# Sovereignty and exitability

> PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.

Run `f6267c3f-2848-4aa5-89df-5fee8b15b3b9` · source digest `sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70`

Sovereignty is not residency, and this document is technical evidence and gaps. It does not certify legal compliance, and legal conclusions remain external.

## Requirement

Sovereignty requirement: NOT PROVIDED.

No sovereignty requirement was provided: no applications file gives a tier or constraints. It is not inferred from the location of the company or of the provider.

## The dimensions

Each dimension states the requirement, what the source shows, what the target is proposed to be, the delta, the evidence, what is unknown and the actions. A statement that reads NOT ASSESSED says that this build has no evidence for it; it is not a finding.

### Data location (`DATA_LOCATION`)

State: EVIDENCE REQUIRED. Requirement: NOT PROVIDED.

- Source: NOT ASSESSED: The location of the source resources is not read: this build computes no region or zone placement for the source.
- Target: STATED: Name resolution: stackit_network.vpc_vpc_private, stackit_network.vpc_vpc_public take the shared variable default_ipv4_nameservers, which defaults to the addresses of the STACKIT DNS Resolver (beta) in eu01 (192.214.161.53, 213.17.17.17, 188.34.111.111), so those name queries go to the resolver STACKIT operates and not to the public resolvers 1.1.1.1, 8.8.8.8 and 9.9.9.9 that STACKIT sets in a public project when none are given. The resolver is a beta product documented for workloads inside STACKIT (docs.stackit.cloud, DNS Resolver, Concepts); no check that it answers from these networks is made here, and who operates it and under which jurisdiction is not assessed here. The capability catalogue lists the STACKIT services of the draft as available in: eu01, eu02. That a service is available in a region is a fact about the service. Region assumed for pricing: eu01 (default; no input chose a region). The catalogue lists the service of 13 units there, but no input or profile has chosen the region, so no resource is tied to it.
- Delta: NOT ASSESSED: No source location is established, so no change of location is stated.
- Evidence: pointers into the JSON files, listed in assurance/sovereignty.json
- Unknown: The provider's own statement on data location is a statement of the provider with control shared: STACKIT states that the development of its cloud takes place in Germany, that its servers and data centers are located in Germany and Austria, and that its cloud operates in accordance with European data protection standards. It names no region id, so it does not tie any resource of the draft to a region.
- Unknown: Where backups, logs and replicas are stored is the subject of the backup chain and the telemetry chain.

### Jurisdiction chain (`JURISDICTION`)

State: NOT ASSESSED. Requirement: NOT PROVIDED.

- Source: NOT ASSESSED: The jurisdiction chain (the legal seat of the provider, of its owners and of its operators, and the legal reach over them) is not assessed. It is not a fact of the Terraform source or of the draft, and legal conclusions stay external.
- Target: NOT ASSESSED: No target state is stated: the source state is not established.
- Delta: NOT ASSESSED: No change is stated.
- Unknown: Which legal order applies to the provider, to its parent organisations and to its operators is a question for counsel, not for this build.

### Operator access (`OPERATOR_ACCESS`)

State: NOT ASSESSED. Requirement: NOT PROVIDED.

- Source: NOT ASSESSED: Who at the provider or at an operator can reach the resources and the data, and under which conditions, is not assessed. It is not a fact of the Terraform source or of the draft.
- Target: NOT ASSESSED: No target state is stated: the source state is not established.
- Delta: NOT ASSESSED: No change is stated.
- Unknown: The access model of the provider's staff and subcontractors is not a fact of the Terraform source.

### Key control (`KEY_CONTROL`)

State: EVIDENCE REQUIRED. Requirement: NOT PROVIDED.

- Source: STATED: A customer-managed key may be stated, but its value is not visible statically, on: module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch.
- Target: STATED: A customer-managed key is a separate setting that exists only where the source names a key: no platform encryption stands in for it, and whether the key management of the source is equivalent to the STACKIT key service is not established. Which target services of the draft can use a key of the customer is not established here.
- Delta: NOT ASSESSED: Whether key ownership changes is not established: the key of the source and the key of the target are not compared.
- Evidence: pointers into the JSON files, listed in assurance/sovereignty.json
- Unknown: Who holds the key material and who can use it on the target is not established.

### Identity chain (`IDENTITY_CHAIN`)

State: DECISION REQUIRED. Requirement: NOT PROVIDED.

- Source: STATED: The source names identities for its workloads or states them as units: module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this, module.retail_app_ecs.module.ui_service.aws_ecs_service.this.
- Target: STATED: The draft attaches a STACKIT service account to a server only where the identity plan attaches it exactly; every other attachment is stated as open. Where the draft writes a project role assignment (for an AWS role, machine user or IAM group it turns into service accounts or members), the role it grants is a variable the architect chooses, because an AWS action is not translated into a STACKIT role: the draft derives no role from the source.
- Delta: NOT ASSESSED: Whether the identity dependency changes is not established: the privilege delta and the external identity provider are not assessed.
- Evidence: pointers into the JSON files, listed in assurance/sovereignty.json
- Unknown: Whether an external identity provider is a dependency of the sign-in of people is not assessed.
- Unknown: The privilege delta between the source identities and the target roles is not assessed.
- Actions: the step "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.execution_role_arn-586451`), the step "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this gets…" (`MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.task_role_arn-686488`), the step "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.execution_role_arn-dedc98`), the step "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.task_role_arn-15a967`), the step "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.execution_role_arn-b70bc2`), the step "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.task_role_arn-9651e2`), the step "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.execution_role_arn-eacc48`), the step "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.task_role_arn-d0b927`), the step "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this pulls…" (`MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.execution_role_arn-2d22d2`), the step "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this gets…" (`MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.task_role_arn-0c66b7`)

### Telemetry chain (`TELEMETRY_CHAIN`)

State: NOT ASSESSED. Requirement: NOT PROVIDED.

- Source: NOT ASSESSED: No log sink of the source is read in this run. That is not a finding that no telemetry leaves the estate.
- Target: STATED: The draft writes log sources as STACKIT Logs instances. Where an export of the source goes is stated in the plan of the log source, not here.
- Delta: NOT ASSESSED: Whether the destination of the telemetry changes is not established.
- Evidence: capability:observability.logs
- Unknown: Where metrics, traces and agent telemetry go is not read by this build.

### Backup chain (`BACKUP_CHAIN`)

State: EVIDENCE REQUIRED. Requirement: NOT PROVIDED.

- Source: STATED: The contracts of the source observe a backup, retention or geo-replication setting on: module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.orders_rds.aws_rds_cluster.this.
- Target: NOT ASSESSED: Where the backups of the target are stored and who operates the destination is not stated by the draft or by this build.
- Delta: NOT ASSESSED: Whether the destination of the backups changes is not established.
- Evidence: pointers into the JSON files, listed in assurance/sovereignty.json
- Unknown: The destination of the backups and replicas, and the jurisdiction of that destination, are not assessed.

### Supply chain (`SUPPLY_CHAIN`)

State: OBSERVED. Requirement: NOT PROVIDED.

- Source: STATED: The source records these Terraform providers, required by its configuration or locked in its lock file: aws, random.
- Target: STATED: The draft is written for the STACKIT provider 0.121.0.
- Delta: NOT ASSESSED: Whether the supply chain of the estate changes is not established.
- Evidence: pointers into the JSON files, listed in assurance/sovereignty.json
- Unknown: The registries and the build chain of the providers, and the provenance of the modules the source calls, are not assessed.

### Third-party processing (`THIRD_PARTY_PROCESSING`)

State: EVIDENCE REQUIRED. Requirement: NOT PROVIDED.

- Source: STATED: The source depends on providers or resource types the knowledge base holds no schema of: provider random.
- Target: NOT ASSESSED: The draft names no STACKIT counterpart for these dependencies.
- Delta: NOT ASSESSED: Whether a third party processes the data after the move is not established.
- Evidence: pointers into the JSON files, listed in assurance/sovereignty.json
- Unknown: What data a third-party provider or service handles is not read from the Terraform source.

### Open interfaces (`OPEN_INTERFACES`)

State: NOT ASSESSED. Requirement: NOT PROVIDED.

- Source: NOT ASSESSED: Whether the interfaces the source depends on are open standards and whether the target keeps them is not assessed.
- Target: NOT ASSESSED: No target state is stated: the source state is not established.
- Delta: NOT ASSESSED: No change is stated.
- Unknown: Which of the interfaces the source uses are proprietary is not read.

### Data portability (`DATA_PORTABILITY`)

State: NOT ASSESSED. Requirement: NOT PROVIDED.

- Source: NOT ASSESSED: Whether the data can be exported in a documented format, and by which path, is not assessed.
- Target: NOT ASSESSED: No target state is stated: the source state is not established.
- Delta: NOT ASSESSED: No change is stated.
- Unknown: How the data of each stateful unit leaves its service is not read.

### Application coupling (`APPLICATION_COUPLING`)

State: NOT ASSESSED. Requirement: NOT PROVIDED.

- Source: NOT ASSESSED: The coupling of application code to the interfaces of the source (SDKs, proprietary protocols) is not assessed: the application code is not scanned.
- Target: NOT ASSESSED: No target state is stated: the source state is not established.
- Delta: NOT ASSESSED: No change is stated.
- Unknown: Which SDKs and protocols the application code uses is not read.

### Exitability (`EXITABILITY`)

State: OBSERVED. Requirement: NOT PROVIDED.

- Source: NOT ASSESSED: The interface, data format, code coupling, replacement complexity, extraction path and alternatives of the source's dependencies are not assessed.
- Target: STATED: The draft is provider-specific Terraform for the STACKIT provider; that is the only exit fact stated, and it is listed per dependency in the exitability entries.
- Delta: NOT ASSESSED: No change of exit cost is stated: no cost, no duration and no complexity is estimated.
- Unknown: Every field of the exitability model but the Terraform coupling is not assessed, so no exit path is proven and none is ruled out.

## Dependencies

The dependencies of the source and what the draft makes of them (source to target). A dependency REPLACED is a unit the knowledge base maps to a STACKIT service; RETAINED is a provider or source type the knowledge base does not know, for which the draft names no counterpart.

| Source | Source type | Target service | Change | Dimensions |
|---|---|---|---|---|
| provider:random | source provider |  | RETAINED | SUPPLY_CHAIN, THIRD_PARTY_PROCESSING |
| module.dependencies.aws_mq_broker.mq | aws_mq_broker | STACKIT RabbitMQ | REPLACED | DATA_LOCATION, EXITABILITY |
| module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | aws_opensearch_domain | STACKIT OpenSearch | REPLACED | DATA_LOCATION, EXITABILITY |
| module.dependencies.module.catalog_rds.aws_rds_cluster.this | aws_rds_cluster | STACKIT MariaDB | REPLACED | DATA_LOCATION, BACKUP_CHAIN, EXITABILITY |
| module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | aws_elasticache_replication_group | STACKIT Key Value Store (Valkey) | REPLACED | DATA_LOCATION, EXITABILITY |
| module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | aws_dynamodb_table | STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | REPLACED | DATA_LOCATION, EXITABILITY |
| module.dependencies.module.orders_rds.aws_rds_cluster.this | aws_rds_cluster | STACKIT PostgreSQL Flex | REPLACED | DATA_LOCATION, BACKUP_CHAIN, EXITABILITY |
| module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | aws_cloudwatch_log_group | STACKIT Logs | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.aws_ecs_cluster.cluster | aws_ecs_cluster | STACKIT Kubernetes Engine (SKE) | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.aws_kms_key.cmk | aws_kms_key | STACKIT KMS | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | aws_secretsmanager_secret | STACKIT Secrets Manager | REPLACED | DATA_LOCATION, KEY_CONTROL, EXITABILITY |
| module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | aws_secretsmanager_secret | STACKIT Secrets Manager | REPLACED | DATA_LOCATION, KEY_CONTROL, EXITABILITY |
| module.retail_app_ecs.aws_secretsmanager_secret.mq | aws_secretsmanager_secret | STACKIT Secrets Manager | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.aws_secretsmanager_secret.orders_db | aws_secretsmanager_secret | STACKIT Secrets Manager | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.alb.aws_lb.this | aws_lb | STACKIT Application Load Balancer | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.alb.aws_security_group.this | aws_security_group | STACKIT security group | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | aws_security_group | STACKIT security group | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.carts_service.aws_ecs_service.this | aws_ecs_service | STACKIT Kubernetes Engine (SKE) | REPLACED | DATA_LOCATION, IDENTITY_CHAIN, EXITABILITY |
| module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role | aws_iam_role | STACKIT service account for the workload | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.carts_service.aws_iam_role.task_role | aws_iam_role | STACKIT service account for the workload | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.carts_service.aws_security_group.this | aws_security_group | STACKIT security group | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | aws_ecs_service | STACKIT Kubernetes Engine (SKE) | REPLACED | DATA_LOCATION, IDENTITY_CHAIN, EXITABILITY |
| module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role | aws_iam_role | STACKIT service account for the workload | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role | aws_iam_role | STACKIT service account for the workload | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.catalog_service.aws_security_group.this | aws_security_group | STACKIT security group | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | aws_ecs_service | STACKIT Kubernetes Engine (SKE) | REPLACED | DATA_LOCATION, IDENTITY_CHAIN, EXITABILITY |
| module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role | aws_iam_role | STACKIT service account for the workload | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role | aws_iam_role | STACKIT service account for the workload | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.checkout_service.aws_security_group.this | aws_security_group | STACKIT security group | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.orders_service.aws_ecs_service.this | aws_ecs_service | STACKIT Kubernetes Engine (SKE) | REPLACED | DATA_LOCATION, IDENTITY_CHAIN, EXITABILITY |
| module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role | aws_iam_role | STACKIT service account for the workload | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.orders_service.aws_iam_role.task_role | aws_iam_role | STACKIT service account for the workload | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.orders_service.aws_security_group.this | aws_security_group | STACKIT security group | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.ui_service.aws_ecs_service.this | aws_ecs_service | STACKIT Kubernetes Engine (SKE) | REPLACED | DATA_LOCATION, IDENTITY_CHAIN, EXITABILITY |
| module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role | aws_iam_role | STACKIT service account for the workload | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.ui_service.aws_iam_role.task_role | aws_iam_role | STACKIT service account for the workload | REPLACED | DATA_LOCATION, EXITABILITY |
| module.retail_app_ecs.module.ui_service.aws_security_group.this | aws_security_group | STACKIT security group | REPLACED | DATA_LOCATION, EXITABILITY |
| module.vpc.module.vpc.aws_vpc.this | aws_vpc | STACKIT project networking / Network Area (SNA) | REPLACED | DATA_LOCATION, EXITABILITY |

## Exitability

For each target dependency the model asks for the interface, the data format, the provider-specific code, the Terraform dependency, the replacement complexity, the data extraction path, the alternative implementation and the exit evidence. The only field this build states is the Terraform dependency: the draft is a provider-specific Terraform draft. No cost, duration or complexity is estimated.

| Source | Target service | State | Terraform dependency | Every other field of the model |
|---|---|---|---|---|
| module.dependencies.aws_mq_broker.mq | STACKIT RabbitMQ | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | STACKIT OpenSearch | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.dependencies.module.catalog_rds.aws_rds_cluster.this | STACKIT MariaDB | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | STACKIT Key Value Store (Valkey) | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.dependencies.module.orders_rds.aws_rds_cluster.this | STACKIT PostgreSQL Flex | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | STACKIT Logs | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.aws_ecs_cluster.cluster | STACKIT Kubernetes Engine (SKE) | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.aws_kms_key.cmk | STACKIT KMS | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | STACKIT Secrets Manager | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | STACKIT Secrets Manager | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.aws_secretsmanager_secret.mq | STACKIT Secrets Manager | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.aws_secretsmanager_secret.orders_db | STACKIT Secrets Manager | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.alb.aws_lb.this | STACKIT Application Load Balancer | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.alb.aws_security_group.this | STACKIT security group | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | STACKIT security group | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.carts_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.carts_service.aws_iam_role.task_role | STACKIT service account for the workload | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.carts_service.aws_security_group.this | STACKIT security group | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role | STACKIT service account for the workload | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.catalog_service.aws_security_group.this | STACKIT security group | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role | STACKIT service account for the workload | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.checkout_service.aws_security_group.this | STACKIT security group | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.orders_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.orders_service.aws_iam_role.task_role | STACKIT service account for the workload | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.orders_service.aws_security_group.this | STACKIT security group | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.ui_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.ui_service.aws_iam_role.task_role | STACKIT service account for the workload | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.retail_app_ecs.module.ui_service.aws_security_group.this | STACKIT security group | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |
| module.vpc.module.vpc.aws_vpc.this | STACKIT project networking / Network Area (SNA) | PROVIDER SPECIFIC | PROVIDER SPECIFIC | NOT ASSESSED |

## Open decisions

- Data location: EVIDENCE REQUIRED
- Key control: EVIDENCE REQUIRED
- Identity chain: DECISION REQUIRED
- Backup chain: EVIDENCE REQUIRED
- Third-party processing: EVIDENCE REQUIRED

## Limits

- Legal conclusions remain external. The block provides technical evidence and gaps and does not certify legal compliance.
- Sovereignty is not residency: a region of a service is a fact about the service, never a statement about the sovereignty of a workload.
- There is no score, no percentage and no count in this block, and no dimension is compared with a requirement in this build.
- Jurisdiction, operator access, open interfaces, data portability and application coupling are not assessed, and every field of the exitability model but the Terraform coupling is not assessed.
- Dependencies are the units the knowledge base maps to a STACKIT service, the source providers the knowledge base holds no schema of and the source types it does not know. A dependency the draft introduces without a source unit is not listed, and a unit with no STACKIT resource is not listed as removed.

The block as data, with the pointers of the evidence, is in assurance/sovereignty.json.