# Operational readiness

> PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.

Run `f6267c3f-2848-4aa5-89df-5fee8b15b3b9` · source digest `sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70`

Terraform generated is not workload ready: 1 of 44 units carry open workload items.

Units that count in the totals: 44; entries not measured because their existence is decided when OpenTofu plans: 49; units where a dimension applies: 7; with open items: 1; needing input: 0; waiting for a decision: 0; blocking: 0; compute units without evidence: 6.

## The dimensions

### Bootstrap configuration

How is the workload installed on this unit?

| State | Units |
|---|---|
| DECISION REQUIRED | 0 |
| EVIDENCE REQUIRED | 0 |
| READY WITH ACTIONS | 0 |
| NOT ASSESSED | 6 |
| NOT APPLICABLE | 38 |

A unit without evidence on this dimension is NOT ASSESSED: StackToIT cannot see how the workload is installed: no provisioner block, user data or startup script was observed on the unit.

### Source artifacts

Which files do the unit's attributes or its bootstrap read that the scan did not find?

| State | Units |
|---|---|
| DECISION REQUIRED | 0 |
| EVIDENCE REQUIRED | 0 |
| READY WITH ACTIONS | 0 |
| NOT ASSESSED | 6 |
| NOT APPLICABLE | 38 |

A unit without evidence on this dimension is NOT ASSESSED: No file the unit depends on was listed as missing, unreadable or unresolved; that does not establish that the scripts and templates are the right ones.

### Target preconditions

What must exist on STACKIT before a resource of the draft works?

| State | Units |
|---|---|
| DECISION REQUIRED | 0 |
| EVIDENCE REQUIRED | 0 |
| READY WITH ACTIONS | 1 |
| NOT ASSESSED | 6 |
| NOT APPLICABLE | 37 |

A unit without evidence on this dimension is NOT ASSESSED: No plan manual action of the kind target precondition names the unit in this build.

### Cutover

What must be true before the cutover?

| State | Units |
|---|---|
| DECISION REQUIRED | 0 |
| EVIDENCE REQUIRED | 0 |
| READY WITH ACTIONS | 1 |
| NOT ASSESSED | 6 |
| NOT APPLICABLE | 37 |

A unit without evidence on this dimension is NOT ASSESSED: This build reads the cutover from two things only: the DNS endpoint reading (a record whose address the draft re-binds to a generated resource carries the cutover requirement; an A or AAAA record whose address is not bound to one needs evidence) and the manual actions of the plan that are due before the cutover. A unit none of them names is not assessed, which is not ready.

### Day 2 operations

What do the plans ask after the move?

| State | Units |
|---|---|
| DECISION REQUIRED | 0 |
| EVIDENCE REQUIRED | 0 |
| READY WITH ACTIONS | 0 |
| NOT ASSESSED | 6 |
| NOT APPLICABLE | 38 |

A unit without evidence on this dimension is NOT ASSESSED: No plan manual action due on day 2 or for optimisation names the unit in this build.

## Dimensions this build does not state

- **IAM:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **WIF:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **Audit logs:** NOT ASSESSED — the draft creates and configures no audit log: the record of administrative activity is a platform fact, not something the draft made. STACKIT Audit Log (capability registry security.audit-log): The platform-wide record of administrative activity (who called which API in an organisation, folder or project): on by default, 90 days of history in the Portal, readable with the audit-log.reader role, routed onward with the Telemetry Router. It records API calls, not the resulting configuration. No Terraform resource enables or configures it. A Telemetry Router destination is drafted for a source CloudTrail trail with logging on; the router takes the Audit Logs of STACKIT products only, so none is drafted for a CloudWatch metric stream or log delivery destination; the link that makes the router receive the project's audit events is not drafted, a person sets it up; the legacy Audit Log API was decommissioned on 2026-06-02, and the Telemetry Router is the way to take the log out.
- **Application logs:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **Metrics:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **Traces:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **Alerts:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **Backup:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **Restore:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **DR:** NOT ASSESSED — this build states nothing about it; business recovery objectives (RTO, RPO) are not provided to this build
- **Patching:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **Upgrade lifecycle:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **Support:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **Quota monitoring:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **Incident handling:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **Capacity:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **Cost allocation:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **Security posture:** NOT ASSESSED — the draft does not enable it and the provider has no resource for it: CSPM is a platform fact, not something the draft made. STACKIT Cloud Security Posture Management (capability registry security.posture-management): Managed security posture management (assessment of a project against fixed benchmarks): STACKIT Cloud Security Posture Management, a Portal service (generally available since 2026-10-05; enabled in the Portal or through the Service Enablement API) whose documented API reference is labelled v1beta, with no Terraform resource. It shows a project-level dashboard with a scan every 24 hours and offers no alerting. Managed threat detection is not part of it. It scans against BSI C5, ISO 27000 and the STACKIT standard. Where the estate has AWS Config or Security Hub rules they are not carried: a person enables CSPM and maps the controls.
- **Secrets:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- **Runbook ownership:** NOT ASSESSED — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure

## Limits

- A generated Terraform resource does not mark these ready: no dimension is ready in this build, and a unit without evidence is not assessed, never ready.
- A state is read from a typed fact of the assessment or of a plan (an open critical semantic, an observed bootstrap, a source artifact the scan did not find, a manual action with its kind and phase); nothing is inferred from a resource name.
- A compute unit is a unit of the catalogue category compute; every other unit applies to a dimension only where a typed fact concerns it.
- The cutover requirement is read for the DNS records of this build only (the re-bound address of an Elastic IP, or an address record with no endpoint binding) and for the manual actions of the plan due before the cutover; the cutover of any other endpoint (load balancer, certificate, allow-list) is not read by this build. StackToIT applies no cutover and the requirement does not change a unit's class, confidence or eligibility.

## Support options

Options read from: STACKIT support plans (https://docs.stackit.cloud/support/plans/), judged as of 2026-11-02.

| Support option | Freshness of the evidence |
|---|---|
| Essential Support | FRESH |
| Advanced Support | FRESH |
| Ultimate Support | FRESH |

- ESTATE: NOT ASSESSED. No criticality stated; pass --applications to state criticality and explicit support requirements