_broker.mq","semantic":"engine-type","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-27233f66625d"},{"unit":"module.dependencies.aws_mq_broker.mq","semantic":"engine-version","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-27233f66625d"},{"unit":"module.dependencies.aws_mq_broker.mq","semantic":"network-exposure","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-27233f66625d"},{"unit":"module.dependencies.aws_mq_broker.mq","semantic":"tc-mq-broker-broker-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-27233f66625d"},{"unit":"module.dependencies.aws_mq_broker.mq","semantic":"tc-user--password","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-27233f66625d"},{"unit":"module.dependencies.aws_mq_broker.mq","semantic":"tc-user--username","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-27233f66625d"},{"unit":"module.dependencies.aws_mq_broker.mq","semantic":"tcp-deployment-mode","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-27233f66625d"},{"unit":"module.dependencies.aws_mq_broker.mq","semantic":"tcp-engine-type","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-27233f66625d"},{"unit":"module.dependencies.aws_mq_broker.mq","semantic":"tcp-engine-version","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-27233f66625d"},{"unit":"module.dependencies.aws_mq_broker.mq","semantic":"tcp-security-groups","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-27233f66625d"},{"unit":"module.dependencies.aws_mq_broker.mq","semantic":"tcp-subnet-ids","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-27233f66625d"}],"invariant_violations":[]},{"address":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic_fingerprint":"4d600ecffdcd2af4cbeb91ab432f2682f6089e8b9f56561db5195fc30de880d3","absent_claims":21,"claims":[{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic":"access-and-encryption-settings","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-05cb9bc201d0"},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic":"cluster-layout-settings","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-05cb9bc201d0"},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic":"credentials-and-keys-settings","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-05cb9bc201d0"},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic":"domain-credentials-and-keys","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-05cb9bc201d0"},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic":"domain-settings","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-05cb9bc201d0"},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic":"encryption-at-rest","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-05cb9bc201d0"},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic":"engine-version","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-05cb9bc201d0"},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic":"fine-grained-access","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-05cb9bc201d0"},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic":"nbr-aws-opensearch-domain-policy","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-05cb9bc201d0"},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic":"network-settings","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-05cb9bc201d0"},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic":"opensearch-domain-policy-resource","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-05cb9bc201d0"},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic":"private-endpoint","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-05cb9bc201d0"},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic":"storage-settings","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-05cb9bc201d0"},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","semantic":"tc-opensearch-domain-domain-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-05cb9bc201d0"}],"invariant_violations":[]},{"address":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic_fingerprint":"abb8199854f673072b0c34605e3db7aed7187dd54d82fce4d35973081d4f8664","absent_claims":89,"claims":[{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"admin-password","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"admin-username-not-carried","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"backup-retention","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"LEDGER","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"db-network-placement","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"engine","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"engine-version","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"final-snapshot","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"log-exports-none","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"member-engine","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"member-settings","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"multiaz-high-availability","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"multiaz-network-exposure","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"parameter-and-option-groups","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"readable-standbys","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"security-groups","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"storage-encryption","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"tc-database-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"tcf-rds-cluster-instance--identifier","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"tcfp-rds-cluster-instance--engine","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"tcfp-rds-cluster-instance--engine-version","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"tcp-backup-retention-period","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"tcp-db-cluster-parameter-group-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"tcp-db-subnet-group-name","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","semantic":"tcp-vpc-security-group-ids","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"}],"invariant_violations":[]},{"address":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","semantic_fingerprint":"0f4708b45f08805537da1ff6826dd47a4863bb79c9d19663f44e9253357f7a4b","absent_claims":56,"claims":[{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","semantic":"at-rest-encryption-off","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b1ccb27fcdc7"},{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","semantic":"engine-version","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-b1ccb27fcdc7"},{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","semantic":"failover-off","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b1ccb27fcdc7"},{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","semantic":"network-placement","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b1ccb27fcdc7"},{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","semantic":"parameter-group","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b1ccb27fcdc7"},{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","semantic":"parameter-group-default","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b1ccb27fcdc7"},{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","semantic":"seed-snapshot","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b1ccb27fcdc7"},{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","semantic":"snapshots-off","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b1ccb27fcdc7"},{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","semantic":"tc-elasticache-replication-group-replication-group-id","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b1ccb27fcdc7"},{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","semantic":"tcp-elasticache-replication-group-at-rest-encryption-enabled","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b1ccb27fcdc7"},{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","semantic":"tcp-elasticache-replication-group-num-cache-clusters","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b1ccb27fcdc7"},{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","semantic":"tcp-elasticache-replication-group-transit-encryption-enabled","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b1ccb27fcdc7"}],"invariant_violations":[]},{"address":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic_fingerprint":"1bb19e74367f9dfbb1175f220f395ba98073ef650d39f6d2c01902d0dd5fa378","absent_claims":88,"claims":[{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"admin-password","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"admin-username-not-carried","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"aurora-extras","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"backup-retention","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"LEDGER","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"db-network-placement","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"engine","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"engine-version","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"final-snapshot","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"log-exports-none","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"member-engine","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"member-settings","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"multiaz-high-availability","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"multiaz-network-exposure","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"parameter-and-option-groups","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"readable-standbys","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"security-groups","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"storage-encryption","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"tc-database-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"tcf-rds-cluster-instance--identifier","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"tcfp-rds-cluster-instance--engine","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"tcfp-rds-cluster-instance--engine-version","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"tcp-backup-retention-period","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"tcp-db-cluster-parameter-group-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"tcp-db-subnet-group-name","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","semantic":"tcp-vpc-security-group-ids","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-be35bf0a9d87"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","semantic_fingerprint":"c0a7122b27ae758b9823b484fd62db42b951a4a75cf236a028a860175249e4a2","absent_claims":31,"claims":[{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","semantic":"customer-managed-key","fact":{"state":"KNOWN","value":"stated-by-reference"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-eae4310bd959"},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","semantic":"secret-value","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-eae4310bd959"},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","semantic":"tc-secretsmanager-secret-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-eae4310bd959"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.aws_secretsmanager_secret.mq","semantic_fingerprint":"06d12e38d1cfe531430d980bccdbb0072f8be8cbfc0542b5978ee640f4a05039","absent_claims":32,"claims":[{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.mq","semantic":"secret-value","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-eae4310bd959"},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.mq","semantic":"tc-secretsmanager-secret-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-eae4310bd959"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","semantic_fingerprint":"06d12e38d1cfe531430d980bccdbb0072f8be8cbfc0542b5978ee640f4a05039","absent_claims":32,"claims":[{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","semantic":"secret-value","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-eae4310bd959"},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","semantic":"tc-secretsmanager-secret-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-eae4310bd959"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","semantic_fingerprint":"9d3f91b7b97cb031270b5ed4eb09708c391237ef0a4c23a95bfc18cec0d99005","absent_claims":97,"claims":[{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","semantic":"facet-link-role","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","semantic":"iam-managed-ecs","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","semantic":"iam-trust-service-workload","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","semantic":"linked-dependency:aws_secretsmanager_secret","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","semantic":"permissions","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","semantic":"tcfp-iam-role-policy-attachment--policy-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","semantic":"trust","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","semantic_fingerprint":"9d3f91b7b97cb031270b5ed4eb09708c391237ef0a4c23a95bfc18cec0d99005","absent_claims":97,"claims":[{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","semantic":"facet-link-role","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","semantic":"iam-managed-ecs","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","semantic":"iam-trust-service-workload","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","semantic":"linked-dependency:aws_secretsmanager_secret","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","semantic":"permissions","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","semantic":"tcfp-iam-role-policy-attachment--policy-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","semantic":"trust","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-b0690303f286"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic_fingerprint":"aae52b976b60d90decdb9fb08d996c5e481ba2b66dcab15b6842363c41c10eaa","absent_claims":107,"claims":[{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"linked-dependency:aws_secretsmanager_secret_version","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"service-connect-values","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"service-desired-count","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"service-discovery","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"service-execute-command","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"service-network-placement","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"service-public-ip-setting","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"service-task-definition","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"task-definition","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"td-container-definitions","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"td-container-image-registry","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"td-container-plaintext-secret-env","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"td-container-secret-references","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"td-execution-role-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"td-network-mode","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","semantic":"td-task-role-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic_fingerprint":"aae52b976b60d90decdb9fb08d996c5e481ba2b66dcab15b6842363c41c10eaa","absent_claims":107,"claims":[{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"linked-dependency:aws_secretsmanager_secret_version","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"service-connect-values","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"service-desired-count","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"service-discovery","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"service-execute-command","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"service-network-placement","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"service-public-ip-setting","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"service-task-definition","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"task-definition","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"td-container-definitions","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"td-container-image-registry","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"td-container-plaintext-secret-env","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"td-container-secret-references","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"td-execution-role-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"td-network-mode","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","semantic":"td-task-role-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic_fingerprint":"e74a44ab37f13ae1b211f6eca07a30147a480832980d192606e148ed1aa6acc7","absent_claims":107,"claims":[{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"service-connect-values","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"service-desired-count","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"service-discovery","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"service-execute-command","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"service-network-placement","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"service-public-ip-setting","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"service-task-definition","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"task-definition","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"td-container-definitions","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"td-container-image-registry","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"td-container-plaintext-secret-env","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"td-container-secret-references","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"td-execution-role-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"td-network-mode","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","semantic":"td-task-role-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic_fingerprint":"23ceb2f0ca7f3f1322f6238b9cc6c1d332dd631fed29ff7ac54cc89121de8436","absent_claims":106,"claims":[{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"service-connect-values","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"service-desired-count","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"service-discovery","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"service-execute-command","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"service-load-balancer-target","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"service-network-placement","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"service-public-ip-setting","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"service-task-definition","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"task-definition","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"td-container-definitions","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"td-container-image-registry","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"td-container-plaintext-secret-env","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"td-container-secret-references","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"td-execution-role-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"td-network-mode","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","semantic":"td-task-role-arn","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-94f243a64cab"}],"invariant_violations":[]},{"address":"module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events","semantic_fingerprint":"fe8427dbb68ca58b4d7aa29a1d75bd143e246d04e2031fcefc49f99efba44fff","absent_claims":0,"claims":[],"invariant_violations":[]},{"address":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights","semantic_fingerprint":"fe8427dbb68ca58b4d7aa29a1d75bd143e246d04e2031fcefc49f99efba44fff","absent_claims":0,"claims":[],"invariant_violations":[]},{"address":"module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs","semantic_fingerprint":"fe8427dbb68ca58b4d7aa29a1d75bd143e246d04e2031fcefc49f99efba44fff","absent_claims":0,"claims":[],"invariant_violations":[]},{"address":"module.vpc.module.vpc.aws_internet_gateway.this","semantic_fingerprint":"66d96e801621d2336e00fff023885463dd6d37821925aa102be0b9a1678141fc","absent_claims":5,"claims":[{"unit":"module.vpc.module.vpc.aws_internet_gateway.this","semantic":"attached-vpc","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-841642b337d0"},{"unit":"module.vpc.module.vpc.aws_internet_gateway.this","semantic":"internet-access","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-841642b337d0"},{"unit":"module.vpc.module.vpc.aws_internet_gateway.this","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-841642b337d0"}],"invariant_violations":[]},{"address":"module.vpc.module.vpc.aws_route_table.private","semantic_fingerprint":"88276075c155a054a9d26abf79ab98b3fd657fd485effe72a305391c692d7a2a","absent_claims":26,"claims":[{"unit":"module.vpc.module.vpc.aws_route_table.private","semantic":"associations","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.private","semantic":"egress-restriction","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.private","semantic":"inbound-none","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.private","semantic":"nat-fixed-egress-address","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.private","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.private","semantic":"route-destinations","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.private","semantic":"route-set-completeness","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.private","semantic":"route-targets","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.private","semantic":"routes","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.private","semantic":"subnet-association-target","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.private","semantic":"tcr-route-table-vpc-id","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-441dfcc70ea4"}],"invariant_violations":[]},{"address":"module.vpc.module.vpc.aws_route_table.public","semantic_fingerprint":"59db7e1d7cc2864c3acfb8d57e676a0d615dc9fa7d8e1cf384a5da4c5d29b583","absent_claims":29,"claims":[{"unit":"module.vpc.module.vpc.aws_route_table.public","semantic":"associations","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.public","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.public","semantic":"route-destinations","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.public","semantic":"route-set-completeness","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.public","semantic":"route-targets","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.public","semantic":"routes","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.public","semantic":"subnet-association-target","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"NOT_APPLICABLE","evidence_set":"ES-441dfcc70ea4"},{"unit":"module.vpc.module.vpc.aws_route_table.public","semantic":"tcr-route-table-vpc-id","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-441dfcc70ea4"}],"invariant_violations":[]},{"address":"module.vpc.module.vpc.aws_subnet.private","semantic_fingerprint":"4cc19bfb799a09d4b823938e06d6e88901c8f3001cf845b1850d9846ec62dc31","absent_claims":87,"claims":[{"unit":"module.vpc.module.vpc.aws_subnet.private","semantic":"availability-zone","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.private","semantic":"dns64","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.private","semantic":"ipv6","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.private","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.private","semantic":"prefix","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.private","semantic":"private-egress-ipv4","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.private","semantic":"subnet-vpc-membership","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.private","semantic":"tc-subnet-enable-resource-name-dns-a-record-on-launch","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.private","semantic":"tc-subnet-enable-resource-name-dns-aaaa-record-on-launch","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-a7b76f2847cd"}],"invariant_violations":[]},{"address":"module.vpc.module.vpc.aws_subnet.public","semantic_fingerprint":"fde0f7c549bd5f0c22b72ca20ade561a22027432fe95e9f35fab8316e6d645f2","absent_claims":85,"claims":[{"unit":"module.vpc.module.vpc.aws_subnet.public","semantic":"availability-zone","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.public","semantic":"dns64","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.public","semantic":"effective-route-table","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.public","semantic":"ipv6","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.public","semantic":"network-topology-boundary","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.public","semantic":"prefix","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.public","semantic":"private-egress-ipv4","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.public","semantic":"public-ip-on-launch","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.public","semantic":"subnet-vpc-membership","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.public","semantic":"tc-subnet-enable-resource-name-dns-a-record-on-launch","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-a7b76f2847cd"},{"unit":"module.vpc.module.vpc.aws_subnet.public","semantic":"tc-subnet-enable-resource-name-dns-aaaa-record-on-launch","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-a7b76f2847cd"}],"invariant_violations":[]}],"evidence_sets":[{"id":"ES-05cb9bc201d0","evidence":[{"kind":"TARGET_API_SPEC","ref":"https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/opensearch/v2/opensearch.json","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/elasticsearch_vpc_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/opensearch_authorize_vpc_endpoint_access","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/opensearch_domain_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/opensearch_domain_saml_options","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/opensearch_package_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/opensearch_vpc_endpoint","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/opensearch_credential","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/opensearch_instance","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.119.0/docs/resources/opensearch_credential","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.119.0/docs/resources/opensearch_instance","valid_from":"2026-09-24"}]},{"id":"ES-09f8dd69c07b","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-security-groups.html","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/cloudfront_multitenant_distribution","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ec2_traffic_mirror_target","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/globalaccelerator_cross_account_attachment","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/lb","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/verifiedaccess_endpoint","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpclattice_target_group_attachment","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/cloudfront_vpc_origin","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_traffic_mirror_target","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_vpc_endpoint_service","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/globalaccelerator_cross_account_attachment","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/globalaccelerator_endpoint_group","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/logs_delivery_source","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/wafv2_web_acl_association","valid_from":"2026-09-29"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://github.com/stackitcloud/terraform-provider-stackit/blob/main/docs/resources/application_load_balancer.md","valid_from":"2026-09-29"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/application_load_balancer","valid_from":"2026-09-29"}]},{"id":"ES-1a83ada574f5","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/eip","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/eip_domain_name","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/globalaccelerator_cross_account_attachment","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/nat_gateway_eip_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/elasticloadbalancingv2_load_balancer","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/globalaccelerator_cross_account_attachment","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/globalaccelerator_endpoint_group","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/public_ip","valid_from":"2026-09-24"}]},{"id":"ES-27233f66625d","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/mq_broker","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/pipes_pipe","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/pipes_pipe","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/rabbitmq_instance","valid_from":"2026-09-24"}]},{"id":"ES-2fdd43a9605d","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/appautoscaling_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/appautoscaling_scheduled_action","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/appautoscaling_target","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/appsync_datasource","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/dynamodb_contributor_insights","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/dynamodb_global_secondary_index","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/dynamodb_kinesis_streaming_destination","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/dynamodb_resource_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/dynamodb_table","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/dynamodb_table_export","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/dynamodb_table_item","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/dynamodb_table_replica","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/dynamodb_tag","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/pipes_pipe","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/applicationautoscaling_scalable_target","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/applicationautoscaling_scaling_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/appsync_data_source","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/dynamodb_backup","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/lambda_event_source_mapping","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/pipes_pipe","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/stepfunctions_state_machine","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/mongodbflex_instance","valid_from":"2026-09-24"}]},{"id":"ES-441dfcc70ea4","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/vpc/latest/userguide/route-table-options.html","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/route_table.html.markdown","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/vpc_endpoint.html.markdown","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/vpc_endpoint_route_table_association.html.markdown","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/v6.66.0/website/docs/r/vpn_gateway_route_propagation.html.markdown","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/main_route_table_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route_table_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpn_gateway_route_propagation","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_ip_pool_route_table_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_route_server_propagation","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_vpc_endpoint","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/network/core-networking/network-area/basics/routing-tables/","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://github.com/stackitcloud/terraform-provider-stackit/blob/main/README.md","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://github.com/stackitcloud/terraform-provider-stackit/blob/main/docs/data-sources/resourcemanager_project.md","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://github.com/stackitcloud/terraform-provider-stackit/blob/main/docs/resources/network.md","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://github.com/stackitcloud/terraform-provider-stackit/blob/main/docs/resources/resourcemanager_project.md","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://github.com/stackitcloud/terraform-provider-stackit/blob/main/docs/resources/routing_table.md","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://github.com/stackitcloud/terraform-provider-stackit/blob/main/docs/resources/vpc_routing_table.md","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/routing_table.md","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/network","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/routing_table","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/routing_table_route","valid_from":"2026-09-28"}]},{"id":"ES-6994962787dd","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/apprunner_vpc_ingress_connection","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/default_network_acl","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/default_route_table","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/default_security_group","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ec2_carrier_gateway","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/internet_gateway_attachment","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/main_route_table_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/network_acl_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/networkmanager_vpc_attachment","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/opensearchserverless_vpc_endpoint","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route53_resolver_config","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route53_resolver_dnssec_config","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route53_resolver_firewall_config","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route53profiles_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_block_public_access_exclusion","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_encryption_control","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_ipv4_cidr_block_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_ipv6_cidr_block_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_security_group_rules_exclusive","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_security_group_vpc_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpclattice_resource_gateway","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpclattice_service_network_vpc_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpclattice_target_group","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpn_gateway_route_propagation","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/apprunner_vpc_ingress_connection","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/autoscaling_launch_configuration","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_carrier_gateway","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_egress_only_internet_gateway","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_flow_log","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_local_gateway_route_table_vpc_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_network_acl","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_route_server_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_security_group","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_security_group_vpc_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_vpc_block_public_access_exclusion","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_vpc_encryption_control","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_vpc_endpoint","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_vpc_peering_connection","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_vpcdhcp_options_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/elasticloadbalancingv2_target_group","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/msk_vpc_connection","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/networkfirewall_firewall","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/networkfirewall_vpc_endpoint_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/networkmanager_vpc_attachment","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/route53_hosted_zone","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/route53profiles_profile_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/route53resolver_firewall_rule_group_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/route53resolver_resolver_config","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/route53resolver_resolver_dnssec_config","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/route53resolver_resolver_query_logging_config_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/route53resolver_resolver_rule_association","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/vpclattice_resource_gateway","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/vpclattice_service_network_vpc_association","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/network/core-networking/public-ip-address/how-tos/setup-ipv6-reachability/","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/network","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/routing_table","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/security_group","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.120.0/docs/resources/network_area_region","valid_from":"2026-09-28"},{"kind":"LIVE_TARGET_PROBE","ref":"tested on a STACKIT project on 2026-10-08","valid_from":"2026-09-28"},{"kind":"LIVE_TARGET_PROBE","ref":"tested on a STACKIT project on 2026-10-12","valid_from":"2026-09-28"}]},{"id":"ES-7b60f884ef30","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ebs_default_kms_key","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ebs_snapshot_copy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ebs_snapshot_import","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ecr_repository_creation_template","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/imagebuilder_component","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/imagebuilder_container_recipe","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/imagebuilder_distribution_configuration","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/imagebuilder_image_recipe","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/imagebuilder_workflow","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/kms_key","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/lambda_capacity_provider","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/verifiedaccess_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/verifiedaccess_group","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/verifiedaccess_trust_provider","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/apprunner_service","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_volume","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecr_repository","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecr_repository_creation_template","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecs_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/eks_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/imagebuilder_component","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/imagebuilder_container_recipe","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/imagebuilder_distribution_configuration","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/imagebuilder_image_recipe","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/imagebuilder_workflow","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/lambda_capacity_provider","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/lambda_event_source_mapping","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/proton_environment_template","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/proton_service_template","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/route53_key_signing_key","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/kms_key","valid_from":"2026-09-24"}]},{"id":"ES-841642b337d0","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ec2_network_insights_path","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/internet_gateway_attachment","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_vpc_gateway_attachment","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/network/core-networking/network-area/basics/routing-tables/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/stackitcloud/stackit-landing-zone/main/docs/architecture.md","valid_from":"2026-09-24"},{"kind":"LIVE_TARGET_PROBE","ref":"tested on a STACKIT project on 2026-10-10","valid_from":"2026-09-24"}]},{"id":"ES-8e3ddd52d6aa","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/apprunner_vpc_connector","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/dax_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/db_proxy_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/docdbelastic_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ecs_express_gateway_service","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ecs_task_set","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/elasticsearch_vpc_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/imagebuilder_infrastructure_configuration","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/lambda_capacity_provider","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/lambdacore_network_connector","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/memorydb_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/msk_replicator","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/msk_serverless_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/opensearch_vpc_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/opensearchserverless_vpc_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/osis_pipeline","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/osis_pipeline_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/redshiftserverless_endpoint_access","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/redshiftserverless_workgroup","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/security_group","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/synthetics_canary","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/timestreaminfluxdb_db_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/timestreaminfluxdb_db_instance","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/verifiedaccess_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_endpoint_security_group_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_security_group_rules_exclusive","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_security_group_vpc_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpclattice_resource_gateway","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpclattice_service_network_vpc_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/apigatewayv2_vpc_link","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/apprunner_vpc_connector","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/autoscaling_launch_configuration","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/batch_compute_environment","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/docdbelastic_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_instance","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_instance_connect_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_launch_template","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_network_interface","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_security_group_egress","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_security_group_ingress","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_verified_access_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_vpc_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecs_express_gateway_service","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecs_service","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecs_task_set","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/eks_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/elasticache_cache_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/elasticache_replication_group","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/elasticache_serverless_cache","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/elasticloadbalancing_load_balancer","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/elasticloadbalancingv2_load_balancer","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/imagebuilder_infrastructure_configuration","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/lambda_capacity_provider","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/lambda_network_connector","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/memorydb_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/msk_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/msk_replicator","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/msk_serverless_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/msk_vpc_connection","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/opensearchserverless_vpc_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/opensearchservice_domain","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/osis_pipeline","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/rds_db_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/rds_db_instance","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/rds_db_proxy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/rds_db_proxy_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/redshift_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/redshift_endpoint_access","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/redshiftserverless_workgroup","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/route53resolver_resolver_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/synthetics_canary","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/timestream_influx_db_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/timestream_influx_db_instance","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/vpclattice_resource_gateway","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/vpclattice_service_network_vpc_association","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/security_group_rule","valid_from":"2026-09-24"}]},{"id":"ES-94f243a64cab","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DockerVolumeConfiguration.html","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_EFSAuthorizationConfig.html","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_EFSVolumeConfiguration.html","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_Volume.html","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://kubernetes.io/docs/concepts/storage/volumes/","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/appautoscaling_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/appautoscaling_scheduled_action","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/appautoscaling_target","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ecs_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ecs_service","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/networkfirewall_container_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/applicationautoscaling_scalable_target","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/applicationautoscaling_scaling_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecs_service","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/events_rule","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/networkfirewall_container_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/scheduler_schedule","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/stepfunctions_state_machine","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/storage/file-storage/basics/limits/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/ske_cluster","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.119.0/docs/resources/sfs_export_policy","valid_from":"2026-09-24"},{"kind":"OTHER","ref":"https://docs.docker.com/engine/storage/volumes/","valid_from":"2026-09-24"}]},{"id":"ES-a7b76f2847cd","evidence":[{"kind":"TARGET_API_SPEC","ref":"https://github.com/stackitcloud/stackit-api-specifications/tree/main/services/iaas","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/apprunner_vpc_connector","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/dax_subnet_group","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/db_proxy_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/docdbelastic_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ec2_fleet","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ec2_subnet_cidr_reservation","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ecs_express_gateway_service","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ecs_task_set","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/elasticsearch_vpc_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/globalaccelerator_custom_routing_endpoint_group","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/imagebuilder_infrastructure_configuration","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/lambda_capacity_provider","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/lambdacore_network_connector","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/memorydb_subnet_group","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/msk_replicator","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/msk_serverless_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/networkmanager_connect_peer","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/networkmanager_device","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/networkmanager_vpc_attachment","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/opensearch_vpc_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/opensearchserverless_vpc_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/osis_pipeline","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/osis_pipeline_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/redshiftserverless_endpoint_access","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/redshiftserverless_workgroup","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/s3outposts_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/spot_fleet_request","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/subnet","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/synthetics_canary","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/timestreaminfluxdb_db_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/timestreaminfluxdb_db_instance","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/verifiedaccess_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_block_public_access_exclusion","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpc_endpoint_subnet_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpclattice_resource_gateway","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/apigatewayv2_vpc_link","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/apprunner_vpc_connector","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/autoscaling_auto_scaling_group","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/batch_compute_environment","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_ec2_fleet","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_flow_log","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_instance","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_instance_connect_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_launch_template","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_network_interface","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_route_server_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_spot_fleet","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_subnet_cidr_block","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_subnet_cidr_reservation","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_subnet_network_acl_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_verified_access_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_vpc_block_public_access_exclusion","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_vpc_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecs_express_gateway_service","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecs_service","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecs_task_set","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/eks_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/eks_fargate_profile","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/elasticloadbalancing_load_balancer","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/elasticloadbalancingv2_load_balancer","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/imagebuilder_infrastructure_configuration","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/lambda_capacity_provider","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/lambda_network_connector","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/msk_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/msk_replicator","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/msk_serverless_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/msk_vpc_connection","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/networkfirewall_firewall","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/networkfirewall_vpc_endpoint_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/networkmanager_connect_peer","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/networkmanager_device","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/networkmanager_vpc_attachment","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/route53resolver_resolver_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/s3outposts_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/synthetics_canary","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/vpclattice_resource_gateway","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/network","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/server","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/volume","valid_from":"2026-09-24"}]},{"id":"ES-b0690303f286","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","ref":"the STACKIT provider schema 0.119.0","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-instance-permissions.html","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ebs_snapshot_import","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ecr_pull_through_cache_rule","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ecr_pull_time_update_exclusion","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ecr_repository_creation_template","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ecs_express_gateway_service","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/eks_capability","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/iam_instance_profile","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/iam_role","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/imagebuilder_image","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/imagebuilder_image_pipeline","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/imagebuilder_lifecycle_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/lambda_capacity_provider","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/lambdacore_network_connector","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/lambdamicrovms_image","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/lambdamicrovms_microvm","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/rolesanywhere_profile","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/spot_fleet_request","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpclattice_auth_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpclattice_resource_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/applicationautoscaling_scalable_target","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/batch_compute_environment","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/batch_job_definition","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/directconnect_direct_connect_gateway_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/directconnect_private_virtual_interface","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/directconnect_public_virtual_interface","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/directconnect_transit_virtual_interface","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/dlm_lifecycle_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_enclave_certificate_iam_role_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_flow_log","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_spot_fleet","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecr_pull_through_cache_rule","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecr_pull_time_update_exclusion","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecr_repository_creation_template","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecs_express_gateway_service","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecs_task_definition","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/eks_addon","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/eks_capability","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/eks_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/eks_fargate_profile","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/eks_pod_identity_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/elasticbeanstalk_environment","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/iam_managed_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/imagebuilder_image","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/imagebuilder_image_pipeline","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/imagebuilder_lifecycle_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/lambda_capacity_provider","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/lambda_microvm_image","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/lambda_network_connector","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/proton_environment_account_connection","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/rolesanywhere_profile","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/custom-roles/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/platform/access-and-identity/service-accounts/authentication-flows/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/compute-engine/run-command/getting-started/enable-run-command-service/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/compute-engine/run-command/how-tos/api-enable-the-run-command-service/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/compute-engine/server-agent/getting-started/installing-server-agent-api/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/compute-engine/server/faq/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/compute-engine/server/how-tos/access-server-web-console/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/compute-engine/server/how-tos/attaching-service-account-to-servers/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/developer-platform/container-registry/how-tos/securing-access-with-role-based-access-control-_rbac_/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/storage/object-storage/how-tos/manage-bucket-policies/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/storage/object-storage/reference/supported-condition-operators-and-keys-in-bucket-policies/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/authorization_service_account_role_assignment","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/server_service_account_attach","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account","valid_from":"2026-09-24"},{"kind":"TARGET_RELEASE_NOTE","ref":"https://docs.stackit.cloud/products/compute-engine/server-agent/release-notes/","valid_from":"2026-09-24"},{"kind":"LIVE_TARGET_PROBE","ref":"tested on a STACKIT project on 2026-10-07","valid_from":"2026-09-24"}]},{"id":"ES-b1ccb27fcdc7","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/appautoscaling_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/appautoscaling_scheduled_action","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/appautoscaling_target","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/elasticache_global_replication_group","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/elasticache_replication_group","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/elasticache_serverless_cache","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/elasticache_serverless_cache_snapshot","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/valkey_instance","valid_from":"2026-09-24"}]},{"id":"ES-b23261b73c61","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/nat_gateway","valid_from":"2026-09-28"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/nat_gateway_eip_association","valid_from":"2026-09-28"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","valid_from":"2026-09-28"}]},{"id":"ES-be35bf0a9d87","evidence":[{"kind":"TARGET_API_SPEC","ref":"https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/mariadb/v1/mariadb.json","valid_from":"2026-09-24"},{"kind":"TARGET_API_SPEC","ref":"https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/mariadb/v2/mariadb.json","valid_from":"2026-09-24"},{"kind":"TARGET_API_SPEC","ref":"https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBCluster.html","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.CloudWatch.html","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/multi-az-db-clusters-concepts.html","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/appautoscaling_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/appautoscaling_scheduled_action","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/appautoscaling_target","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/cloudwatch_log_subscription_filter","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/db_cluster_snapshot","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/db_event_subscription","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/rds_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/rds_cluster_role_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/rds_global_cluster","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/rds_integration","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/rds_shard_group","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/verifiedaccess_endpoint","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpclattice_resource_configuration","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/rds_cluster_snapshot","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/rds_db_shard_group","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/vpclattice_resource_configuration","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/logging-and-monitoring/telemetry-router/basics/overview/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/mariadb_credential","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/postgresflex_instance","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/postgresflex_user","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.119.0/docs/resources/postgresflex_user","valid_from":"2026-09-24"}]},{"id":"ES-e45d2e1b3202","evidence":[{"kind":"TARGET_API_SPEC","ref":"https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/cloudwatch_log_anomaly_detector","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/cloudwatch_log_data_protection_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/cloudwatch_log_group","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/cloudwatch_log_index_policy","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/cloudwatch_log_metric_filter","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/cloudwatch_log_subscription_filter","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/cloudwatch_log_transformer","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/datasync_task","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/route53_query_log","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/storagegateway_gateway","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/verifiedaccess_instance_logging_configuration","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/vpclattice_access_log_subscription","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ec2_flow_log","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/logs_delivery_destination","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/logs_log_anomaly_detector","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/route53_hosted_zone","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/route53_query_logging_config","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/route53resolver_resolver_query_logging_config","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/vpclattice_access_log_subscription","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/logging-and-monitoring/logs/basics/core-features-and-use-cases-of-logs/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/logging-and-monitoring/telemetry-router/basics/overview/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/logs_instance","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.120.0/docs/resources/observability_logalertgroup","valid_from":"2026-09-24"}]},{"id":"ES-eae4310bd959","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/dx_macsec_key_association","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ecr_pull_through_cache_rule","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/imagebuilder_distribution_configuration","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/secretsmanager_tag","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/aws/6.66.0/docs/resources/ssm_parameter","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/batch_job_definition","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/awscc/1.103.0/docs/resources/ecr_pull_through_cache_rule","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/security/secrets-manager/","valid_from":"2026-09-24"}]}]}}