# Target readiness

> PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.

Run `f6267c3f-2848-4aa5-89df-5fee8b15b3b9` · source digest `sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70`

Target profile: Stable network model: the experimental STACKIT VPC resources are not used. STACKIT provider 0.121.0, knowledge base 0.384.0.

## The catalogue

83 units state a target and 10 units state none. Of those that state one, 67 are matched by a capability row of the catalogue, 0 partly, 2 by no row although the STACKIT provider has every one of their resource types (the capability metadata is incomplete), 0 by no row with a type the provider schema does not have, and 14 need no STACKIT resource. No row is a gap in the catalogue, not an unsupported target.

- KNOWN_PRESENT: 44 state a target (37 matched, 0 partly, 0 metadata incomplete, 0 type not in the provider schema, 7 need no STACKIT resource), 0 state none
- CONDITIONAL: 8 state a target (4 matched, 0 partly, 0 metadata incomplete, 0 type not in the provider schema, 4 need no STACKIT resource), 0 state none
- KNOWN_ABSENT: 31 state a target (26 matched, 0 partly, 2 metadata incomplete, 0 type not in the provider schema, 3 need no STACKIT resource), 10 state none

STACKIT resource types of the targets that no capability row lists:

- `stackit_dns_record_set`: 1 unit, RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED: The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete. Functional parity NOT_ASSESSED.
- `stackit_vpn_connection`: 1 unit, RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED: The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete. Functional parity NOT_ASSESSED.
- `stackit_vpn_gateway`: 1 unit, RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED: The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete. Functional parity NOT_ASSESSED.

## The targets of the units

| Unit | STACKIT service | Resources | Maturity | Lifecycle | Lifecycle state | Catalogue | Regions |
|---|---|---|---|---|---|---|---|
| module.dependencies.aws_mq_broker.mq | STACKIT RabbitMQ | stackit_rabbitmq_instance, stackit_rabbitmq_credential | ga | active |  | MATCHED | eu01, eu02 |
| module.dependencies.aws_security_group.catalog_opensearch_sg | not written by this draft (stackit_security_group, stackit_security_group_rule) |  |  |  |  | NOT_APPLICABLE |  |
| module.dependencies.aws_security_group.mq | not written by this draft (stackit_security_group, stackit_security_group_rule) |  |  |  |  | NOT_APPLICABLE |  |
| module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this | switched off (for_each = 0) — would map to STACKIT Logs if switched on | stackit_logs_instance, stackit_logs_access_token | ga | active |  | MATCHED |  |
| module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_resource_policy.this | switched off (count = 0) — would map to STACKIT Logs access tokens if switched on | stackit_logs_access_token | ga | active |  | MATCHED |  |
| module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | STACKIT OpenSearch | stackit_opensearch_instance, stackit_opensearch_credential | ga | active |  | MATCHED | eu01, eu02 |
| module.dependencies.module.catalog_opensearch.aws_security_group.this | switched off (count = 0) — would map to STACKIT security group if switched on | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this | switched off (for_each = 0) — would map to STACKIT Logs if switched on | stackit_logs_instance, stackit_logs_access_token | ga | active |  | MATCHED |  |
| module.dependencies.module.catalog_rds.aws_rds_cluster.this | STACKIT MariaDB | stackit_mariadb_instance | ga | active |  | MATCHED | eu01, eu02 |
| module.dependencies.module.catalog_rds.aws_security_group.this | not written by this draft (stackit_security_group, stackit_security_group_rule) |  |  |  |  | NOT_APPLICABLE |  |
| module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu | switched off (count = 0) — would map to STACKIT Observability alert rules if switched on | stackit_observability_instance, stackit_observability_alertgroup | ga | active |  | MATCHED | eu01 |
| module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory | switched off (count = 0) — would map to STACKIT Observability alert rules if switched on | stackit_observability_instance, stackit_observability_alertgroup | ga | active |  | MATCHED | eu01 |
| module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | STACKIT Key Value Store (Valkey) | stackit_valkey_instance, stackit_valkey_credential | ga | active |  | MATCHED | eu01, eu02 |
| module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd | not written by this draft (stackit_security_group, stackit_security_group_rule) |  |  |  |  | NOT_APPLICABLE |  |
| module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default | switched off (count = 0) — would map to STACKIT security group if switched on | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default | switched off (count = 0) — would map to STACKIT DNS record set if switched on | stackit_dns_record_set | ga | active |  | RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED |  |
| module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled | switched off (count = 0) — would map to STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) if switched on | stackit_mongodbflex_instance | ga | active |  | MATCHED | eu01, eu02 |
| module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore | switched off (count = 0) — would map to STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) if switched on | stackit_mongodbflex_instance | ga | active |  | MATCHED | eu01, eu02 |
| module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | stackit_mongodbflex_instance | ga | active |  | MATCHED | eu01, eu02 |
| module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this | switched off (for_each = 0) — would map to STACKIT Logs if switched on | stackit_logs_instance, stackit_logs_access_token | ga | active |  | MATCHED |  |
| module.dependencies.module.orders_rds.aws_rds_cluster.this | STACKIT PostgreSQL Flex | stackit_postgresflex_instance | ga | active |  | MATCHED | eu01, eu02 |
| module.dependencies.module.orders_rds.aws_security_group.this | not written by this draft (stackit_security_group, stackit_security_group_rule) |  |  |  |  | NOT_APPLICABLE |  |
| module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events | none managed — application events over RabbitMQ |  |  |  |  | NOT_APPLICABLE |  |
| module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights | STACKIT Logs | stackit_logs_instance, stackit_logs_access_token | ga | active |  | MATCHED |  |
| module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | STACKIT Logs | stackit_logs_instance, stackit_logs_access_token | ga | active |  | MATCHED |  |
| module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs | STACKIT Logs access tokens | stackit_logs_access_token | ga | active |  | MATCHED |  |
| module.retail_app_ecs.aws_ecs_cluster.cluster | STACKIT Kubernetes Engine (SKE) | stackit_ske_cluster | ga | active | GA | MATCHED | eu01, eu02 |
| module.retail_app_ecs.aws_kms_key.cmk | STACKIT KMS | stackit_kms_keyring, stackit_kms_key | ga | active |  | MATCHED |  |
| module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | STACKIT Secrets Manager | stackit_secretsmanager_instance, stackit_secretsmanager_user | ga | active |  | MATCHED |  |
| module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | STACKIT Secrets Manager | stackit_secretsmanager_instance, stackit_secretsmanager_user | ga | active |  | MATCHED |  |
| module.retail_app_ecs.aws_secretsmanager_secret.mq | STACKIT Secrets Manager | stackit_secretsmanager_instance, stackit_secretsmanager_user | ga | active |  | MATCHED |  |
| module.retail_app_ecs.aws_secretsmanager_secret.orders_db | STACKIT Secrets Manager | stackit_secretsmanager_instance, stackit_secretsmanager_user | ga | active |  | MATCHED |  |
| module.retail_app_ecs.module.alb.aws_lb.this | STACKIT Application Load Balancer | stackit_application_load_balancer, stackit_alb_certificate | ga | active |  | MATCHED | eu01, eu02 |
| module.retail_app_ecs.module.alb.aws_security_group.this | STACKIT security group | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.retail_app_ecs.module.alb_sg.aws_security_group.this | switched off (count = 0) — would map to STACKIT security group if switched on | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | STACKIT security group | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.retail_app_ecs.module.carts_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | stackit_ske_cluster | ga | active | GA | MATCHED | eu01, eu02 |
| module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | stackit_service_account, stackit_service_account_key, stackit_authorization_project_role_assignment | experimental | active |  | MATCHED |  |
| module.retail_app_ecs.module.carts_service.aws_iam_role.task_role | STACKIT service account for the workload | stackit_service_account, stackit_service_account_key, stackit_authorization_project_role_assignment | experimental | active |  | MATCHED |  |
| module.retail_app_ecs.module.carts_service.aws_security_group.this | STACKIT security group | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | stackit_ske_cluster | ga | active | GA | MATCHED | eu01, eu02 |
| module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | stackit_service_account, stackit_service_account_key, stackit_authorization_project_role_assignment | experimental | active |  | MATCHED |  |
| module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role | STACKIT service account for the workload | stackit_service_account, stackit_service_account_key, stackit_authorization_project_role_assignment | experimental | active |  | MATCHED |  |
| module.retail_app_ecs.module.catalog_service.aws_security_group.this | STACKIT security group | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | stackit_ske_cluster | ga | active | GA | MATCHED | eu01, eu02 |
| module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | stackit_service_account, stackit_service_account_key, stackit_authorization_project_role_assignment | experimental | active |  | MATCHED |  |
| module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role | STACKIT service account for the workload | stackit_service_account, stackit_service_account_key, stackit_authorization_project_role_assignment | experimental | active |  | MATCHED |  |
| module.retail_app_ecs.module.checkout_service.aws_security_group.this | STACKIT security group | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.retail_app_ecs.module.orders_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | stackit_ske_cluster | ga | active | GA | MATCHED | eu01, eu02 |
| module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | stackit_service_account, stackit_service_account_key, stackit_authorization_project_role_assignment | experimental | active |  | MATCHED |  |
| module.retail_app_ecs.module.orders_service.aws_iam_role.task_role | STACKIT service account for the workload | stackit_service_account, stackit_service_account_key, stackit_authorization_project_role_assignment | experimental | active |  | MATCHED |  |
| module.retail_app_ecs.module.orders_service.aws_security_group.this | STACKIT security group | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.retail_app_ecs.module.ui_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | stackit_ske_cluster | ga | active | GA | MATCHED | eu01, eu02 |
| module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | stackit_service_account, stackit_service_account_key, stackit_authorization_project_role_assignment | experimental | active |  | MATCHED |  |
| module.retail_app_ecs.module.ui_service.aws_iam_role.task_role | STACKIT service account for the workload | stackit_service_account, stackit_service_account_key, stackit_authorization_project_role_assignment | experimental | active |  | MATCHED |  |
| module.retail_app_ecs.module.ui_service.aws_security_group.this | STACKIT security group | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log | switched off (count = 0) — would map to STACKIT Logs if switched on | stackit_logs_instance, stackit_logs_access_token | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_default_vpc.this | switched off (count = 0) — would map to STACKIT project networking / Network Area (SNA) if switched on | stackit_network_area, stackit_network | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_eip.nat | implicit (belongs to the NAT gateway) |  |  |  |  | NOT_APPLICABLE |  |
| module.vpc.module.vpc.aws_flow_log.this | switched off (count = 0) — would map to none - no packet-flow log: a capture on the servers whose records a log shipper sends to a STACKIT Logs instance is a design of its own if switched on |  |  |  |  | NOT_APPLICABLE |  |
| module.vpc.module.vpc.aws_internet_gateway.this | implicit (STACKIT network default gateway) |  |  |  |  | NOT_APPLICABLE |  |
| module.vpc.module.vpc.aws_nat_gateway.this | implicit outbound (STACKIT network) |  |  |  |  | NOT_APPLICABLE |  |
| module.vpc.module.vpc.aws_network_acl.database | switched off (count = 0) — would map to STACKIT security groups (no stateless NACLs) if switched on | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_network_acl.elasticache | switched off (count = 0) — would map to STACKIT security groups (no stateless NACLs) if switched on | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_network_acl.intra | switched off (count = 0) — would map to STACKIT security groups (no stateless NACLs) if switched on | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_network_acl.outpost | switched off (count = 0) — would map to STACKIT security groups (no stateless NACLs) if switched on | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_network_acl.private | switched off (count = 0) — would map to STACKIT security groups (no stateless NACLs) if switched on | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_network_acl.public | switched off (count = 0) — would map to STACKIT security groups (no stateless NACLs) if switched on | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_network_acl.redshift | switched off (count = 0) — would map to STACKIT security groups (no stateless NACLs) if switched on | stackit_security_group, stackit_security_group_rule | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_route_table.private | implicit (STACKIT network default routing) |  |  |  |  | NOT_APPLICABLE |  |
| module.vpc.module.vpc.aws_route_table.public | implicit (STACKIT network default routing) |  |  |  |  | NOT_APPLICABLE |  |
| module.vpc.module.vpc.aws_subnet.database | switched off (count = 0) — would map to STACKIT network if switched on | stackit_network | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_subnet.elasticache | switched off (count = 0) — would map to STACKIT network if switched on | stackit_network | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_subnet.intra | switched off (count = 0) — would map to STACKIT network if switched on | stackit_network | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_subnet.outpost | switched off (count = 0) — would map to STACKIT network if switched on | stackit_network | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_subnet.private | STACKIT network | stackit_network | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_subnet.public | STACKIT network | stackit_network | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_subnet.redshift | switched off (count = 0) — would map to STACKIT network if switched on | stackit_network | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_vpc.this | STACKIT project networking / Network Area (SNA) | stackit_network_area, stackit_network | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this | switched off (for_each = 0) — would map to none - no account guardrail to except a VPC or subnet from if switched on |  |  |  |  | NOT_APPLICABLE |  |
| module.vpc.module.vpc.aws_vpc_block_public_access_options.this | switched off (count = 0) — would map to none - no account guardrail; exposure is set by security groups and by who may attach public IPs if switched on |  |  |  |  | NOT_APPLICABLE |  |
| module.vpc.module.vpc.aws_vpc_dhcp_options.this | switched off (count = 0) — would map to STACKIT network DNS settings if switched on | stackit_network | ga | active |  | MATCHED |  |
| module.vpc.module.vpc.aws_vpn_gateway.this | switched off (count = 0) — would map to STACKIT VPN if switched on | stackit_vpn_gateway, stackit_vpn_connection | ga | active |  | RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED |  |

## Readiness dimensions

| Dimension | Coverage state | Migration decisions | Target validation | Blockers | Open decisions | Detail |
|---|---|---|---|---|---|---|
| Source Fidelity | PARTLY COVERED | BLOCKERS OPEN | NOT APPLICABLE | 1 | n/a | For some units, whether and how many times they exist is decided only when OpenTofu plans. |
| Semantic Accounting | COVERED | BLOCKERS OPEN | NOT APPLICABLE | 43 | n/a | Accounted for is not decided. Covered means every unit has a semantic contract and no critical setting is unaccounted; it does not mean the settings are decided, so the blockers still count the 43 units that leave one for a person. 0 units have no semantic contract; 0 units leave a critical setting unaccounted; 43 units leave one for a person to review (accounted for, not decided). A blocker here is a unit that does either of the last two. |
| Critical Resolution | PARTLY COVERED | BLOCKERS OPEN | NOT APPLICABLE | 43 | n/a | 36 of 319 critical settings are resolved; 43 units hold an open one (accounted for, not decided); 0 units have no semantic contract. A blocker here is a unit that does either. |
| Target Functional Fit | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | n/a | n/a | Not assessed in this build. |
| Target Operability | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | n/a | n/a | Not assessed in this build. |
| Terraform Draft Accounting | NOT COVERED | BLOCKERS OPEN | STATIC CHECKS PASSED | 44 | n/a | Not a validation. This counts only whether each unit's critical settings are accounted for in the draft; it does not mean the draft validates, plans or applies against STACKIT, and even the coverage state Covered would not mean it. |
| Security | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | n/a | n/a | Not assessed in this build. |
| Reliability / Resilience | NOT COVERED | BLOCKERS OPEN | NOT VALIDATED | 6 | 0 | 6 units state a failure-domain, replication or backup fact or hold state. 6 units have no RTO or RPO the customer wrote to decide against, and 0 units have one and wait for a person to choose its resilience intent. No unit is called resilient and no intent is chosen: the source states none, and the availability-zone and metro facts of the target are not assessed. |
| Operational Readiness | PARTLY COVERED | NO OPEN ITEMS | NOT VALIDATED | 0 | 0 | Terraform generated is not workload ready: 1 of 44 units carry open workload items. 0 units need a decision or evidence from a person (0 of them a decision; 0 block a readiness claim, a cutover decision being a migration operation and not a blocker); 6 compute units have no workload evidence in this build. The 20 dimensions of the amendment's operational readiness (identity, logs, backup, DR, support and the rest) are not assessed. A generated Terraform resource does not mark any of them ready. |
| Sovereignty & Exitability | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | n/a | n/a | No state is derived for this dimension: this build rates neither sovereignty nor exitability. What it does state (the thirteen dimensions, the source dependencies and the exitability entries, each with its own state) is in assurance/sovereignty.md and on the Sovereignty page. |
| Cost Confidence | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | n/a | n/a | Not assessed in this build. |
| Evidence Freshness | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | n/a | n/a | Not assessed in this build. |

There is no overall score: a dimension is a state of its own, and one this build cannot support reads NOT ASSESSED. The coverage state says how much of what the dimension counts is covered; COVERED is not decided, not validated and not ready. The migration decision state is read from the Blockers and Open decisions of the same row. The target validation state is what StackToIT's own checks established about the generated target (no STACKIT plan is run).