{ "schema_version": "0.4.0", "run_id": "f6267c3f-2848-4aa5-89df-5fee8b15b3b9", "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "statement": "PROPOSAL: a record groups the open decisions of the plans of the draft by the part of the draft they concern and the kind of the decision, or the units that leave one critical semantic of one contract open, or the manual actions of the plans by kind, or the open statements of the plans about units they write no resource for by the reason of the statement. It is a view: nothing here changes the draft, target-plan.json, a gate, or any class, confidence or eligibility, and every critical semantic stays open in the assessment. A review of a plan-decision record acts on the execution plan only, by its effect (issue #205): an answer whose option is what the draft already carries out (ACK_CURRENT_ARTIFACT) frees the steps that wait for the decision; an option that changes the draft (REGENERATE_REQUIRED) or a redesign keeps them held until the draft is regenerated with it, a manual alternative frees only the manual step that carries it out, and a refused opt-in to an API resolves to the draft's own path (the steps of the API path are not taken). The draft itself is unchanged by any answer.", "state": "BUILT", "basis": "Records group four lists: the open decisions of the TargetPlans of the draft this run wrote, by the family of the producer (security group, routing, identity, logs, server) and the kind of the decision (plan decisions); the open critical semantics of the units, by the contract family and the semantic (critical semantics); the manual actions of the plans, by the family of the producer and the kind of the action (manual actions); and the open statements of the plans about units they write no resource for (a redesign, a review, a block, a failed model, or a step beside a unit whose draft a converter writes), by the family of the producer and the reason (plan statements). Plan decisions and manual actions cover only drafted units whose draft passed StackToIT's own checks, and only the families whose draft this run wrote from a plan: a family with no plan has none to list. A plan statement covers a unit the plan writes nothing for, whether or not a draft check ran over it; a statement that leaves nothing to a person (a unit the plan does not draft and no manual action of it names) is counted (closed_statements) and is no record. A record shows the review of an overlay beside the open state the engine reached; a review closes no critical semantic and changes no draft, target plan, gate, class, confidence or eligibility. An accepted plan decision frees the steps of the execution plan that wait for it only when the answer's effect acknowledges the current draft; an option that changes the draft keeps them held until the draft is regenerated with it. Records of the family \"convert\" are decisions of the converter's own generators, outside every plan: a CONSTRAINT_CONFLICT (a variable whose consumers' STACKIT bounds exclude one another keeps the source default) and an AMBIGUOUS_* selection (the source does not prove which instance, interface, key pair, gateway, peer, subnet, proxy, URL map or health check it means, so the draft holds a required variable without a default); the unit that owns one is not automation-eligible. They are listed for a drafted unit whose plan checks did not fail.", "plan_read": true, "decisions": [ { "id": "DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION", "kind": "AMBIGUOUS_INSTANCE_SELECTION", "family": "convert", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-convert", "block": "AMBIGUOUS_INSTANCE_SELECTION", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.alb.aws_lb.this", "artifact": "assessment.json", "pointer": "/units/28" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "convert:module.retail_app_ecs.module.alb.aws_lb.this:network_id:AMBIGUOUS_INSTANCE_SELECTION", "artifact": "workspace.json", "pointer": "/units/35/deployment_prerequisites/open_decisions/0" } ], "options": [ { "id": "set-the-selector-to-one-instance", "title": "Set the selector variable to the index of the instance the source means", "effect": "The attribute takes one id, so one instance is meant; a person sets the selector variable the draft declares to the index of that instance, and the step is applied as the draft writes it (it needs the variable as an input). No other instance is referenced.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "network_id (String) The network ID to which the network interface is associated." } ] }, { "id": "reference-another-resource", "title": "Reference another resource than the candidates", "effect": "None of the instances of the repeated resource is what the source means; the reference is changed in the draft (to another block, or a block of its own) before the step is applied.", "execution_effect": "REGENERATE_REQUIRED", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "network_id (String) The network ID to which the network interface is associated." } ] } ], "recommended_option": null, "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.alb.aws_lb.this", "artifact": "workspace.json", "pointer": "/units/35/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:7d4ce9ee9ce1f3acbba48c88c829f6eb66a62259ada1ad27007786228edd5d9d", "artifact_sha256": "sha256:d657345b9c347c9f67a71d34532dd9b788bb6c142734877e5b4a3580c976dd9a", "kb_dependencies": [ { "kind": "decision_kind", "id": "convert/AMBIGUOUS_INSTANCE_SELECTION", "sha256": "sha256:a2d26890cd858ebc95b4846b5347c3031ccdbf138979005633525707206877fc" }, { "kind": "review_cause", "id": "convert/AMBIGUOUS_INSTANCE_SELECTION", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:3cff130385543c2c208d88b90edeb0c1f0fe7d19da8e60e6420d1f8dfd5b3f07" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "unblocks": { "holds": 66, "stuck": 63, "alone": 0, "shared": 3, "steps": [], "best_option": "set-the-selector-to-one-instance", "options": [ { "option": "set-the-selector-to-one-instance", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 0, "shared": 3 }, { "option": "reference-another-resource", "effects": [ "REGENERATE_REQUIRED" ], "alone": 0, "shared": 0 } ] }, "why": "The converter could not prove which instance of a repeated resource the source means (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides.", "required_evidence": [ "the reference reaches stackit_network.vpc_vpc_public, a repeated resource (count or for_each), and nothing in the source proves which instance it means; no instance is assumed and the variable has no default", "which instance of the repeated resource the source means (its index among the candidates the selector variable's description lists)" ], "resolution": { "decision_id": "DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION", "source_family": "convert", "source_semantic": "AMBIGUOUS_INSTANCE_SELECTION", "affected_units": [ "module.retail_app_ecs.module.alb.aws_lb.this" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "TARGET_DESIGN_OPEN", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The plan leaves this decision open on module.retail_app_ecs.module.alb.aws_lb.this.", "generated_target_behavior": "The draft holds TF/stackit_application_load_balancer.retail_app_ecs_alb_this until this decision is answered by an answer that frees it.", "residual_difference": "the target design is open until the decision is answered", "execution_effect": "1 step waits for it until it is answered: TF/stackit_application_load_balancer.retail_app_ecs_alb_this.", "next_action": "Name the instance of a repeated resource a reference means for module.retail_app_ecs.module.alb.aws_lb.this: choose one of the 2 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "The converter could not prove which instance of a repeated resource the source means (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides." ], "closes_when": [ "an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option" ], "required_inputs": [ "the reference reaches stackit_network.vpc_vpc_public, a repeated resource (count or for_each), and nothing in the source proves which instance it means; no instance is assumed and the variable has no default", "which instance of the repeated resource the source means (its index among the candidates the selector variable's description lists)" ], "resolution_paths": [ { "id": "set-the-selector-to-one-instance", "title": "Set the selector variable to the index of the instance the source means", "prerequisites": [], "effects": [ "The attribute takes one id, so one instance is meant; a person sets the selector variable the draft declares to the index of that instance, and the step is applied as the draft writes it (it needs the variable as an input). No other instance is referenced." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29" ], "regeneration_required": false }, { "id": "reference-another-resource", "title": "Reference another resource than the candidates", "prerequisites": [], "effects": [ "None of the instances of the repeated resource is what the source means; the reference is changed in the draft (to another block, or a block of its own) before the step is applied." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29" ], "regeneration_required": true } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29" ], "related_execution_steps": [ { "id": "TF/stackit_application_load_balancer.retail_app_ecs_alb_this", "mode": "TERRAFORM", "phase": "PLATFORM", "executable": false, "waits_for_this": true } ] } }, { "id": "DEC-GEN-CONVERT-API-OPT-IN", "kind": "API_OPT_IN", "family": "convert", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-convert", "block": "API_OPT_IN", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db", "artifact": "assessment.json", "pointer": "/units/35" }, { "kind": "unit", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch", "artifact": "assessment.json", "pointer": "/units/9" }, { "kind": "unit", "id": "module.retail_app_ecs.aws_secretsmanager_secret.mq", "artifact": "assessment.json", "pointer": "/units/36" }, { "kind": "unit", "id": "module.retail_app_ecs.aws_secretsmanager_secret.orders_db", "artifact": "assessment.json", "pointer": "/units/37" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN", "artifact": "workspace.json", "pointer": "/units/30/deployment_prerequisites/open_decisions/0" } ], "options": [ { "id": "allow-calls-of-the-api", "title": "Allow the calls of the API for this migration", "effect": "The calls of the API the plan states are made as the plan writes them (the request documents of the execution package), and the steps of their path are taken; the migration then depends on an API that may change or vanish.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-10-23", "quote": "\"info\": {\"description\": \"This API provides endpoints for managing STACKIT Functions.\", \"title\": \"STACKIT Functions Core API\", \"version\": \"1alpha\"}" } ] } ], "recommended_option": null, "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db", "artifact": "workspace.json", "pointer": "/units/30/trace" }, { "kind": "evidence", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch", "artifact": "workspace.json", "pointer": "/units/31/trace" }, { "kind": "evidence", "id": "module.retail_app_ecs.aws_secretsmanager_secret.mq", "artifact": "workspace.json", "pointer": "/units/32/trace" }, { "kind": "evidence", "id": "module.retail_app_ecs.aws_secretsmanager_secret.orders_db", "artifact": "workspace.json", "pointer": "/units/33/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:e38398c0e3d250ba5bc2f41d119954b6cca973ef84267dcb555af7fa66082039", "artifact_sha256": "sha256:8f448648a56ee601d5c9aeef0b5a933cd2aabe601c1db6a7695df6b7315e6bef", "kb_dependencies": [ { "kind": "decision_kind", "id": "convert/API_OPT_IN", "sha256": "sha256:54132b6ed57d6a74b87e703c82360235486f76a5141b49f018b81d3be2629bfb" }, { "kind": "review_cause", "id": "convert/API_OPT_IN", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:03735a47b22c84235c95ed16b33e929eb21e905431c7a1c2103a67e6c13f9395" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "unblocks": { "holds": 74, "stuck": 64, "alone": 4, "shared": 6, "steps": [ "API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db", "API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch", "API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq", "API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db" ], "best_option": "allow-calls-of-the-api", "options": [ { "option": "allow-calls-of-the-api", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 4, "shared": 6 }, { "option": "", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 4, "shared": 6 } ] }, "why": "The plan calls a STACKIT API that is not generally available (alpha, beta, or a release status its documentation does not state), which may change or be withdrawn, so it makes those calls only after you allow them (1 API): until you answer, the calls and the steps of their path wait. Allowing carries them out; refusing keeps the draft's own path where the API's path is an alternative beside it, and leaves the question open where the API is the only carrier of what its call sets. No block of the draft waits for it, and no unit's eligibility rests on it.", "required_evidence": [ "the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db wait for this decision; the draft's own blocks do not", "the platform's consent to depend on an API that may change or vanish (alpha, beta, or a maturity the documentation does not establish)" ], "resolution": { "decision_id": "DEC-GEN-CONVERT-API-OPT-IN", "source_family": "convert", "source_semantic": "API_OPT_IN", "affected_units": [ "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db", "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch", "module.retail_app_ecs.aws_secretsmanager_secret.mq", "module.retail_app_ecs.aws_secretsmanager_secret.orders_db" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "TARGET_DESIGN_OPEN", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The plan leaves this decision open on module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq and module.retail_app_ecs.aws_secretsmanager_secret.orders_db.", "generated_target_behavior": "The draft holds API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq and API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db until this decision is answered by an answer that frees it.", "residual_difference": "the target design is open until the decision is answered", "execution_effect": "4 steps wait for it until it is answered: API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq and API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db.", "next_action": "Allow STACKIT's pre-release API, which may change or be withdrawn: Secrets Manager v1 (release status not stated). 4 steps wait for this answer; allowing the calls lets the plan carry them out and makes the migration depend on that API. If you say no (record a rejection), the calls are not made: the steps of Secrets Manager stay open. Record the answer in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "The plan calls a STACKIT API that is not generally available (alpha, beta, or a release status its documentation does not state), which may change or be withdrawn, so it makes those calls only after you allow them (1 API): until you answer, the calls and the steps of their path wait. Allowing carries them out; refusing keeps the draft's own path where the API's path is an alternative beside it, and leaves the question open where the API is the only carrier of what its call sets. No block of the draft waits for it, and no unit's eligibility rests on it." ], "closes_when": [ "Every API the record lists is answered in the decisions file: allowed, or refused." ], "required_inputs": [ "the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db wait for this decision; the draft's own blocks do not", "the platform's consent to depend on an API that may change or vanish (alpha, beta, or a maturity the documentation does not establish)" ], "resolution_paths": [ { "id": "allow-calls-of-the-api", "title": "Allow the calls of the API for this migration", "prerequisites": [], "effects": [ "The calls of the API the plan states are made as the plan writes them (the request documents of the execution package), and the steps of their path are taken; the migration then depends on an API that may change or vanish." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771" ], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771" ], "related_execution_steps": [ { "id": "API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db", "mode": "STACKIT_API", "phase": "SECURITY", "executable": false, "waits_for_this": true }, { "id": "API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch", "mode": "STACKIT_API", "phase": "SECURITY", "executable": false, "waits_for_this": true }, { "id": "API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq", "mode": "STACKIT_API", "phase": "SECURITY", "executable": false, "waits_for_this": true }, { "id": "API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db", "mode": "STACKIT_API", "phase": "SECURITY", "executable": false, "waits_for_this": true } ] } }, { "id": "DEC-GEN-CONVERT-DATA-MOVEMENT", "kind": "DATA_MOVEMENT", "family": "convert", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-convert", "block": "DATA_MOVEMENT", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Data Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "artifact": "assessment.json", "pointer": "/units/31" }, { "kind": "unit", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/32" }, { "kind": "unit", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "artifact": "assessment.json", "pointer": "/units/33" }, { "kind": "unit", "id": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this", "artifact": "assessment.json", "pointer": "/units/0" }, { "kind": "unit", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/34" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:data:DATA_MOVEMENT", "artifact": "workspace.json", "pointer": "/units/5/deployment_prerequisites/open_decisions/0" }, { "kind": "plan_decision", "id": "convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:data:DATA_MOVEMENT", "artifact": "workspace.json", "pointer": "/units/9/deployment_prerequisites/open_decisions/0" }, { "kind": "plan_decision", "id": "convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:data:DATA_MOVEMENT", "artifact": "workspace.json", "pointer": "/units/13/deployment_prerequisites/open_decisions/0" }, { "kind": "plan_decision", "id": "convert:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this:data:DATA_MOVEMENT", "artifact": "workspace.json", "pointer": "/units/19/deployment_prerequisites/open_decisions/0" }, { "kind": "plan_decision", "id": "convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:data:DATA_MOVEMENT", "artifact": "workspace.json", "pointer": "/units/22/deployment_prerequisites/open_decisions/0" } ], "aliases": [ { "id": "convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:data:DATA_MOVEMENT", "source": "PLAN_DECISION", "subject": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "display_id": "DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this" }, { "id": "convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:data:DATA_MOVEMENT", "source": "PLAN_DECISION", "subject": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "display_id": "DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this" }, { "id": "convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:data:DATA_MOVEMENT", "source": "PLAN_DECISION", "subject": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "display_id": "DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default" }, { "id": "convert:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this:data:DATA_MOVEMENT", "source": "PLAN_DECISION", "subject": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this", "display_id": "DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this" }, { "id": "convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:data:DATA_MOVEMENT", "source": "PLAN_DECISION", "subject": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "display_id": "DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this" } ], "options": [ { "id": "export-and-import-with-the-engine-clients", "title": "Export the data from the source and import it with the clients of the target engine", "effect": "A person exports the data from the source and imports it into the STACKIT instance with the clients of its engine during a window the business accepts, then checks that the copy is complete; the clients reach the instance at the host and port its credential states. The source and the target engine may differ (DynamoDB to MongoDB Flex), so the export is converted where they do. The plan holds the steps of this option as typed steps: for a PostgreSQL database, for a MySQL, MariaDB or Aurora MySQL database moving to MariaDB and for an RDS for SQL Server database moving to SQLServer Flex (the native backup, its copy to a STACKIT S3 bucket and the import_database call) the preflight, the rehearsal, the write freeze, the dump or backup and the restore or import inside it, the reconcile and the cleanup; for an ElastiCache, MemoryDB or ElastiCache serverless cache moving to a Key Value Store the preflight, the rehearsal, the write freeze, the copy by a client, the reconcile and the cleanup; for an Amazon Aurora DSQL cluster moving to PostgreSQL Flex the preflight, the rehearsal, the write freeze, the copy of the tables by a client (the schema from the catalogs of the cluster, or from pg_dump --schema-only where the preflight shows that it works, and the rows through the PostgreSQL protocol: no AWS page read documents a dump of a cluster), the reconcile and the cleanup; for an OpenSearch store the write freeze, the copy and the reconcile. The decision offers this option only for a store whose STACKIT service documents a way in with such clients: PostgreSQL Flex (for an Aurora DSQL cluster, which has no change stream, this option and the tool of the customer's own are the only ones; the replication of the engine is not offered), MariaDB (the mysql client loads a dump into an empty instance), SQLServer Flex (a .bak file imported with import_database), Key Value Store (the tutorial migrates a Redis instance by the MIGRATE command; for an ElastiCache source, where AWS lists migrate among the commands unavailable for caches running Redis OSS, the copy is a client that iterates the keys with SCAN and copies each with DUMP, PTTL and RESTORE; for a MemoryDB source, where AWS lists migrate, sync, psync, bgsave, save and config among the unavailable commands and the cluster mode is always on, the same client copy runs against every shard primary found with CLUSTER NODES or CLUSTER SLOTS, with TLS where the source has it and an ACL user that reaches every key; whether DUMP, RESTORE and PTTL run on a standard MemoryDB cluster is not stated by AWS, and for a member of a multi-Region cluster, whose page lists PTTL as unsupported, the step says the TTLs are not carried) and OpenSearch (the reindex operation). For a store without a documented way in (MongoDB Flex, a memcached cache) it is not offered and the decision offers the tool of the customer's own alone.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "Read-Only: host (String), hosts (List of String), ..., port (Number), uri (String, Sensitive)" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "Read-Only: host (String), ..., port (Number), uri (String, Sensitive)" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "Read-Only: host (String), hosts (List of String), ..., port (Number), ..., uri (String, Sensitive)" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "Read-Only: host (String), hosts (List of String), load_balanced_host (String), ..., port (Number), uri (String, Sensitive) Connection URI." }, { "url": "https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "Connect to the database and import the backup." }, { "url": "https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "You have uploaded the database to be imported as .bak file(s) to the STACKIT S3 bucket" }, { "url": "https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "The main strategy to migrate the whole dataset from the source to the target is based on the MIGRATE command." }, { "url": "https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "For caches running Redis OSS, the following commands are unavailable:" }, { "url": "https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "To deliver a managed service experience, MemoryDB restricts access to certain commands that require advanced privileges. The following commands are unavailable:" }, { "url": "https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "to use the `reindex` Data Operation" } ] }, { "id": "replicate-with-the-engine-replication", "title": "Replicate the data with the replication of the source engine until the cutover", "effect": "A person sets up the replication of the source engine so that the STACKIT instance follows the source while the application keeps writing to the source (for PostgreSQL, logical replication: the schema is copied first with pg_dump --schema-only, a publication on the source and a subscription on the target copy the existing rows and then the changes, and the sequences are copied inside the write freeze because they are not replicated). The source needs a change and a reboot to turn replication on, and the target must be able to reach the source. Inside the write freeze the person waits until the target has caught up, compares both sides and switches the clients, then removes the replication. For a PostgreSQL database the plan holds the steps of this option (the initial copy, the watch of the lag, the freeze, the final copy, the reconcile and the cleanup); for an S3 bucket this option is not available, because S3 Replication copies between Amazon S3 buckets and no STACKIT bucket is documented as a destination (the plan holds the two copy tools instead); for any other engine this option is not offered, because no STACKIT service other than PostgreSQL Flex documents the replication of a source engine into it (MariaDB, Key Value Store, OpenSearch and MongoDB Flex document none, and the SQLServer Flex page on transactional replication describes an on-premises publisher and does not name Amazon RDS as one), so the decision of such a store offers the export and the import with the engine clients where its service documents them, and the tool of the customer's own.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "You can use replication to enable automatic, asynchronous copying of objects across Amazon S3 buckets." }, { "url": "https://www.postgresql.org/docs/current/logical-replication-restrictions.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "The database schema and DDL commands are not replicated. The initial schema can be copied by hand using pg_dump --schema-only." }, { "url": "https://www.postgresql.org/docs/current/logical-replication-restrictions.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "Sequence data is not replicated." }, { "url": "https://www.postgresql.org/docs/current/sql-createsubscription.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "To be able to create a subscription, you must have the privileges of the pg_create_subscription role, as well as CREATE privileges on the current database." }, { "url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "Set the rds.logical_replication static parameter to 1." }, { "url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "Reboot the DB instance for the static rds.logical_replication parameter to take effect." } ] }, { "id": "migrate-with-a-tool-of-my-own", "title": "Move the data with a migration tool or a replication of the owner's own", "effect": "A person moves the data with a tool or a replication they run (for example a change-data-capture replication that keeps the copy in step until the cutover), writes its steps, the checks before the move, the cutover window and the way back, and carries them out. The STACKIT instance is reached at the host and port its credential states. The plan holds that work as typed steps: the write freeze of the source, the copy as one step whose commands the person writes, and the reconcile that compares both sides; the source stays the way back until the reconcile records GO, which a person checks, since the plan cannot know that the tool leaves the source unchanged. A memcached cache holds a confirmation instead of a copy. A bucket repeated by count or for_each has neither a reconcile nor any other option: its instances and the buckets they move to are not named, so the plan holds the one manual step, which the person writes for each instance after naming them.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "Read-Only: host (String), hosts (List of String), ..., port (Number), uri (String, Sensitive)" } ] } ], "recommended_option": null, "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "artifact": "workspace.json", "pointer": "/units/5/trace" }, { "kind": "evidence", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/9/trace" }, { "kind": "evidence", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "artifact": "workspace.json", "pointer": "/units/13/trace" }, { "kind": "evidence", "id": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this", "artifact": "workspace.json", "pointer": "/units/19/trace" }, { "kind": "evidence", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/22/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:bd6dc33bd3777ba67c03a89361624334a25a61983906190c138fe87904c08a32", "artifact_sha256": "sha256:15bd4a976759c2e9e78fcac08a2e4bb165e943ae8006503f5b7e166f2e075a97", "kb_dependencies": [ { "kind": "decision_kind", "id": "convert/DATA_MOVEMENT", "sha256": "sha256:e3cf2a65c088a6ea536170a5fc6970aab632c442714ea237f8ad0d6b0545fae1" }, { "kind": "review_cause", "id": "convert/DATA_MOVEMENT", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:610870c4321b580122859ef332af5301a6bd3a8973057240bd04c7d631e03a41" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 5 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "unblocks": { "holds": 114, "stuck": 65, "alone": 18, "shared": 14, "steps": [ "MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/own-tool", "MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/own-tool", "MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/own-tool", "MAN/cutover/connection/module.dependencies.module.catalog_rds.aws_rds_cluster.this", "MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/own-tool", "MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/own-tool", "MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/own-tool", "MAN/cutover/connection/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/write-freeze/own-tool", "MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/export/own-tool", "MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/transform/own-tool", "MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/final-sync/own-tool", "MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/reconcile/own-tool", "MAN/cutover/connection/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this", "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/own-tool", "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/own-tool", "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/own-tool", "MAN/cutover/connection/module.dependencies.module.orders_rds.aws_rds_cluster.this" ], "best_option": "migrate-with-a-tool-of-my-own", "options": [ { "option": "export-and-import-with-the-engine-clients", "effects": [ "MANUAL_ALTERNATIVE", "NOT_STATED" ], "alone": 12, "shared": 3 }, { "option": "replicate-with-the-engine-replication", "effects": [ "MANUAL_ALTERNATIVE", "NOT_STATED" ], "alone": 6, "shared": 0 }, { "option": "migrate-with-a-tool-of-my-own", "effects": [ "MANUAL_ALTERNATIVE" ], "alone": 18, "shared": 14 } ] }, "why": "The method that moves the data of a store (a database, a cache, a search domain, or the objects of a bucket) to its STACKIT service is a person's choice (5 converter decisions): the steps of each method are in the plan where the planner covers the store (a PostgreSQL database and an S3 bucket, each with the runbook of the move), and the plan holds one manual step the person writes where it does not; the steps of the move wait for the choice. The choice decides how the data is moved, not whether it is: every method is work a person does by hand, so the unit that owns one keeps a manual data-migration step, and answering it does not make the unit automation-eligible.", "required_evidence": [ "StackToIT moves no data and writes no runbook for aws_dynamodb_table to STACKIT MongoDB Flex; the data-movement register lists module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs", "StackToIT moves no data and writes no runbook for aws_opensearch_domain to STACKIT OpenSearch; the data-movement register lists module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs", "the plan defines both methods of the engine (a dump restored inside the write freeze, and a logical replication that follows the changes until the freeze) and keeps them open: which one applies depends on the size of the data, the write rate and the downtime the business accepts, and the source states none of them; the steps of the methods wait for the answer", "the plan defines the one method the STACKIT MariaDB pages document, a dump loaded with the mysql client into the empty instance, and the customer's own tool; the replication of the binary log is refused because no STACKIT page documents it; STACKIT has no managed MySQL, so a MySQL source is an engine change whose collations, DEFINER accounts, accounts and settings the checks of the plan name, and the size of the data, the downtime the business accepts and the consistency the application needs are not in the source; the steps wait for the answer", "the plan defines the one method the STACKIT pages and the ElastiCache pages allow together, a copy of the keys by a client (SCAN, DUMP, PTTL, RESTORE) inside the write freeze, and the customer's own tool; loading an exported snapshot is refused because no STACKIT page or API takes an RDB file, and following the source as a replica is refused because neither end offers it; the source does not say whether the cache holds only what the application rebuilds, the size of the data, the downtime the business accepts or the shards the keys are spread over, and the Key Value Store has no sharding; the steps wait for the answer", "the size of the data, the downtime the business tolerates and the consistency the application needs, to choose the method and the cutover window" ], "resolution": { "decision_id": "DEC-GEN-CONVERT-DATA-MOVEMENT", "source_family": "convert", "source_semantic": "DATA_MOVEMENT", "affected_units": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this", "module.dependencies.module.orders_rds.aws_rds_cluster.this" ], "affected_application": [], "action_type": "BLOCKED_OR_UNSUPPORTED", "work_package": "NOT_STATED", "owner_role": "Data Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "TARGET_DESIGN_OPEN", "review_status": "OPEN", "customer_action_status": "BLOCKED", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "the execution plan states that no answer makes MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/cleanup/dump-restore, MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/cleanup/client-import, MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/dump-restore and MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/logical-replication executable", "source_observation": "The plan leaves this decision open on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this and 1 more.", "generated_target_behavior": "The draft holds MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/own-tool, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/own-tool, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/own-tool, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/own-tool and 28 more until this decision is answered by an answer that frees it.", "residual_difference": "the target design is open until the decision is answered", "execution_effect": "38 steps wait for it until it is answered: MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/own-tool, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/own-tool, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/own-tool, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/own-tool and 28 more.", "next_action": "The plan states that no answer makes MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/cleanup/dump-restore, MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/cleanup/client-import, MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/dump-restore and MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/logical-replication executable for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this and 1 more: change the draft or the source that holds it before anything rests on this record.", "why_open": [ "The method that moves the data of a store (a database, a cache, a search domain, or the objects of a bucket) to its STACKIT service is a person's choice (5 converter decisions): the steps of each method are in the plan where the planner covers the store (a PostgreSQL database and an S3 bucket, each with the runbook of the move), and the plan holds one manual step the person writes where it does not; the steps of the move wait for the choice. The choice decides how the data is moved, not whether it is: every method is work a person does by hand, so the unit that owns one keeps a manual data-migration step, and answering it does not make the unit automation-eligible." ], "closes_when": [ "an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option" ], "required_inputs": [ "StackToIT moves no data and writes no runbook for aws_dynamodb_table to STACKIT MongoDB Flex; the data-movement register lists module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs", "StackToIT moves no data and writes no runbook for aws_opensearch_domain to STACKIT OpenSearch; the data-movement register lists module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs", "the plan defines both methods of the engine (a dump restored inside the write freeze, and a logical replication that follows the changes until the freeze) and keeps them open: which one applies depends on the size of the data, the write rate and the downtime the business accepts, and the source states none of them; the steps of the methods wait for the answer", "the plan defines the one method the STACKIT MariaDB pages document, a dump loaded with the mysql client into the empty instance, and the customer's own tool; the replication of the binary log is refused because no STACKIT page documents it; STACKIT has no managed MySQL, so a MySQL source is an engine change whose collations, DEFINER accounts, accounts and settings the checks of the plan name, and the size of the data, the downtime the business accepts and the consistency the application needs are not in the source; the steps wait for the answer", "the plan defines the one method the STACKIT pages and the ElastiCache pages allow together, a copy of the keys by a client (SCAN, DUMP, PTTL, RESTORE) inside the write freeze, and the customer's own tool; loading an exported snapshot is refused because no STACKIT page or API takes an RDB file, and following the source as a replica is refused because neither end offers it; the source does not say whether the cache holds only what the application rebuilds, the size of the data, the downtime the business accepts or the shards the keys are spread over, and the Key Value Store has no sharding; the steps wait for the answer", "the size of the data, the downtime the business tolerates and the consistency the application needs, to choose the method and the cutover window" ], "resolution_paths": [ { "id": "export-and-import-with-the-engine-clients", "title": "Export the data from the source and import it with the clients of the target engine", "prerequisites": [], "effects": [ "A person exports the data from the source and imports it into the STACKIT instance with the clients of its engine during a window the business accepts, then checks that the copy is complete; the clients reach the instance at the host and port its credential states. The source and the target engine may differ (DynamoDB to MongoDB Flex), so the export is converted where they do. The plan holds the steps of this option as typed steps: for a PostgreSQL database, for a MySQL, MariaDB or Aurora MySQL database moving to MariaDB and for an RDS for SQL Server database moving to SQLServer Flex (the native backup, its copy to a STACKIT S3 bucket and the import_database call) the preflight, the rehearsal, the write freeze, the dump or backup and the restore or import inside it, the reconcile and the cleanup; for an ElastiCache, MemoryDB or ElastiCache serverless cache moving to a Key Value Store the preflight, the rehearsal, the write freeze, the copy by a client, the reconcile and the cleanup; for an Amazon Aurora DSQL cluster moving to PostgreSQL Flex the preflight, the rehearsal, the write freeze, the copy of the tables by a client (the schema from the catalogs of the cluster, or from pg_dump --schema-only where the preflight shows that it works, and the rows through the PostgreSQL protocol: no AWS page read documents a dump of a cluster), the reconcile and the cleanup; for an OpenSearch store the write freeze, the copy and the reconcile. The decision offers this option only for a store whose STACKIT service documents a way in with such clients: PostgreSQL Flex (for an Aurora DSQL cluster, which has no change stream, this option and the tool of the customer's own are the only ones; the replication of the engine is not offered), MariaDB (the mysql client loads a dump into an empty instance), SQLServer Flex (a .bak file imported with import_database), Key Value Store (the tutorial migrates a Redis instance by the MIGRATE command; for an ElastiCache source, where AWS lists migrate among the commands unavailable for caches running Redis OSS, the copy is a client that iterates the keys with SCAN and copies each with DUMP, PTTL and RESTORE; for a MemoryDB source, where AWS lists migrate, sync, psync, bgsave, save and config among the unavailable commands and the cluster mode is always on, the same client copy runs against every shard primary found with CLUSTER NODES or CLUSTER SLOTS, with TLS where the source has it and an ACL user that reaches every key; whether DUMP, RESTORE and PTTL run on a standard MemoryDB cluster is not stated by AWS, and for a member of a multi-Region cluster, whose page lists PTTL as unsupported, the step says the TTLs are not carried) and OpenSearch (the reindex operation). For a store without a documented way in (MongoDB Flex, a memcached cache) it is not offered and the decision offers the tool of the customer's own alone." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57", "https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/", "https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/", "https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/", "https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html", "https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html", "https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/" ], "regeneration_required": false }, { "id": "replicate-with-the-engine-replication", "title": "Replicate the data with the replication of the source engine until the cutover", "prerequisites": [], "effects": [ "A person sets up the replication of the source engine so that the STACKIT instance follows the source while the application keeps writing to the source (for PostgreSQL, logical replication: the schema is copied first with pg_dump --schema-only, a publication on the source and a subscription on the target copy the existing rows and then the changes, and the sequences are copied inside the write freeze because they are not replicated). The source needs a change and a reboot to turn replication on, and the target must be able to reach the source. Inside the write freeze the person waits until the target has caught up, compares both sides and switches the clients, then removes the replication. For a PostgreSQL database the plan holds the steps of this option (the initial copy, the watch of the lag, the freeze, the final copy, the reconcile and the cleanup); for an S3 bucket this option is not available, because S3 Replication copies between Amazon S3 buckets and no STACKIT bucket is documented as a destination (the plan holds the two copy tools instead); for any other engine this option is not offered, because no STACKIT service other than PostgreSQL Flex documents the replication of a source engine into it (MariaDB, Key Value Store, OpenSearch and MongoDB Flex document none, and the SQLServer Flex page on transactional replication describes an on-premises publisher and does not name Amazon RDS as one), so the decision of such a store offers the export and the import with the engine clients where its service documents them, and the tool of the customer's own." ], "risk": [], "evidence": [ "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html", "https://www.postgresql.org/docs/current/logical-replication-restrictions.html", "https://www.postgresql.org/docs/current/logical-replication-restrictions.html", "https://www.postgresql.org/docs/current/sql-createsubscription.html", "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html", "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html" ], "regeneration_required": false }, { "id": "migrate-with-a-tool-of-my-own", "title": "Move the data with a migration tool or a replication of the owner's own", "prerequisites": [], "effects": [ "A person moves the data with a tool or a replication they run (for example a change-data-capture replication that keeps the copy in step until the cutover), writes its steps, the checks before the move, the cutover window and the way back, and carries them out. The STACKIT instance is reached at the host and port its credential states. The plan holds that work as typed steps: the write freeze of the source, the copy as one step whose commands the person writes, and the reconcile that compares both sides; the source stays the way back until the reconcile records GO, which a person checks, since the plan cannot know that the tool leaves the source unchanged. A memcached cache holds a confirmation instead of a copy. A bucket repeated by count or for_each has neither a reconcile nor any other option: its instances and the buckets they move to are not named, so the plan holds the one manual step, which the person writes for each instance after naming them." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57" ], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57", "https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/", "https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/", "https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/", "https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html", "https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html", "https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/", "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html", "https://www.postgresql.org/docs/current/logical-replication-restrictions.html", "https://www.postgresql.org/docs/current/sql-createsubscription.html", "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html" ], "related_execution_steps": [ { "id": "MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/client-import", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/client-import", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/client-import", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/dump-restore", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/dump-restore", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/cleanup/dump-restore", "mode": "MANUAL", "phase": "DECOMMISSION", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/client-import", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/client-import", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/client-import", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/cleanup/client-import", "mode": "MANUAL", "phase": "DECOMMISSION", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/write-freeze/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/export/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/transform/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/final-sync/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/reconcile/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/initial-copy/logical-replication", "mode": "MANUAL", "phase": "PLATFORM", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/delta-sync/logical-replication", "mode": "MANUAL", "phase": "PLATFORM", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/dump-restore", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/dump-restore", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/dump-restore", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/logical-replication", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/logical-replication", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/logical-replication", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/dump-restore", "mode": "MANUAL", "phase": "DECOMMISSION", "executable": false, "waits_for_this": true }, { "id": "MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/logical-replication", "mode": "MANUAL", "phase": "DECOMMISSION", "executable": false, "waits_for_this": true } ] } }, { "id": "DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE", "kind": "ENGINE_VERSION_DOWNGRADE", "family": "convert", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-convert", "block": "ENGINE_VERSION_DOWNGRADE", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Data Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "artifact": "assessment.json", "pointer": "/units/31" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:version:ENGINE_VERSION_DOWNGRADE", "artifact": "workspace.json", "pointer": "/units/5/deployment_prerequisites/open_decisions/2" } ], "options": [ { "id": "move-the-data-into-the-offered-version", "title": "Move the data into the version STACKIT offers, by re-reading it from the source", "effect": "The instance is created with the version STACKIT offers (the draft's version variable is set to it, e.g. 2 for OpenSearch), and the data is re-read from the source rather than restored from a snapshot: an OpenSearch index is reindexed from the source (or the application writes to both during the cutover), a database is exported and imported with the clients of the engine. A snapshot of the newer engine is not restored into the older one. The applications are tested against the older version first; whether they work is not known from the source.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://docs.opensearch.org/latest/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-restore/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Restoring a snapshot to an older version of OpenSearch is not supported. Snapshots are only forward compatible by one major version." }, { "url": "https://www.postgresql.org/docs/current/app-pgdump.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Also, it is not guaranteed that pg_dump's output can be loaded into a server of an older major version — not even if the dump was taken from a server of that version." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_instance.md#L35", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "version (String) The service version." } ] }, { "id": "run-the-engine-self-managed-on-ske", "title": "Run the source's engine version yourself on SKE (self-managed)", "effect": "The managed STACKIT instance is not used: the customer runs the engine at the source's version on a STACKIT Kubernetes Engine cluster (an operator or a chart of its own) and operates it (upgrades, backups, monitoring). The draft does not write that workload, so it is changed (the managed instance removed, the workload added) before the step is applied.", "execution_effect": "REGENERATE_REQUIRED", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L55", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "node_pools (Attributes List) One or more node_pool block as defined below." } ] }, { "id": "wait-for-the-version", "title": "Wait until STACKIT offers the source's version", "effect": "The unit stays where it is until the region's catalogue lists the source's version; the draft is then regenerated against the new catalogue (the version check compares again), and the step stays blocked until then. STACKIT announces new service versions in the release notes of the service (OpenSearch: \"STACKIT OpenSearch2 is now available\", May 15, 2023); no date for a newer version is stated.", "execution_effect": "REGENERATE_REQUIRED", "evidence": [ { "url": "https://docs.stackit.cloud/products/databases/opensearch/release-notes/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "May 15, 2023 We are happy to announce our new service releases for STACKIT OpenSearch2 The Service are offered with completely new Service Plans." } ] } ], "recommended_option": null, "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "artifact": "workspace.json", "pointer": "/units/5/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:da0e0583e3f086831a47b05396b1d30756583e8d7f3d4dd2b89e37050a55f030", "artifact_sha256": "sha256:dc1e43b17cf02fc8aa65d7e26ca697d4699550aa5046f8552e15968db7b53c64", "kb_dependencies": [ { "kind": "decision_kind", "id": "convert/ENGINE_VERSION_DOWNGRADE", "sha256": "sha256:598e0370ef670a5918183744bed0fb91777f6e7bd4b8b06ee66134dab92b6f51" }, { "kind": "review_cause", "id": "convert/ENGINE_VERSION_DOWNGRADE", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" } ], "kb_dependencies_sha256": "sha256:df6451f6350a2b971c09bbf5ecf6ab18b5750dd81cbfa67f5af0282c74b4283b" }, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "blocker_class": "ROOT_BLOCKER", "unblocks": { "holds": 84, "stuck": 65, "alone": 2, "shared": 17, "steps": [ "TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this", "TF/stackit_opensearch_credential.dependencies_catalog_opensearch_this" ], "best_option": "move-the-data-into-the-offered-version", "options": [ { "option": "move-the-data-into-the-offered-version", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 2, "shared": 17 }, { "option": "run-the-engine-self-managed-on-ske", "effects": [ "REGENERATE_REQUIRED" ], "alone": 0, "shared": 0 }, { "option": "wait-for-the-version", "effects": [ "REGENERATE_REQUIRED" ], "alone": 0, "shared": 0 } ] }, "why": "The source runs an engine version newer than every version STACKIT offers in the region (1 converter decision): a snapshot of the newer engine is not restored into the older one, so the step that creates the instance waits until a person chooses how the data reaches the offered version (re-read from the source), runs the engine self-managed on SKE, or waits for the version; the unit that owns one is not automation-eligible until then.", "required_evidence": [ "the source runs OpenSearch 3.3 (engine_version), newer than every version the eu01 catalogue (2026-10-18) lists for stackit_opensearch_instance (2): a snapshot of 3.3 cannot be restored into 2 (OpenSearch restores a snapshot into the same or a newer version only); reindex from the source, or write to both during the cutover (dual-write), is the path; whether the clients work against 2 is unknown", "whether the applications and their client libraries work against the older engine version STACKIT offers (queries, mappings, plugins, protocol features)", "the size of the data and the downtime the business tolerates, to choose between re-reading the data from the source and writing to both during the cutover" ], "resolution": { "decision_id": "DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE", "source_family": "convert", "source_semantic": "ENGINE_VERSION_DOWNGRADE", "affected_units": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "NOT_STATED", "owner_role": "Data Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "TARGET_DESIGN_OPEN", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The plan leaves this decision open on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this.", "generated_target_behavior": "The draft holds TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this until this decision is answered by an answer that frees it.", "residual_difference": "the target design is open until the decision is answered", "execution_effect": "1 step waits for it until it is answered: TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this.", "next_action": "Decide engine version downgrade for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: choose one of the 3 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "The source runs an engine version newer than every version STACKIT offers in the region (1 converter decision): a snapshot of the newer engine is not restored into the older one, so the step that creates the instance waits until a person chooses how the data reaches the offered version (re-read from the source), runs the engine self-managed on SKE, or waits for the version; the unit that owns one is not automation-eligible until then." ], "closes_when": [ "an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option" ], "required_inputs": [ "the source runs OpenSearch 3.3 (engine_version), newer than every version the eu01 catalogue (2026-10-18) lists for stackit_opensearch_instance (2): a snapshot of 3.3 cannot be restored into 2 (OpenSearch restores a snapshot into the same or a newer version only); reindex from the source, or write to both during the cutover (dual-write), is the path; whether the clients work against 2 is unknown", "whether the applications and their client libraries work against the older engine version STACKIT offers (queries, mappings, plugins, protocol features)", "the size of the data and the downtime the business tolerates, to choose between re-reading the data from the source and writing to both during the cutover" ], "resolution_paths": [ { "id": "move-the-data-into-the-offered-version", "title": "Move the data into the version STACKIT offers, by re-reading it from the source", "prerequisites": [], "effects": [ "The instance is created with the version STACKIT offers (the draft's version variable is set to it, e.g. 2 for OpenSearch), and the data is re-read from the source rather than restored from a snapshot: an OpenSearch index is reindexed from the source (or the application writes to both during the cutover), a database is exported and imported with the clients of the engine. A snapshot of the newer engine is not restored into the older one. The applications are tested against the older version first; whether they work is not known from the source." ], "risk": [], "evidence": [ "https://docs.opensearch.org/latest/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-restore/", "https://www.postgresql.org/docs/current/app-pgdump.html", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_instance.md#L35" ], "regeneration_required": false }, { "id": "run-the-engine-self-managed-on-ske", "title": "Run the source's engine version yourself on SKE (self-managed)", "prerequisites": [], "effects": [ "The managed STACKIT instance is not used: the customer runs the engine at the source's version on a STACKIT Kubernetes Engine cluster (an operator or a chart of its own) and operates it (upgrades, backups, monitoring). The draft does not write that workload, so it is changed (the managed instance removed, the workload added) before the step is applied." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L55" ], "regeneration_required": true }, { "id": "wait-for-the-version", "title": "Wait until STACKIT offers the source's version", "prerequisites": [], "effects": [ "The unit stays where it is until the region's catalogue lists the source's version; the draft is then regenerated against the new catalogue (the version check compares again), and the step stays blocked until then. STACKIT announces new service versions in the release notes of the service (OpenSearch: \"STACKIT OpenSearch2 is now available\", May 15, 2023); no date for a newer version is stated." ], "risk": [], "evidence": [ "https://docs.stackit.cloud/products/databases/opensearch/release-notes/" ], "regeneration_required": true } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://docs.opensearch.org/latest/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-restore/", "https://www.postgresql.org/docs/current/app-pgdump.html", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_instance.md#L35", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L55", "https://docs.stackit.cloud/products/databases/opensearch/release-notes/" ], "related_execution_steps": [ { "id": "TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this", "mode": "TERRAFORM", "phase": "PLATFORM", "executable": false, "waits_for_this": true } ] } }, { "id": "DEC-GEN-CONVERT-EXPOSURE-WIDENED", "kind": "EXPOSURE_WIDENED", "family": "convert", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-convert", "block": "EXPOSURE_WIDENED", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "module.dependencies.aws_mq_broker.mq", "artifact": "assessment.json", "pointer": "/units/30" }, { "kind": "unit", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "artifact": "assessment.json", "pointer": "/units/31" }, { "kind": "unit", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/32" }, { "kind": "unit", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "artifact": "assessment.json", "pointer": "/units/33" }, { "kind": "unit", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/34" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "convert:module.dependencies.aws_mq_broker.mq:exposure:EXPOSURE_WIDENED", "artifact": "workspace.json", "pointer": "/units/0/deployment_prerequisites/open_decisions/1" }, { "kind": "plan_decision", "id": "convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:exposure:EXPOSURE_WIDENED", "artifact": "workspace.json", "pointer": "/units/5/deployment_prerequisites/open_decisions/1" }, { "kind": "plan_decision", "id": "convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED", "artifact": "workspace.json", "pointer": "/units/9/deployment_prerequisites/open_decisions/1" }, { "kind": "plan_decision", "id": "convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:exposure:EXPOSURE_WIDENED", "artifact": "workspace.json", "pointer": "/units/13/deployment_prerequisites/open_decisions/2" }, { "kind": "plan_decision", "id": "convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED", "artifact": "workspace.json", "pointer": "/units/22/deployment_prerequisites/open_decisions/2" }, { "kind": "semantic", "id": "module.dependencies.aws_mq_broker.mq|network-exposure", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/3" } ], "sources": [ "PLAN_DECISION", "CRITICAL_SEMANTIC" ], "blocking_effects": [ "TARGET_DESIGN_OPEN", "CRITICAL_SEMANTIC_OPEN" ], "aliases": [ { "id": "convert:module.dependencies.aws_mq_broker.mq:exposure:EXPOSURE_WIDENED", "source": "PLAN_DECISION", "subject": "module.dependencies.aws_mq_broker.mq", "display_id": "DEC-GEN-CONVERT-EXPOSURE-WIDENED/module.dependencies.aws_mq_broker.mq" }, { "id": "convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:exposure:EXPOSURE_WIDENED", "source": "PLAN_DECISION", "subject": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "display_id": "DEC-GEN-CONVERT-EXPOSURE-WIDENED/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this" }, { "id": "convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED", "source": "PLAN_DECISION", "subject": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "display_id": "DEC-GEN-CONVERT-EXPOSURE-WIDENED/module.dependencies.module.catalog_rds.aws_rds_cluster.this" }, { "id": "convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:exposure:EXPOSURE_WIDENED", "source": "PLAN_DECISION", "subject": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "display_id": "DEC-GEN-CONVERT-EXPOSURE-WIDENED/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default" }, { "id": "convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED", "source": "PLAN_DECISION", "subject": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "display_id": "DEC-GEN-CONVERT-EXPOSURE-WIDENED/module.dependencies.module.orders_rds.aws_rds_cluster.this" }, { "id": "module.dependencies.aws_mq_broker.mq|network-exposure", "source": "CRITICAL_SEMANTIC", "subject": "module.dependencies.aws_mq_broker.mq", "display_id": "DEC-GEN-CONVERT-EXPOSURE-WIDENED/module.dependencies.aws_mq_broker.mq" } ], "options": [ { "id": "accept-the-public-endpoint", "title": "Accept the public endpoint, limited by its access list", "effect": "The endpoint the draft writes is applied as written: the instance (or the Kubernetes API) is reached at its public address, and only the IP networks of its access list may connect (acl of stackit_postgresflex_instance and stackit_sqlserverflex_instance, sgw_acl of stackit_mariadb_instance, extensions.acl.allowed_cidrs of stackit_ske_cluster; parameters.sgw_acl of stackit_valkey_instance (Key Value Store), stackit_opensearch_instance, stackit_rabbitmq_instance and stackit_redis_instance, a comma-separated list of IP networks in CIDR notation, left to the default when the draft states none). The exposure is wider than the source's and the difference is accepted. Maturity: for stackit_ske_cluster this is the ACL-restricted public control plane: GA, not the source's private endpoint (the ACL how-to, last updated Aug 19, 2026, carries no Private Preview or beta notice, and says ACLs only control access to the API of the public control plane); the provider documents acl and sgw_acl of the data services without a preview notice. For an Application Load Balancer: it is created with the access control the draft writes, options.access_control.allowed_source_ranges, one set of source ranges for the whole load balancer (or none, where the draft can prove no range), so it admits more clients than the source's security groups; the restriction the set cannot express is the client-access manual step of the plan behind this decision, which follows the load balancer. The draft carries this option out BY DEFAULT for the Kubernetes API of a cluster whose source endpoint is private (stackit_ske_cluster, extensions.acl): of the three options it is the only one that is production grade (the ACL-restricted public control plane is GA, the network-area-only control plane is a Private Preview on request, not recommended for production, and cannot be combined with the ACL extension) and it is fail-closed, because only the CIDRs of the access list may connect. The decision stays OPEN with this option marked DEFAULT; the access list stays a required variable with no default (no CIDR is invented, and neither the cluster's own egress addresses nor a STACKIT range is a fallback, because the source's private clients are the admin and CI networks only the customer knows) that refuses an empty list, so the step of the cluster waits for the networks the person lists and not for the decision. The draft carries it out by default for a managed data service (stackit_postgresflex_instance, stackit_sqlserverflex_instance, stackit_mariadb_instance, stackit_mongodbflex_instance, stackit_valkey_instance, stackit_opensearch_instance, stackit_rabbitmq_instance, stackit_redis_instance) as well, on the same grounds and only when all of these hold: the decision is open and no review declines it; the access list the block writes (acl, sgw_acl) is one variable the draft wrote, of type list(string), with no default, that refuses an empty list, an empty entry and null; and the draft could not derive the clients' addresses (where every client is a drafted cluster or a drafted server with a public address the access list already has those addresses as its default, and the decision stands on that default). Of the options, accept-the-public-endpoint is the only one that is generally available for every data service (the network-area-only scope is a Private Preview for enabled accounts and exists for PostgreSQL Flex and SQL Server Flex only), and with a required, non-empty list it is fail-closed: only the CIDRs the person lists may connect. No CIDR is invented, and STACKIT's documented service ranges are no fallback. The default applies to a source that is private and to one whose exposure cannot be read, because the draft writes the same fail-closed endpoint for both. The access-scope variable of PostgreSQL Flex and SQL Server Flex keeps no default, and the critical network exposure of the unit stays open for the assurance until a review that chooses this option also states an exposure_acceptance (its statement and scope), which records the public endpoint as an accepted design change naming the reviewer, never as an equivalent. A review that names another option for the record, or rejects the proposal, declines the default. A cluster whose source endpoint is public gets no decision: its public_access_cidrs are the access list.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_instance.md#L105", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-22", "quote": "acl (List of String) The Access Control List (ACL) for the PostgresFlex instance." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/sqlserverflex_instance.md#L93", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-22", "quote": "acl (List of String) List of IPV4 cidr." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_instance.md#L64", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-22", "quote": "sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L162", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-22", "quote": "Nested Schema for extensions.acl — Required: allowed_cidrs (List of String) Specify a list of CIDRs to whitelist. enabled (Boolean) Is ACL enabled?" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_instance.md#L79", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_instance.md#L68", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/rabbitmq_instance.md#L70", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/redis_instance.md#L82", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L469", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "access_control (Attributes) Use this option to limit the IP ranges that can use the Application Load Balancer. ... allowed_source_ranges (Set of String) Application Load Balancer is accessible only from an IP address in this range." }, { "url": "https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/configure-access-control-for-your-cluster/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "ACLs only control access to the API of the public control plane. You cannot combine ACLs with a private control plane (accessScope: \"SNA\"), because the two features are mutually exclusive. You can use ACLs with a public cluster, or use a private cluster without ACLs. (page last updated on Aug 19, 2026; the page carries no Private Preview or beta notice)" }, { "url": "https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/enable-private-clusters/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "This feature is currently in Private Preview and available only upon request. It is under active development, subject to breaking changes without prior notice, and not recommended for production use. ... Private clusters (accessScope: \"SNA\") and the ACL extension (extensions.acl.enabled = true) are mutually exclusive and cannot be combined. (page last updated on Oct 1, 2026; the default for the Kubernetes API of a private EKS endpoint is the ACL-restricted public control plane because it is the only option of the decision that is GA)" } ], "default": true }, { "id": "use-the-network-area-only-scope", "title": "Use the network-area-only scope (SNA) instead of the public endpoint (Private Preview, on request)", "effect": "Maturity by target. stackit_ske_cluster: SNA private control plane: Private Preview, on request, not for production, no ACL extension (private preview; the documentation says the feature is available only upon request, is under active development, subject to breaking changes without prior notice, and not recommended for production use, and that a private cluster and the ACL extension are mutually exclusive: the GA way to restrict the Kubernetes API is the ACL-restricted public control plane, which is not the source's private endpoint). stackit_postgresflex_instance and stackit_sqlserverflex_instance: private preview (the provider documents access_scope as a private preview for enabled accounts). stackit_mariadb_instance, stackit_valkey_instance, stackit_opensearch_instance, stackit_rabbitmq_instance, stackit_redis_instance and stackit_application_load_balancer: not offered (no access scope; the redesign option applies). What the option means: The endpoint is reachable only inside a STACKIT Network Area: access_scope = SNA of stackit_postgresflex_instance and stackit_sqlserverflex_instance, network.control_plane.access_scope = SNA of stackit_ske_cluster (immutable). The scope is a private preview, permitted for enabled accounts only (a request of another account is rejected). The draft does not write it, so the draft is regenerated (or changed) with the scope before the step is applied. The pinned provider documents no access scope for stackit_mariadb_instance: there it is a redesign. Neither does it for stackit_valkey_instance (Key Value Store), stackit_opensearch_instance, stackit_rabbitmq_instance or stackit_redis_instance, whose access is set by parameters.sgw_acl only (the pinned STACKIT provider schema): for a private cache, search domain or broker there is no network-area-only option: the way out is a redesign, so the draft is changed before the step is applied. Neither does it for stackit_application_load_balancer, whose options are access_control, ephemeral_address, observability and private_network_only (accessible only via a private network address, not changeable after creation): there the way out is a redesign (a private load balancer, or the restriction in front of it), so the draft is regenerated or changed before the step is applied.", "execution_effect": "REGENERATE_REQUIRED", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_instance.md#L104", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-22", "quote": "access_scope (String) The network access scope of the instance. This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected. Possible values are: PUBLIC, SNA." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/sqlserverflex_instance.md#L92", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-22", "quote": "access_scope (String) The network access scope of the instance. This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected. Possible values are: PUBLIC, SNA." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L249", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-22", "quote": "access_scope (String) Access scope of the control plane. It defines if the Kubernetes control plane is public or only available inside a STACKIT Network Area. This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected.Possible values are: PUBLIC, SNA. The field is immutable!" }, { "url": "https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/enable-private-clusters/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "This feature is currently in Private Preview and available only upon request. It is under active development, subject to breaking changes without prior notice, and not recommended for production use. Private Preview products and features are available “as is” and might have limited support. ... Private clusters (accessScope: \"SNA\") and the ACL extension (extensions.acl.enabled = true) are mutually exclusive and cannot be combined. (page last updated on Oct 1, 2026)" }, { "url": "https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/networking/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "By default, your Kubernetes control plane is exposed to the public internet. This is equivalent to setting accessScope: \"PUBLIC\". If you set accessScope: \"SNA\" instead, your Kubernetes control plane will only be exposed within the SNA. This is called a private SKE cluster. ... Private clusters (\"accessScope\": \"SNA\") and the ACL extension (\"acl\": { \"enabled\": true }) are mutually exclusive. If you need the ACL extension, you can’t use a private cluster. (page last updated on Oct 14, 2026)" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_instance.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-22", "quote": "searched mariadb_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L469", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "access_control (Attributes) Use this option to limit the IP ranges that can use the Application Load Balancer. ... allowed_source_ranges (Set of String) Application Load Balancer is accessible only from an IP address in this range." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_instance.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "searched valkey_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_instance.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "searched opensearch_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/rabbitmq_instance.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "searched rabbitmq_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/redis_instance.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "searched redis_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L472", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "searched application_load_balancer.md for access_scope and SNA: no match; Nested Schema for options lists access_control, ephemeral_address, observability and private_network_only (Boolean) Application Load Balancer is accessible only via a private network ip address. Not changeable after creation." } ] }, { "id": "redesign-the-endpoint", "title": "Redesign how the clients reach the endpoint (no private option offered or not usable)", "effect": "Neither the GA option (a public endpoint limited by an access list, wider than the source's) nor the Private Preview option (SNA: on request, not for production, and for stackit_ske_cluster not together with the ACL extension) is taken: a person designs how the clients reach the endpoint and carries it out, and the drafted step stays held until the design is recorded. Not offered: stackit_mariadb_instance, stackit_valkey_instance, stackit_opensearch_instance, stackit_rabbitmq_instance, stackit_redis_instance and stackit_application_load_balancer offer no network-area-only scope, so a redesign is the only way to a private endpoint there. For the Kubernetes API of stackit_ske_cluster the documentation names the source addresses an ACL has to allow (corporate NAT gateways, VPN egress addresses, bastion hosts, CI/CD pipeline egress addresses); a private cluster is a design only after STACKIT enabled the Private Preview for the project and the owner has accepted its maturity and the loss of the ACL extension.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/configure-access-control-for-your-cluster/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Make sure to allow the source IPs that actually reach the Kubernetes API server. This includes corporate NAT gateways, VPN egress addresses, bastion hosts, and CI/CD pipeline egress addresses." }, { "url": "https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/enable-private-clusters/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Open a ticket with STACKIT Support to request access for your organization or project." } ] } ], "recommended_option": null, "defaults": [ { "member": "convert:module.dependencies.aws_mq_broker.mq:exposure:EXPOSURE_WIDENED", "option": "accept-the-public-endpoint", "words": "StackToIT carried out the option accept-the-public-endpoint for stackit_rabbitmq_instance.dependencies_mq by default: the RabbitMQ instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.orders_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_mq_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.", "answered_by": "DEFAULT" }, { "member": "convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:exposure:EXPOSURE_WIDENED", "option": "accept-the-public-endpoint", "words": "StackToIT carried out the option accept-the-public-endpoint for stackit_opensearch_instance.dependencies_catalog_opensearch_this by default: the OpenSearch instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.catalog_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_catalog_opensearch_this_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.", "answered_by": "DEFAULT" }, { "member": "convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED", "option": "accept-the-public-endpoint", "words": "StackToIT carried out the option accept-the-public-endpoint for stackit_mariadb_instance.dependencies_catalog_rds_this by default: the MariaDB instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.catalog_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_catalog_rds_this_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.", "answered_by": "DEFAULT" }, { "member": "convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:exposure:EXPOSURE_WIDENED", "option": "accept-the-public-endpoint", "words": "StackToIT carried out the option accept-the-public-endpoint for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default by default: the Valkey instance keeps its own public STACKIT endpoint, and only the CIDRs of var.dependencies_checkout_elasticache_redis_default_allowed_cidrs may connect; the clients of the source could not be mapped to addresses, no CIDR is invented, so the variable has no default and the step waits for the networks you list. The draft writes no default list of the clients' addresses: the rule module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed[\"in#in#sg#0\"] is no plain allow of a complete list of clients. Name the networks the clients connect from. To change it, answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.", "answered_by": "DEFAULT" }, { "member": "convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED", "option": "accept-the-public-endpoint", "words": "StackToIT carried out the option accept-the-public-endpoint for stackit_postgresflex_instance.dependencies_orders_rds_this by default: the PostgreSQL Flex instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.orders_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_orders_rds_this_allowed_cidrs, or answer this decision in decisions.yaml with use-the-network-area-only-scope or redesign-the-endpoint (or reject the proposal): the next run then writes no default.", "answered_by": "DEFAULT" } ], "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.aws_mq_broker.mq", "artifact": "workspace.json", "pointer": "/units/0/trace" }, { "kind": "evidence", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "artifact": "workspace.json", "pointer": "/units/5/trace" }, { "kind": "evidence", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/9/trace" }, { "kind": "evidence", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "artifact": "workspace.json", "pointer": "/units/13/trace" }, { "kind": "evidence", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/22/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:423e4ba2d45f712b067c92f5838a736429f1ad4d536c2a73854bfed78e11de19", "artifact_sha256": "sha256:6a3930f51ec64054caff9296506c7e1d98a191a1b856d8742e3f58fb75e37071", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.mq_broker/network-exposure", "sha256": "sha256:482ab593cf1842106a10069b233b2563f12a1e021bc0faa72f6f54a896ecfd73" }, { "kind": "decision_kind", "id": "convert/EXPOSURE_WIDENED", "sha256": "sha256:f079f79b23d703a3708c4883230a49d0572f7f2dccd4fdb7972defbce84513ad" }, { "kind": "review_cause", "id": "convert/EXPOSURE_WIDENED", "sha256": "sha256:fb3924b78b2b793d51a4edfba69fadc3e4f28d576808d9aad0f362b264b84410" } ], "kb_dependencies_sha256": "sha256:54db0cb3f0a546a487cbbf2ad23a0bc21bc2410cb91089a25cec295baf9709b2" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 5 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The draft turns an endpoint that is private in the source into a public one on STACKIT (5 converter decisions): the step that creates it is not executable until a person accepts the exposure or chooses what the target offers instead, and the unit that owns one is not automation-eligible until then. It also holds the open critical semantic that the knowledge base leaves open for the same question of the same unit (the same ledger row): an answer to this record answers both, and the semantic stays open in assurance/critical-semantics.json, where a review closes nothing.", "required_evidence": [ "the exposure of the source module.dependencies.module.catalog_rds.aws_rds_cluster.this is not readable (it states no publicly_accessible setting, or one that a variable without a value or a default decides), so the source is not proven publicly accessible and the draft does not take it as public; the STACKIT instance has its own IPv4 endpoint outside the project network, limited by its access list, which is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods) by default, so the exposure is a decision and not a preserved property", "the exposure of the source module.dependencies.module.orders_rds.aws_rds_cluster.this is not readable (it states no publicly_accessible setting, or one that a variable without a value or a default decides), so the source is not proven publicly accessible and the draft does not take it as public; the STACKIT instance has its own IPv4 endpoint outside the project network, limited by its access list, which is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods) by default, so the exposure is a decision and not a preserved property", "the source module.dependencies.aws_mq_broker.mq is private (the broker states publicly_accessible = false: it is reached from inside the VPC that hosts its subnets) and the STACKIT RabbitMQ instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has the empty list as its default, which the block replaces by the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods)); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property", "the source module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is private (the domain states vpc_options: it is reached from inside its VPC) and the STACKIT OpenSearch instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has the empty list as its default, which the block replaces by the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods)); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property", "the source module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is private (Amazon ElastiCache has no public endpoint: the cache is reached from inside its VPC through its subnet group) and the STACKIT Valkey instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has no default and rejects an empty list, so the list is yours); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property", "whether the clients of the source endpoint can reach a public address limited by an access list, or need the endpoint inside the network (and, for the network-area-only scope, that the STACKIT account is enabled for the private preview)", "for an Application Load Balancer: the client ranges the source security groups admit on each listener port, and the addresses of the clients they name by a group reference or a prefix list" ], "resolution": { "decision_id": "DEC-GEN-CONVERT-EXPOSURE-WIDENED", "source_family": "convert", "source_semantic": "EXPOSURE_WIDENED", "affected_units": [ "module.dependencies.aws_mq_broker.mq", "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "module.dependencies.module.orders_rds.aws_rds_cluster.this" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "network-security", "owner_role": "Security Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "guidance_ref": "convert-exposure-widened-public-endpoint/EXPOSURE_WIDENED:exposure", "state_reason": "a person's decision or input is still open", "source_observation": "The source states the setting on module.dependencies.aws_mq_broker.mq. The plan leaves this decision open on module.dependencies.aws_mq_broker.mq, module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and 1 more. A database, a cache (Key Value Store), a search domain (OpenSearch), a message broker (RabbitMQ) or a Kubernetes API that is not public on the source gets a public STACKIT endpoint, limited by an access list of IP networks. PostgreSQL Flex, SQL Server Flex and the Kubernetes control plane also offer a network-area-only scope, a private preview for enabled accounts only; the provider read documents no such scope for MariaDB, Key Value Store, OpenSearch or RabbitMQ, whose access is set by the access list only. Maturity of the ways out for the Kubernetes API: the ACL-restricted public control plane is GA and is not the source's private endpoint; the SNA private control plane is Private Preview, on request, not for production, and cannot be combined with the ACL extension.", "generated_target_behavior": "The draft does not carry the setting on module.dependencies.aws_mq_broker.mq. The draft carries the default accept-the-public-endpoint out (answered by DEFAULT: nobody answered the decision), and the decision stays open. The database, cache, search domain, message broker or Kubernetes API is written with its public endpoint and its access list. The step that creates the endpoint waits for this decision.", "residual_difference": "That only the clients the source admitted reach the endpoint on the target.", "execution_effect": "No step waits for it. The plan can start TF/stackit_rabbitmq_instance.dependencies_mq, TF/stackit_mariadb_instance.dependencies_catalog_rds_this, TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default, TF/stackit_postgresflex_instance.dependencies_orders_rds_this and MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect now. Held by something else first: TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this.", "next_action": "Decide how the clients reach an endpoint the draft exposes more widely for module.dependencies.aws_mq_broker.mq, module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and 1 more: choose one of the 3 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The broker is either reachable from the public internet or only from private networks." ], "closes_when": [ "The knowledge base states no closing condition for a decision of the plan; it is done when an answer in the decisions file accepts the public endpoint with its access list, or when the regenerated draft carries the network-area-only scope or the redesign and the step that creates the endpoint is free.", "A person sets which networks may reach the STACKIT RabbitMQ instance with its access list (a list of CIDR networks); the draft sets none." ], "required_inputs": [ "the exposure of the source module.dependencies.module.catalog_rds.aws_rds_cluster.this is not readable (it states no publicly_accessible setting, or one that a variable without a value or a default decides), so the source is not proven publicly accessible and the draft does not take it as public; the STACKIT instance has its own IPv4 endpoint outside the project network, limited by its access list, which is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods) by default, so the exposure is a decision and not a preserved property", "the exposure of the source module.dependencies.module.orders_rds.aws_rds_cluster.this is not readable (it states no publicly_accessible setting, or one that a variable without a value or a default decides), so the source is not proven publicly accessible and the draft does not take it as public; the STACKIT instance has its own IPv4 endpoint outside the project network, limited by its access list, which is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods) by default, so the exposure is a decision and not a preserved property", "the source module.dependencies.aws_mq_broker.mq is private (the broker states publicly_accessible = false: it is reached from inside the VPC that hosts its subnets) and the STACKIT RabbitMQ instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has the empty list as its default, which the block replaces by the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods)); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property", "the source module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is private (the domain states vpc_options: it is reached from inside its VPC) and the STACKIT OpenSearch instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has the empty list as its default, which the block replaces by the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods)); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property", "the source module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is private (Amazon ElastiCache has no public endpoint: the cache is reached from inside its VPC through its subnet group) and the STACKIT Valkey instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has no default and rejects an empty list, so the list is yours); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property", "whether the clients of the source endpoint can reach a public address limited by an access list, or need the endpoint inside the network (and, for the network-area-only scope, that the STACKIT account is enabled for the private preview)", "for an Application Load Balancer: the client ranges the source security groups admit on each listener port, and the addresses of the clients they name by a group reference or a prefix list" ], "resolution_paths": [ { "id": "accept-the-public-endpoint", "title": "Accept the public endpoint, limited by its access list", "prerequisites": [ "the client networks that must reach the endpoint, in its access list", "the owner's statement that the wider exposure is accepted" ], "effects": [ "The draft is applied as written and the wider exposure is an accepted difference." ], "risk": [ "Every address the access list admits reaches the endpoint over the internet." ], "evidence": [ "decision kind convert.EXPOSURE_WIDENED of the knowledge base: \"The endpoint the draft writes is applied as written: the instance (or the Kubernetes API) is reached at its public address, and only the IP networks of its access list may connect\"" ], "regeneration_required": false }, { "id": "use-the-network-area-only-scope", "title": "Use the network-area-only scope instead of the public endpoint (Private Preview, on request)", "prerequisites": [ "a STACKIT account enabled for the private preview, and the clients inside the Network Area", "for the Kubernetes control plane: the owner's acceptance that the private control plane is not recommended for production and cannot carry the ACL extension", "the draft regenerated or changed with the scope before the step is applied" ], "effects": [ "The database or the Kubernetes API is reachable only inside the Network Area. MariaDB, the Key Value Store, OpenSearch and RabbitMQ take no such scope: for them this path is a redesign." ], "risk": [ "A request of an account that is not enabled is rejected, and the scope of the Kubernetes control plane cannot be changed later. A private preview is not for production: the documentation says it is subject to breaking changes without prior notice." ], "evidence": [ "decision kind convert.EXPOSURE_WIDENED of the knowledge base: \"access_scope (String) The network access scope of the instance. This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected. Possible values are: PUBLIC, SNA.\"", "decision kind convert.EXPOSURE_WIDENED of the knowledge base: \"SNA private control plane: Private Preview, on request, not for production, no ACL extension\"", "decision kind convert.EXPOSURE_WIDENED of the knowledge base: \"The pinned provider documents no access scope for stackit_mariadb_instance: there it is a redesign.\"", "decision kind convert.EXPOSURE_WIDENED of the knowledge base: \"Neither does it for stackit_valkey_instance (Key Value Store), stackit_opensearch_instance, stackit_rabbitmq_instance or stackit_redis_instance, whose access is set by parameters.sgw_acl only\"" ], "regeneration_required": true }, { "id": "redesign-the-endpoint", "title": "Redesign how the clients reach the endpoint", "prerequisites": [ "a design of the access that neither widens the exposure to an access list nor depends on a private preview the owner has not accepted" ], "effects": [ "A person designs and carries out the access; the drafted step stays held until the design is recorded. Where the service offers no network-area-only scope (MariaDB, Key Value Store, OpenSearch, RabbitMQ, Redis, the Application Load Balancer) this is the only way to a private endpoint." ], "risk": [ "A redesign needs its own proof; the draft does not carry it." ], "evidence": [ "decision kind convert.EXPOSURE_WIDENED of the knowledge base: \"Not offered: stackit_mariadb_instance, stackit_valkey_instance, stackit_opensearch_instance, stackit_rabbitmq_instance, stackit_redis_instance and stackit_application_load_balancer offer no network-area-only scope, so a redesign is the only way to a private endpoint there.\"" ], "regeneration_required": true } ], "required_verification": [ "a connection from an address outside the access list is refused by the target endpoint, and one from a client the source admitted is served", "the decision is recorded with who decided, its scope and its reason" ], "next_run_changes": [ "An answer that accepts the endpoint frees the step on the current draft; the network-area-only scope needs a regenerated or changed draft, so its answer frees nothing until then." ], "remains_manual": [ "Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "the generator of the draft: \"so the execution plan blocks that step (fromconvert) until a person has decided\"", "decision kind convert.EXPOSURE_WIDENED of the knowledge base: \"acl (List of String) The Access Control List (ACL) for the PostgresFlex instance.\"", "decision kind convert.EXPOSURE_WIDENED of the knowledge base: \"sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance.\"" ], "related_execution_steps": [ { "id": "TF/stackit_rabbitmq_instance.dependencies_mq", "mode": "TERRAFORM", "phase": "PLATFORM", "executable": true, "waits_for_this": false }, { "id": "TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this", "mode": "TERRAFORM", "phase": "PLATFORM", "executable": false, "waits_for_this": false }, { "id": "TF/stackit_mariadb_instance.dependencies_catalog_rds_this", "mode": "TERRAFORM", "phase": "PLATFORM", "executable": true, "waits_for_this": false }, { "id": "TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default", "mode": "TERRAFORM", "phase": "DATA", "executable": true, "waits_for_this": false }, { "id": "TF/stackit_postgresflex_instance.dependencies_orders_rds_this", "mode": "TERRAFORM", "phase": "PLATFORM", "executable": true, "waits_for_this": false }, { "id": "MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH", "kind": "INGRESS_EXPOSURE_PATH", "family": "convert", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-convert", "block": "INGRESS_EXPOSURE_PATH", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.alb.aws_lb.this", "artifact": "assessment.json", "pointer": "/units/28" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "convert:module.retail_app_ecs.module.alb.aws_lb.this:target_pools:INGRESS_EXPOSURE_PATH", "artifact": "workspace.json", "pointer": "/units/35/deployment_prerequisites/open_decisions/1" } ], "options": [ { "id": "nodeport-alb-target-pool", "title": "Keep the draft: a NodePort Service of each workload and the target pool on its node port at the private IPs of the cluster's nodes", "effect": "The manifest of each workload writes a Service of type NodePort with the node port the target pool of the drafted Application Load Balancer listens on, and the pool's targets are the private IPs of the nodes of the SKE cluster, which a person sets and keeps current: the nodes change as the node pool scales and is updated, and a node missing from the list receives no traffic. The health check of the pool reaches the pods through the same node port. The draft applies as written once the IPs are set.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L420", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "ip (String) Private target IP, which must by unique within a target pool." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L70-L76", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Read-Only: egress_address_ranges, id, kubernetes_version_used, pod_address_ranges, service_account_issuer (searched the resource documentation: no attribute holds the addresses of the nodes)" }, { "url": "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L88", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-10-26", "quote": "type = \"NodePort\" (the Service of the workload a STACKIT Application Load Balancer reaches on SKE)" } ], "default": true }, { "id": "ingress-controller-behind-alb", "title": "Run an Ingress controller on the cluster and put the load balancer in front of it", "effect": "An Ingress controller (for example ingress-nginx, installed by a Helm release) runs on the SKE cluster and routes the requests by Ingress rules to the ClusterIP Services of the workloads; the load balancer reaches the controller, on the controller's node port at the private IPs of the nodes (the target pool of the draft changed to that port) or through the controller's own Service of type LoadBalancer. The draft writes neither the controller nor the Ingress rules: a person carries it out, and the load balancer's step stays held.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L420", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "ip (String) Private target IP, which must by unique within a target pool." }, { "url": "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-nginx-rate-limit/070-helm.tf#L15-L18", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-10-26", "quote": "resource \"helm_release\" \"ingress_nginx\" { name = \"ingress-nginx\" repository = \"https://kubernetes.github.io/ingress-nginx\" chart = \"ingress-nginx\"" } ] }, { "id": "stackit-alb-ingress-controller", "title": "Use the STACKIT ALB as the Ingress: the SKE Application Load Balancer extension", "effect": "The Application Load Balancer extension of the SKE cluster is enabled (extensions.application_load_balancer.enabled of stackit_ske_cluster; in private preview, only for enabled accounts) and each workload gets an Ingress of an IngressClass of the controller stackit.cloud/alb-ingress over a Service of type NodePort, the only network mode the controller supports; the controller provisions the Application Load Balancer through the STACKIT API, so the stackit_application_load_balancer block of the draft is not applied. The draft writes neither the extension nor the Ingress: a person carries it out, and the load balancer's step stays held.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L171", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`enabled` (Boolean) Enables the application load balancer extension. Note: This feature is in private preview. Enabling application load balancer extension is only possible for enabled accounts. Otherwise the request will be rejected." }, { "url": "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/ARCHITECTURE.md#L5", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-10-26", "quote": "The STACKIT ALB Controller implements the standard Kubernetes Ingress controller pattern: it watches `IngressClass` and `Ingress` objects and translates them into a fully managed STACKIT Application Load Balancer." }, { "url": "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L25-L33", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-10-26", "quote": "# Mandatory; NodePort is currently the only supported network mode. \"alb.stackit.cloud/network-mode\" = \"NodePort\" ... controller = \"stackit.cloud/alb-ingress\"" }, { "url": "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L88", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-10-26", "quote": "type = \"NodePort\" (the Service of the workload a STACKIT Application Load Balancer reaches on SKE)" } ] } ], "recommended_option": "nodeport-alb-target-pool", "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.alb.aws_lb.this", "artifact": "workspace.json", "pointer": "/units/35/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:d7bf04a14592c56905fb4aaaf64310c4a399ab5a50cefaace7cdb6f7435abf4a", "artifact_sha256": "sha256:f4d05a27ee3dc30c9802a025a3ba2390b8efe68eba7027ef1a0a9d29bc87a4d0", "kb_dependencies": [ { "kind": "decision_kind", "id": "convert/INGRESS_EXPOSURE_PATH", "sha256": "sha256:aeeeb5d82a419af9f7f2e8a4af53b39a744fa32385636f4ba3a967f1e567294e" }, { "kind": "review_cause", "id": "convert/INGRESS_EXPOSURE_PATH", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:9a087b808a89168f09e6e245d0b89524c03ac3e758f07e554c71661a6068b367" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "unblocks": { "holds": 66, "stuck": 63, "alone": 0, "shared": 3, "steps": [], "best_option": "nodeport-alb-target-pool", "options": [ { "option": "nodeport-alb-target-pool", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 0, "shared": 3 }, { "option": "ingress-controller-behind-alb", "effects": [ "NOT_STATED" ], "alone": 0, "shared": 0 }, { "option": "stackit-alb-ingress-controller", "effects": [ "NOT_STATED" ], "alone": 0, "shared": 0 } ] }, "why": "The converter could not prove what the source means by the ingress exposure path (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides.", "required_evidence": [ "a STACKIT target pool reaches its targets by private IP and the SKE cluster exports no node address to Terraform, so a Kubernetes workload is reachable from the load balancer only through a node port at the IPs of the nodes, which change as the node pool scales and is updated, or through an Ingress controller; the source registered the tasks of the service by their own IPs (awsvpc)", "for the drafted path: the private IPs of the nodes of the SKE cluster the target pool lists, and who keeps them current as the node pool scales and is updated", "for an Ingress controller: the controller, how the load balancer reaches it (its node port at the node IPs, or its own Service of type LoadBalancer) and the Ingress rules of each workload", "for the STACKIT ALB as the Ingress: that the account may enable the Application Load Balancer extension of SKE (private preview), and the IngressClass and Ingress of each workload" ], "resolution": { "decision_id": "DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH", "source_family": "convert", "source_semantic": "INGRESS_EXPOSURE_PATH", "affected_units": [ "module.retail_app_ecs.module.alb.aws_lb.this" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "TARGET_DESIGN_OPEN", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": "nodeport-alb-target-pool", "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The plan leaves this decision open on module.retail_app_ecs.module.alb.aws_lb.this.", "generated_target_behavior": "The draft holds TF/stackit_application_load_balancer.retail_app_ecs_alb_this until this decision is answered by an answer that frees it.", "residual_difference": "the target design is open until the decision is answered", "execution_effect": "1 step waits for it until it is answered: TF/stackit_application_load_balancer.retail_app_ecs_alb_this.", "next_action": "Decide how a load balancer reaches a workload on SKE for module.retail_app_ecs.module.alb.aws_lb.this: choose one of the 3 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "The converter could not prove what the source means by the ingress exposure path (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides." ], "closes_when": [ "an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option" ], "required_inputs": [ "a STACKIT target pool reaches its targets by private IP and the SKE cluster exports no node address to Terraform, so a Kubernetes workload is reachable from the load balancer only through a node port at the IPs of the nodes, which change as the node pool scales and is updated, or through an Ingress controller; the source registered the tasks of the service by their own IPs (awsvpc)", "for the drafted path: the private IPs of the nodes of the SKE cluster the target pool lists, and who keeps them current as the node pool scales and is updated", "for an Ingress controller: the controller, how the load balancer reaches it (its node port at the node IPs, or its own Service of type LoadBalancer) and the Ingress rules of each workload", "for the STACKIT ALB as the Ingress: that the account may enable the Application Load Balancer extension of SKE (private preview), and the IngressClass and Ingress of each workload" ], "resolution_paths": [ { "id": "nodeport-alb-target-pool", "title": "Keep the draft: a NodePort Service of each workload and the target pool on its node port at the private IPs of the cluster's nodes", "prerequisites": [], "effects": [ "The manifest of each workload writes a Service of type NodePort with the node port the target pool of the drafted Application Load Balancer listens on, and the pool's targets are the private IPs of the nodes of the SKE cluster, which a person sets and keeps current: the nodes change as the node pool scales and is updated, and a node missing from the list receives no traffic. The health check of the pool reaches the pods through the same node port. The draft applies as written once the IPs are set." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L420", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L70-L76", "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L88" ], "regeneration_required": false }, { "id": "ingress-controller-behind-alb", "title": "Run an Ingress controller on the cluster and put the load balancer in front of it", "prerequisites": [], "effects": [ "An Ingress controller (for example ingress-nginx, installed by a Helm release) runs on the SKE cluster and routes the requests by Ingress rules to the ClusterIP Services of the workloads; the load balancer reaches the controller, on the controller's node port at the private IPs of the nodes (the target pool of the draft changed to that port) or through the controller's own Service of type LoadBalancer. The draft writes neither the controller nor the Ingress rules: a person carries it out, and the load balancer's step stays held." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L420", "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-nginx-rate-limit/070-helm.tf#L15-L18" ], "regeneration_required": false }, { "id": "stackit-alb-ingress-controller", "title": "Use the STACKIT ALB as the Ingress: the SKE Application Load Balancer extension", "prerequisites": [], "effects": [ "The Application Load Balancer extension of the SKE cluster is enabled (extensions.application_load_balancer.enabled of stackit_ske_cluster; in private preview, only for enabled accounts) and each workload gets an Ingress of an IngressClass of the controller stackit.cloud/alb-ingress over a Service of type NodePort, the only network mode the controller supports; the controller provisions the Application Load Balancer through the STACKIT API, so the stackit_application_load_balancer block of the draft is not applied. The draft writes neither the extension nor the Ingress: a person carries it out, and the load balancer's step stays held." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L171", "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/ARCHITECTURE.md#L5", "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L25-L33", "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L88" ], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L420", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L70-L76", "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L88", "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-nginx-rate-limit/070-helm.tf#L15-L18", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L171", "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/ARCHITECTURE.md#L5", "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L25-L33" ], "related_execution_steps": [ { "id": "TF/stackit_application_load_balancer.retail_app_ecs_alb_this", "mode": "TERRAFORM", "phase": "PLATFORM", "executable": false, "waits_for_this": true } ] } }, { "id": "DEC-GEN-CONVERT-POD-SEGMENTATION", "kind": "POD_SEGMENTATION", "family": "convert", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-convert", "block": "POD_SEGMENTATION", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "artifact": "assessment.json", "pointer": "/units/13" }, { "kind": "unit", "id": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "artifact": "assessment.json", "pointer": "/units/15" }, { "kind": "unit", "id": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "artifact": "assessment.json", "pointer": "/units/17" }, { "kind": "unit", "id": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "artifact": "assessment.json", "pointer": "/units/19" }, { "kind": "unit", "id": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "artifact": "assessment.json", "pointer": "/units/21" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "convert:module.retail_app_ecs.module.carts_service.aws_security_group.this:security-group:POD_SEGMENTATION", "artifact": "workspace.json", "pointer": "/units/43/deployment_prerequisites/open_decisions/0" }, { "kind": "plan_decision", "id": "convert:module.retail_app_ecs.module.catalog_service.aws_security_group.this:security-group:POD_SEGMENTATION", "artifact": "workspace.json", "pointer": "/units/47/deployment_prerequisites/open_decisions/0" }, { "kind": "plan_decision", "id": "convert:module.retail_app_ecs.module.checkout_service.aws_security_group.this:security-group:POD_SEGMENTATION", "artifact": "workspace.json", "pointer": "/units/51/deployment_prerequisites/open_decisions/0" }, { "kind": "plan_decision", "id": "convert:module.retail_app_ecs.module.orders_service.aws_security_group.this:security-group:POD_SEGMENTATION", "artifact": "workspace.json", "pointer": "/units/55/deployment_prerequisites/open_decisions/0" }, { "kind": "plan_decision", "id": "convert:module.retail_app_ecs.module.ui_service.aws_security_group.this:security-group:POD_SEGMENTATION", "artifact": "workspace.json", "pointer": "/units/59/deployment_prerequisites/open_decisions/0" } ], "aliases": [ { "id": "convert:module.retail_app_ecs.module.carts_service.aws_security_group.this:security-group:POD_SEGMENTATION", "source": "PLAN_DECISION", "subject": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "display_id": "DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this" }, { "id": "convert:module.retail_app_ecs.module.catalog_service.aws_security_group.this:security-group:POD_SEGMENTATION", "source": "PLAN_DECISION", "subject": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "display_id": "DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this" }, { "id": "convert:module.retail_app_ecs.module.checkout_service.aws_security_group.this:security-group:POD_SEGMENTATION", "source": "PLAN_DECISION", "subject": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "display_id": "DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this" }, { "id": "convert:module.retail_app_ecs.module.orders_service.aws_security_group.this:security-group:POD_SEGMENTATION", "source": "PLAN_DECISION", "subject": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "display_id": "DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this" }, { "id": "convert:module.retail_app_ecs.module.ui_service.aws_security_group.this:security-group:POD_SEGMENTATION", "source": "PLAN_DECISION", "subject": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "display_id": "DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this" } ], "options": [ { "id": "generate-networkpolicy-from-the-group-rules", "title": "Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group", "effect": "A NetworkPolicy per workload admits the traffic the rules of the source group allowed and nothing else, so the segmentation moves from the interface of the task to the pod. The sources read state that SKE applies NetworkPolicy objects (a default-deny policy of its own in kube-system, and a request to add policies for custom workloads) and give no statement about the policy engine in a workload's namespace, which is checked on the cluster. The draft does not write the NetworkPolicy in this build: a person writes it from the rules of the drafted group, and the group stays a record of what the source allowed.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "With Kubernetes 1.33 there will be a new deny-all NetworkPolicy introduced, which blocks Network Traffic in the namespace kube-system. If there is custom workload in the namespace, please apply additional NetworkPolicies for Ingress and Egress." }, { "url": "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-s3-csi-juicefs/README.md#L59", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-10-26", "quote": "SKE (Gardener) enforces a default-deny `NetworkPolicy` in `kube-system`." } ] }, { "id": "security-group-on-the-nodes", "title": "Carry the segmentation as a STACKIT security group on the nodes (coarser than the source)", "effect": "A security group acts on the network interface that lists it, so on a node and on every pod of it, not on one workload: it is coarser than the source group, which acted on the interface of each task. The provider resource of the cluster has no security group attribute, on the cluster or on a node pool, so the draft cannot write it, and whether the interfaces of the nodes can list a group by another route is not stated by the sources read: a person establishes that with STACKIT before choosing it.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L40", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`security_group_ids` (List of String) The list of security group UUIDs. If security is set to false, setting this field will lead to an error." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "(searched the resource documentation of stackit_ske_cluster, its node_pools nested schema included, and the pinned provider schema 0.120.0: no security group attribute)" } ] }, { "id": "accept-no-segmentation", "title": "Accept that the pods run without the segmentation the source group gave the tasks", "effect": "The group is created as the draft writes it and is attached to nothing; no policy of the draft restricts the traffic to or from the pods, so what the cluster admits to them is its own default, which the sources read do not state for a workload namespace. The loss of the source's restriction is a difference, recorded as accepted with who accepted it and why, never as equivalent.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L40", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`security_group_ids` (List of String) The list of security group UUIDs. If security is set to false, setting this field will lead to an error." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "(searched the resource documentation of stackit_ske_cluster, its node_pools nested schema included, and the pinned provider schema 0.120.0: no security group attribute)" } ] } ], "recommended_option": null, "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "artifact": "workspace.json", "pointer": "/units/43/trace" }, { "kind": "evidence", "id": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "artifact": "workspace.json", "pointer": "/units/47/trace" }, { "kind": "evidence", "id": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "artifact": "workspace.json", "pointer": "/units/51/trace" }, { "kind": "evidence", "id": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "artifact": "workspace.json", "pointer": "/units/55/trace" }, { "kind": "evidence", "id": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "artifact": "workspace.json", "pointer": "/units/59/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:29854ad7b6a2cfd7733fbf071811c930e5023b74bc53cbea83bece2408c8973d", "artifact_sha256": "sha256:4e0ef236960deac4d2b2ebae29798e224cb78827e6fa6fbb95b47aa06542708b", "kb_dependencies": [ { "kind": "decision_kind", "id": "convert/POD_SEGMENTATION", "sha256": "sha256:ebf5a760a2d0635ab2bf4ffe2cfddab5fc9aff76474059b3d6ac5f12b58529fa" }, { "kind": "review_cause", "id": "convert/POD_SEGMENTATION", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" } ], "kb_dependencies_sha256": "sha256:0ab49a10e7889d96d2724e04ceb59d86dea0c9e7505705506b10ad00b58faa14" }, "causes": [ { "cause": "TARGET_LIMIT", "members": 5 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "unblocks": { "holds": 96, "stuck": 65, "alone": 20, "shared": 11, "steps": [ "MAN/security/attachment-design:module.retail_app_ecs.module.carts_service.aws_security_group.this", "MAN/security/accept/module.retail_app_ecs.module.carts_service.aws_security_group.this:open-ingress-application-port", "MAN/security/attachment-design:module.retail_app_ecs.module.catalog_service.aws_security_group.this", "MAN/security/accept/module.retail_app_ecs.module.catalog_service.aws_security_group.this:open-ingress-application-port", "MAN/security/attachment-design:module.retail_app_ecs.module.checkout_service.aws_security_group.this", "MAN/security/accept/module.retail_app_ecs.module.checkout_service.aws_security_group.this:open-ingress-application-port", "MAN/security/attachment-design:module.retail_app_ecs.module.orders_service.aws_security_group.this", "MAN/security/accept/module.retail_app_ecs.module.orders_service.aws_security_group.this:open-ingress-application-port", "MAN/security/attachment-design:module.retail_app_ecs.module.ui_service.aws_security_group.this", "MAN/security/accept/module.retail_app_ecs.module.ui_service.aws_security_group.this:open-ingress-application-port", "MAN/draft/kubernetes/carts/manifests-yaml", "MAN/draft/kubernetes/catalog/manifests-yaml", "MAN/draft/kubernetes/checkout/manifests-yaml", "MAN/draft/kubernetes/orders/manifests-yaml", "MAN/draft/kubernetes/ui/manifests-yaml", "MAN/verify/dns/module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "MAN/verify/dns/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "MAN/verify/dns/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "MAN/verify/dns/module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "MAN/verify/dns/module.retail_app_ecs.module.ui_service.aws_ecs_service.this" ], "best_option": "generate-networkpolicy-from-the-group-rules", "options": [ { "option": "generate-networkpolicy-from-the-group-rules", "effects": [ "MANUAL_ALTERNATIVE" ], "alone": 20, "shared": 11 }, { "option": "security-group-on-the-nodes", "effects": [ "MANUAL_ALTERNATIVE" ], "alone": 20, "shared": 11 }, { "option": "accept-no-segmentation", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 20, "shared": 11 } ] }, "why": "The converter could not prove what the source means by the pod segmentation (5 converter decisions): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides.", "required_evidence": [ "the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision)", "for each workload the record names: the traffic the source group allowed to and from its tasks (the rules of the drafted group) and which of those rules the target still needs", "for a NetworkPolicy: that the cluster enforces NetworkPolicy objects in the workload's namespace, and the labels of the pods the policy selects", "for a security group on the nodes: whether the network interfaces of the nodes of the cluster can list a STACKIT security group at all (the provider resource of the cluster has no attribute for it), and that its rules then act on every pod of a node" ], "resolution": { "decision_id": "DEC-GEN-CONVERT-POD-SEGMENTATION", "source_family": "convert", "source_semantic": "POD_SEGMENTATION", "affected_units": [ "module.retail_app_ecs.module.carts_service.aws_security_group.this", "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "module.retail_app_ecs.module.orders_service.aws_security_group.this", "module.retail_app_ecs.module.ui_service.aws_security_group.this" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "TARGET_DESIGN_OPEN", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The plan leaves this decision open on module.retail_app_ecs.module.carts_service.aws_security_group.this, module.retail_app_ecs.module.catalog_service.aws_security_group.this, module.retail_app_ecs.module.checkout_service.aws_security_group.this, module.retail_app_ecs.module.orders_service.aws_security_group.this and 1 more.", "generated_target_behavior": "The draft holds MAN/security/attachment-design:module.retail_app_ecs.module.carts_service.aws_security_group.this, MAN/security/attachment-design:module.retail_app_ecs.module.catalog_service.aws_security_group.this, MAN/security/attachment-design:module.retail_app_ecs.module.checkout_service.aws_security_group.this, MAN/security/attachment-design:module.retail_app_ecs.module.orders_service.aws_security_group.this and MAN/security/attachment-design:module.retail_app_ecs.module.ui_service.aws_security_group.this until this decision is answered by an answer that frees it.", "residual_difference": "the target design is open until the decision is answered", "execution_effect": "5 steps wait for it until it is answered: MAN/security/attachment-design:module.retail_app_ecs.module.carts_service.aws_security_group.this, MAN/security/attachment-design:module.retail_app_ecs.module.catalog_service.aws_security_group.this, MAN/security/attachment-design:module.retail_app_ecs.module.checkout_service.aws_security_group.this, MAN/security/attachment-design:module.retail_app_ecs.module.orders_service.aws_security_group.this and MAN/security/attachment-design:module.retail_app_ecs.module.ui_service.aws_security_group.this.", "next_action": "Decide how the segmentation of ECS tasks that become pods is carried for module.retail_app_ecs.module.carts_service.aws_security_group.this, module.retail_app_ecs.module.catalog_service.aws_security_group.this, module.retail_app_ecs.module.checkout_service.aws_security_group.this, module.retail_app_ecs.module.orders_service.aws_security_group.this and 1 more: choose one of the 3 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "The converter could not prove what the source means by the pod segmentation (5 converter decisions): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides." ], "closes_when": [ "an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option" ], "required_inputs": [ "the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision)", "for each workload the record names: the traffic the source group allowed to and from its tasks (the rules of the drafted group) and which of those rules the target still needs", "for a NetworkPolicy: that the cluster enforces NetworkPolicy objects in the workload's namespace, and the labels of the pods the policy selects", "for a security group on the nodes: whether the network interfaces of the nodes of the cluster can list a STACKIT security group at all (the provider resource of the cluster has no attribute for it), and that its rules then act on every pod of a node" ], "resolution_paths": [ { "id": "generate-networkpolicy-from-the-group-rules", "title": "Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group", "prerequisites": [], "effects": [ "A NetworkPolicy per workload admits the traffic the rules of the source group allowed and nothing else, so the segmentation moves from the interface of the task to the pod. The sources read state that SKE applies NetworkPolicy objects (a default-deny policy of its own in kube-system, and a request to add policies for custom workloads) and give no statement about the policy engine in a workload's namespace, which is checked on the cluster. The draft does not write the NetworkPolicy in this build: a person writes it from the rules of the drafted group, and the group stays a record of what the source allowed." ], "risk": [], "evidence": [ "https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/", "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-s3-csi-juicefs/README.md#L59" ], "regeneration_required": false }, { "id": "security-group-on-the-nodes", "title": "Carry the segmentation as a STACKIT security group on the nodes (coarser than the source)", "prerequisites": [], "effects": [ "A security group acts on the network interface that lists it, so on a node and on every pod of it, not on one workload: it is coarser than the source group, which acted on the interface of each task. The provider resource of the cluster has no security group attribute, on the cluster or on a node pool, so the draft cannot write it, and whether the interfaces of the nodes can list a group by another route is not stated by the sources read: a person establishes that with STACKIT before choosing it." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L40", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md" ], "regeneration_required": false }, { "id": "accept-no-segmentation", "title": "Accept that the pods run without the segmentation the source group gave the tasks", "prerequisites": [], "effects": [ "The group is created as the draft writes it and is attached to nothing; no policy of the draft restricts the traffic to or from the pods, so what the cluster admits to them is its own default, which the sources read do not state for a workload namespace. The loss of the source's restriction is a difference, recorded as accepted with who accepted it and why, never as equivalent." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L40", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md" ], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/", "https://github.com/stackitcloud/professional-service/blob/main/examples/ske-s3-csi-juicefs/README.md#L59", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L40", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md" ], "related_execution_steps": [ { "id": "MAN/security/attachment-design:module.retail_app_ecs.module.carts_service.aws_security_group.this", "mode": "MANUAL", "phase": "SECURITY", "executable": false, "waits_for_this": true }, { "id": "MAN/security/attachment-design:module.retail_app_ecs.module.catalog_service.aws_security_group.this", "mode": "MANUAL", "phase": "SECURITY", "executable": false, "waits_for_this": true }, { "id": "MAN/security/attachment-design:module.retail_app_ecs.module.checkout_service.aws_security_group.this", "mode": "MANUAL", "phase": "SECURITY", "executable": false, "waits_for_this": true }, { "id": "MAN/security/attachment-design:module.retail_app_ecs.module.orders_service.aws_security_group.this", "mode": "MANUAL", "phase": "SECURITY", "executable": false, "waits_for_this": true }, { "id": "MAN/security/attachment-design:module.retail_app_ecs.module.ui_service.aws_security_group.this", "mode": "MANUAL", "phase": "SECURITY", "executable": false, "waits_for_this": true } ] } }, { "id": "DEC-GEN-CONVERT-SIZE-FROM-SOURCE", "kind": "SIZE_FROM_SOURCE", "family": "convert", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-convert", "block": "SIZE_FROM_SOURCE", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "module.dependencies.aws_mq_broker.mq", "artifact": "assessment.json", "pointer": "/units/30" }, { "kind": "unit", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "artifact": "assessment.json", "pointer": "/units/33" }, { "kind": "unit", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/34" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "convert:module.dependencies.aws_mq_broker.mq:dependencies_mq_plan_name:SIZE_FROM_SOURCE", "artifact": "workspace.json", "pointer": "/units/0/deployment_prerequisites/open_decisions/0" }, { "kind": "plan_decision", "id": "convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:dependencies_checkout_elasticache_redis_default_plan_name:SIZE_FROM_SOURCE", "artifact": "workspace.json", "pointer": "/units/13/deployment_prerequisites/open_decisions/1" }, { "kind": "plan_decision", "id": "convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:dependencies_orders_rds_this_flavor_id:SIZE_FROM_SOURCE", "artifact": "workspace.json", "pointer": "/units/22/deployment_prerequisites/open_decisions/1" } ], "aliases": [ { "id": "convert:module.dependencies.aws_mq_broker.mq:dependencies_mq_plan_name:SIZE_FROM_SOURCE", "source": "PLAN_DECISION", "subject": "module.dependencies.aws_mq_broker.mq", "display_id": "DEC-GEN-CONVERT-SIZE-FROM-SOURCE/module.dependencies.aws_mq_broker.mq" }, { "id": "convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:dependencies_checkout_elasticache_redis_default_plan_name:SIZE_FROM_SOURCE", "source": "PLAN_DECISION", "subject": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "display_id": "DEC-GEN-CONVERT-SIZE-FROM-SOURCE/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default" }, { "id": "convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:dependencies_orders_rds_this_flavor_id:SIZE_FROM_SOURCE", "source": "PLAN_DECISION", "subject": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "display_id": "DEC-GEN-CONVERT-SIZE-FROM-SOURCE/module.dependencies.module.orders_rds.aws_rds_cluster.this" } ], "options": [ { "id": "use-the-size-derived-from-the-source", "title": "Keep the plan or machine type the draft derived from the size of the source", "effect": "The draft already writes the derived plan, flavor or machine type (as the default of the variable for a plan or a machine type, as the literal of the block for a database flavor), said as DEFAULT on the block: the instance or the pool is created with it and the cost page prices it. Confirming it accepts the proposal as the starting size of the target; it does not say that the size carries the load, which the source does not state, and the disk of a plan is the smallest of that size. The memory was compared in bytes: the API states the memory of a PostgreSQL Flex and a SQL Server Flex flavor in Gibibyte, the unit of the source; the plan tables of Key Value Store and RabbitMQ and the MongoDB Flex flavors state their RAM as GB without defining it, so the draft took the plan or flavor that holds the source's memory when a GB is 10^9 bytes (it then holds it when a GB is 2^30 bytes as well) and says where that made it larger than the reading of a GB as a GiB; a machine type's memory is the catalogue's ram_mb read as MiB, an inference the API does not state. The next run writes the same default.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://docs.stackit.cloud/products/databases/key-value-store/reference/service-plans/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-02", "quote": "Single-node service plans do not provide this grade of high availability. Therefore, we strongly advise against using them in production environments." }, { "url": "https://docs.stackit.cloud/products/databases/key-value-store/reference/service-plans/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-02", "quote": "Service Plan | High availability | Number of nodes | vCPU per node | RAM (GB) per node | Disk (GB) per node; keyvalue-1.2.10-Replica | yes | 3 | 1 | 2 | 10; keyvalue-2.8.250-Replica-HiPerf | yes | 3 | 2 (dedicated) | 8 | 250; keyvalue-1.4.10-Single | no | 1 | 1 | 4 | 10 (the cells of the table, joined with ' | ')" }, { "url": "https://docs.stackit.cloud/products/messaging/rabbitmq/reference/service-plans/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-02", "quote": "Service Plan | High availability | Number of nodes | vCPU per node | RAM (GB) per node | Disk per node; RabbitMQ-1.2.10-Replica | yes | 3 | 1 | 2 | 10; RabbitMQ-2.4.10-Single | no | 1 | 2 | 4 | 10; RabbitMQ-8.16.100-replica-HiPerf | yes | 3 | 8¹ | 16 | 100; ^1dedicated CPU for highest performance (the cells of the table, joined with ' | ')" }, { "url": "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/ske/v2/ske.json#L2048", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-11-02", "quote": "Machine.type: \"For valid types please take a look at [provider-options](#tag/ProviderOptions/operation/SkeService_GetProviderOptions) `machineTypes`.\" (provider options: machineTypes, \"List of available machine types\", each with architecture, cpu, gpu, memory and name)" }, { "url": "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L1408", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-11-02", "quote": "flavor.memory: \"The memory of the instance in Gibibyte.\"" }, { "url": "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/sqlserverflex/v3/sqlserverflex.json#L1455", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-11-02", "quote": "flavor.memory: \"The memory of the instance in Gibibyte.\"" }, { "url": "https://docs.stackit.cloud/products/databases/mongodb-flex/reference/flavors-and-performance-classes/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-02", "quote": "Replica set: Description | ID | CPU | RAM (GB); Tiny, Compute optimized | 1.2 | 1 | 2; Tiny, Database optimized | 1.4 | 1 | 4 (the cells of the table, joined with ' | '; the page defines GB nowhere and the mongodb-flex v2 spec types `memory` as an int32 without a description)" }, { "url": "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json#L3660", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-11-02", "quote": "SizeInMB: \"Size in Megabyte.\" (the ram of a MachineType); project quota ram: \"Amount of server RAM in MiB.\"; the provider data source machine_type: \"ram (Number) RAM size in MB\" with the filter example \"vcpus \u003e= 2 \u0026\u0026 ram \u003e= 2048\"" } ], "default": true }, { "id": "choose-the-size", "title": "Set the plan or machine type yourself", "effect": "The next run leaves the variable a required one the owner sets (a plan or a flavor of the catalogue, or a machine type the SKE API lists); the derived default and its DEFAULT line leave the draft, and the step that reads the variable waits for the value. Where the unit of the target's memory is not stated (the GB of a plan table or of a MongoDB Flex flavor), the person who sets the value reads the table in the unit that holds: a plan whose GB is a GiB can be smaller than the one the draft proposed.", "execution_effect": "REGENERATE_REQUIRED", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_instance.md#L36", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-02", "quote": "`plan_name` (String) The selected plan name." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/rabbitmq_instance.md#L36", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-02", "quote": "`plan_name` (String) The selected plan name." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L84", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-02", "quote": "`machine_type` (String) The machine type." } ] } ], "recommended_option": null, "defaults": [ { "member": "convert:module.dependencies.aws_mq_broker.mq:dependencies_mq_plan_name:SIZE_FROM_SOURCE", "option": "use-the-size-derived-from-the-source", "words": "StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.aws_mq_broker.mq by default: var.dependencies_mq_plan_name defaults to stackit-rabbitmq-8.16.50-replica (broker instance type mq.m5.large has 2 vCPU and 8 GiB (AWS price list, mq_broker_sizes.json), and the broker is a single instance: the smallest replica (three nodes, high availability) RabbitMQ plan of the eu01 catalogue (2026-10-18) that holds 2 vCPU and 8 GiB (8.59 GB at 10^9 bytes per GB) of memory (the plan table gives its RAM as \"GB\" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)): 8 vCPU / 16 GB RAM / 50 GB disk per node; the disk is not a figure of the source, so the smallest disk of that size is taken and the disk is open; no single-node plan of that size exists, so this replica plan adds the replicas the source does not have, and their price; this plan is larger than the one the other reading gives: reading the table's GB as a GiB, stackit-rabbitmq-4.8.50-single (4 vCPU / 8 GB RAM / 50 GB disk per node) would hold the source, and the draft is priced on the larger plan; if the table's GB is a GiB, answer choose-the-size and set stackit-rabbitmq-4.8.50-single). To change it, answer this decision in decisions.yaml with choose-the-size (and set the plan in the variable), or reject the proposal: the next run then writes the variable without a default.", "answered_by": "DEFAULT" }, { "member": "convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:dependencies_checkout_elasticache_redis_default_plan_name:SIZE_FROM_SOURCE", "option": "use-the-size-derived-from-the-source", "words": "StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default by default: var.dependencies_checkout_elasticache_redis_default_plan_name defaults to stackit-keyvalue-1.4.10-single (node type cache.t3.micro has 2 vCPU and 0.5 GiB (AWS price list, cache_node_sizes.json), and the source is a single node: the smallest single-node Key Value Store plan of the eu01 catalogue (2026-10-18) that holds 0.5 GiB (0.5369 GB at 10^9 bytes per GB) of memory (the plan table gives its RAM as \"GB\" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)): 1 vCPU / 4 GB RAM / 10 GB disk per node; the disk is not a figure of the source, so the smallest disk of that size is taken and the disk is open). To change it, answer this decision in decisions.yaml with choose-the-size (and set the plan in the variable), or reject the proposal: the next run then writes the variable without a default.", "answered_by": "DEFAULT" }, { "member": "convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:dependencies_orders_rds_this_flavor_id:SIZE_FROM_SOURCE", "option": "use-the-size-derived-from-the-source", "words": "StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.module.orders_rds.aws_rds_cluster.this by default: flavor_id = 2.4 (module.dependencies.module.orders_rds.aws_rds_cluster.this (source class db.t3.medium) has 2 vCPU and 4 GiB (AWS price list); 2.4 is the smallest single-node PostgreSQL Flex flavor of the eu01 catalogue (2026-10-18) that covers it: 2 vCPU / 4 GiB). To change it, answer this decision in decisions.yaml with choose-the-size (and set the flavor in the variable), or reject the proposal: the next run then writes flavor_id as var.dependencies_orders_rds_this_flavor_id without a default.", "answered_by": "DEFAULT" } ], "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.aws_mq_broker.mq", "artifact": "workspace.json", "pointer": "/units/0/trace" }, { "kind": "evidence", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "artifact": "workspace.json", "pointer": "/units/13/trace" }, { "kind": "evidence", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/22/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:68bd3fec47f2c8f8025a99a3b80707342357b42589bda9f46be69f7182fb9730", "artifact_sha256": "sha256:47d23376f79ef8f3b2f4b11187b1b9a723301f6aa27bae31bad3b3205556514b", "kb_dependencies": [ { "kind": "decision_kind", "id": "convert/SIZE_FROM_SOURCE", "sha256": "sha256:b4444f4b71337fb988507f8542866a80ceacfe2fbce22c1d88c73b1d78090d23" }, { "kind": "review_cause", "id": "convert/SIZE_FROM_SOURCE", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:4aefcdb4f8cff3c728aa8535ac7777fa49c3c4576077a04da8978b2e25bb606e" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 3 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The draft derives a plan or a machine type from the size the source states and writes it as the default of a variable (3 converter decisions): the steps that read the variable run on that default until a person confirms it or sets another size, and the price on the cost page is the price of the default. The source states the size of its own offer, not the load, so the size is a proposal.", "required_evidence": [ "the target sizes by a flavor of the catalogue, and the source states a size in the terms of its own offer; the draft proposes the smallest flavor that covers it, which leaves out what the source does not state (the disk of a plan, the sustained load, the headroom of a pool), so the value is a proposal and the price of the draft moves with it; unit of the memory figure: PostgreSQL Flex states the memory of a flavor in Gibibyte (API v3 spec, flavor.memory), the unit of the source's size, so no unit is assumed", "the target sizes by a plan of the catalogue, and the source states a size in the terms of its own offer; the draft proposes the smallest plan that covers it, which leaves out what the source does not state (the disk of a plan, the sustained load, the headroom of a pool), so the value is a proposal and the price of the draft moves with it; unit of the memory figure: the plan table gives its RAM as \"GB\" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)", "the load the instance or the pool has to carry on STACKIT: memory in use, connections or messages per second, and the headroom the owner wants (the source states the size of its offer, not the load)", "for a plan: whether the availability of the source (replicas, automatic failover, a cluster of brokers) is kept, and the disk the data needs (the disk is not a figure of the source)", "for a pool: the requests of the workloads that run on it, and the minimum and maximum of the pool" ], "resolution": { "decision_id": "DEC-GEN-CONVERT-SIZE-FROM-SOURCE", "source_family": "convert", "source_semantic": "SIZE_FROM_SOURCE", "affected_units": [ "module.dependencies.aws_mq_broker.mq", "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "module.dependencies.module.orders_rds.aws_rds_cluster.this" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "TARGET_DESIGN_OPEN", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The plan leaves this decision open on module.dependencies.aws_mq_broker.mq, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and module.dependencies.module.orders_rds.aws_rds_cluster.this.", "generated_target_behavior": "The draft carries the default use-the-size-derived-from-the-source out (answered by DEFAULT: nobody answered the decision), and the decision stays open.", "residual_difference": "the target design stands on a default that nobody answered: StackToIT chose it, and a person confirms it or changes it in the decisions file", "execution_effect": "No step waits for it. The plan can start TF/stackit_rabbitmq_instance.dependencies_mq, TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and TF/stackit_postgresflex_instance.dependencies_orders_rds_this now.", "next_action": "Confirm the plan or machine type StackToIT derived from the size of the source for module.dependencies.aws_mq_broker.mq, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and module.dependencies.module.orders_rds.aws_rds_cluster.this: choose one of the 2 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "The draft derives a plan or a machine type from the size the source states and writes it as the default of a variable (3 converter decisions): the steps that read the variable run on that default until a person confirms it or sets another size, and the price on the cost page is the price of the default. The source states the size of its own offer, not the load, so the size is a proposal." ], "closes_when": [ "an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option" ], "required_inputs": [ "the target sizes by a flavor of the catalogue, and the source states a size in the terms of its own offer; the draft proposes the smallest flavor that covers it, which leaves out what the source does not state (the disk of a plan, the sustained load, the headroom of a pool), so the value is a proposal and the price of the draft moves with it; unit of the memory figure: PostgreSQL Flex states the memory of a flavor in Gibibyte (API v3 spec, flavor.memory), the unit of the source's size, so no unit is assumed", "the target sizes by a plan of the catalogue, and the source states a size in the terms of its own offer; the draft proposes the smallest plan that covers it, which leaves out what the source does not state (the disk of a plan, the sustained load, the headroom of a pool), so the value is a proposal and the price of the draft moves with it; unit of the memory figure: the plan table gives its RAM as \"GB\" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)", "the load the instance or the pool has to carry on STACKIT: memory in use, connections or messages per second, and the headroom the owner wants (the source states the size of its offer, not the load)", "for a plan: whether the availability of the source (replicas, automatic failover, a cluster of brokers) is kept, and the disk the data needs (the disk is not a figure of the source)", "for a pool: the requests of the workloads that run on it, and the minimum and maximum of the pool" ], "resolution_paths": [ { "id": "use-the-size-derived-from-the-source", "title": "Keep the plan or machine type the draft derived from the size of the source", "prerequisites": [], "effects": [ "The draft already writes the derived plan, flavor or machine type (as the default of the variable for a plan or a machine type, as the literal of the block for a database flavor), said as DEFAULT on the block: the instance or the pool is created with it and the cost page prices it. Confirming it accepts the proposal as the starting size of the target; it does not say that the size carries the load, which the source does not state, and the disk of a plan is the smallest of that size. The memory was compared in bytes: the API states the memory of a PostgreSQL Flex and a SQL Server Flex flavor in Gibibyte, the unit of the source; the plan tables of Key Value Store and RabbitMQ and the MongoDB Flex flavors state their RAM as GB without defining it, so the draft took the plan or flavor that holds the source's memory when a GB is 10^9 bytes (it then holds it when a GB is 2^30 bytes as well) and says where that made it larger than the reading of a GB as a GiB; a machine type's memory is the catalogue's ram_mb read as MiB, an inference the API does not state. The next run writes the same default." ], "risk": [], "evidence": [ "https://docs.stackit.cloud/products/databases/key-value-store/reference/service-plans/", "https://docs.stackit.cloud/products/databases/key-value-store/reference/service-plans/", "https://docs.stackit.cloud/products/messaging/rabbitmq/reference/service-plans/", "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/ske/v2/ske.json#L2048", "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L1408", "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/sqlserverflex/v3/sqlserverflex.json#L1455", "https://docs.stackit.cloud/products/databases/mongodb-flex/reference/flavors-and-performance-classes/", "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json#L3660" ], "regeneration_required": false }, { "id": "choose-the-size", "title": "Set the plan or machine type yourself", "prerequisites": [], "effects": [ "The next run leaves the variable a required one the owner sets (a plan or a flavor of the catalogue, or a machine type the SKE API lists); the derived default and its DEFAULT line leave the draft, and the step that reads the variable waits for the value. Where the unit of the target's memory is not stated (the GB of a plan table or of a MongoDB Flex flavor), the person who sets the value reads the table in the unit that holds: a plan whose GB is a GiB can be smaller than the one the draft proposed." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_instance.md#L36", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/rabbitmq_instance.md#L36", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L84" ], "regeneration_required": true } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://docs.stackit.cloud/products/databases/key-value-store/reference/service-plans/", "https://docs.stackit.cloud/products/messaging/rabbitmq/reference/service-plans/", "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/ske/v2/ske.json#L2048", "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L1408", "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/sqlserverflex/v3/sqlserverflex.json#L1455", "https://docs.stackit.cloud/products/databases/mongodb-flex/reference/flavors-and-performance-classes/", "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json#L3660", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_instance.md#L36", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/rabbitmq_instance.md#L36", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L84" ], "related_execution_steps": [ { "id": "TF/stackit_rabbitmq_instance.dependencies_mq", "mode": "TERRAFORM", "phase": "PLATFORM", "executable": true, "waits_for_this": false }, { "id": "TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default", "mode": "TERRAFORM", "phase": "DATA", "executable": true, "waits_for_this": false }, { "id": "TF/stackit_postgresflex_instance.dependencies_orders_rds_this", "mode": "TERRAFORM", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-GEN-CONVERT-WORKLOAD-PLACEMENT", "kind": "WORKLOAD_PLACEMENT", "family": "convert", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-convert", "block": "WORKLOAD_PLACEMENT", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "module.vpc.module.vpc.aws_subnet.private", "artifact": "assessment.json", "pointer": "/units/85" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "convert:module.vpc.module.vpc.aws_subnet.private:network:WORKLOAD_PLACEMENT", "artifact": "workspace.json", "pointer": "/units/84/deployment_prerequisites/open_decisions/0" } ], "options": [ { "id": "one-network-for-the-cluster-and-services", "title": "Place the cluster and the servers in one STACKIT network, and admit the clients of the managed services by access lists naming its range", "effect": "The Kubernetes cluster is deployed into one network (network.id of stackit_ske_cluster names a STACKIT Network Area network; a node pool states no network, so the tasks the source spread over several subnets share it), the servers are placed in it by their network interfaces (network_id of stackit_network_interface), and a managed database or cache is not placed in a network: its access list (acl of stackit_postgresflex_instance and stackit_mongodbflex_instance) names the range of that network. The other drafted networks of the subnets hold none of these consumers. The draft writes the cluster half of this option by default (network = { id = ... } on the drafted stackit_ske_cluster, marked DEFAULT) where the target project is not stated to be outside a Network Area, the draft asks for no such project, the cluster serves workloads of exactly one drafted network, and every other consumer of that network has a decision of its own; where one of these does not hold it writes no network.id and a person carries the cluster half out. The access lists of the managed services are a separate default of the draft and not written by this option: a person (or that default) carries the services half out, and the network's step stays held until the decision is answered where the draft binds nothing.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`id` (String) ID of the STACKIT Network Area (SNA) network into which the cluster will be deployed." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L79-L101", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Nested Schema for `node_pools` — Required: availability_zones, machine_type, maximum, minimum, name; Optional: allow_system_components, cri, labels, max_surge, max_unavailable, os_name, os_version, os_version_min, taints, volume_size, volume_type (searched the nested schema: no network attribute)" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "network_id (String) The network ID to which the network interface is associated." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_instance.md#L44", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`acl` (List of String) The Access Control List (ACL) for the MongoDB Flex instance. (searched the resource documentation: no network id attribute)" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_instance.md#L104", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-22", "quote": "access_scope (String) The network access scope of the instance. This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected. Possible values are: PUBLIC, SNA." } ] }, { "id": "keep-the-networks-and-place-by-tier", "title": "Keep the drafted networks and place each consumer in the network of its tier", "effect": "A network is kept per source subnet class and each consumer is placed where STACKIT can place it: a server by its network interface, a load balancer by its networks (networks.network_id of stackit_application_load_balancer), the Kubernetes cluster by network.id in one network (its node pools state no network, so one cluster cannot follow a split of its tasks over several networks), and a managed database or cache by an access list naming the range of its tier's network. The draft does not write this placement: a person carries it out, and the network's step stays held.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`id` (String) ID of the STACKIT Network Area (SNA) network into which the cluster will be deployed." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L79-L101", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Nested Schema for `node_pools` — Required: availability_zones, machine_type, maximum, minimum, name; Optional: allow_system_components, cri, labels, max_surge, max_unavailable, os_name, os_version, os_version_min, taints, volume_size, volume_type (searched the nested schema: no network attribute)" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "network_id (String) The network ID to which the network interface is associated." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L397-L398", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-25", "quote": "network_id (String) STACKIT network ID the Application Load Balancer and/or targets are in. role (String) The role defines how the Application Load Balancer is using the network. Possible values are: ROLE_UNSPECIFIED, ROLE_LISTENERS_AND_TARGETS, ROLE_LISTENERS, ROLE_TARGETS." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_instance.md#L44", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`acl` (List of String) The Access Control List (ACL) for the MongoDB Flex instance. (searched the resource documentation: no network id attribute)" } ] }, { "id": "redesign-the-network-placement", "title": "Redesign the network placement of the workloads", "effect": "The architect designs the placement outside the draft (for example the cluster in an existing Network Area network of the target environment, or the workloads on servers in the drafted networks); the drafted network is replaced by that design. The draft carries none of it, and the network's step stays held.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`id` (String) ID of the STACKIT Network Area (SNA) network into which the cluster will be deployed." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "network_id (String) The network ID to which the network interface is associated." } ] }, { "id": "accept-the-consumers-outside-the-network", "title": "Accept that the drafted network holds none of the source's consumers of its subnet", "effect": "The network is applied as the draft writes it, and none of the consumers the record names is placed in it: the cluster is created without network.id as drafted (which network then holds its nodes is not stated by the sources read), a load balancer takes the network its variable is set to, and a managed database or cache admits the clients of its access list. The source's placement of these workloads in the subnet is not kept; a person accepts that difference, and whether the network's range is still needed is decided with it.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L67", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`network` (Attributes) Network block as defined below. (listed under Optional)" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`id` (String) ID of the STACKIT Network Area (SNA) network into which the cluster will be deployed." } ] } ], "recommended_option": null, "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.vpc.module.vpc.aws_subnet.private", "artifact": "workspace.json", "pointer": "/units/84/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:8423085c8f163f8f11a333347eb7eb7897eac61922c9c6cd69a52a5a7a6893f9", "artifact_sha256": "sha256:6fcbcaeb18342452421d74df69cd6a2867a13923f52b57ba684e15b806ebb8c1", "kb_dependencies": [ { "kind": "decision_kind", "id": "convert/WORKLOAD_PLACEMENT", "sha256": "sha256:863c22b2e639e148e0c59d256af963266540adb387590bc607e3ae215a009aeb" }, { "kind": "review_cause", "id": "convert/WORKLOAD_PLACEMENT", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:bf8b1a74b9af3006bff3fdbd5579c5d953ccadafcdfefcf59bee748eb6c1e230" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "unblocks": { "holds": 3, "stuck": 2, "alone": 1, "shared": 0, "steps": [ "TF/stackit_network.vpc_vpc_private" ], "best_option": "accept-the-consumers-outside-the-network", "options": [ { "option": "one-network-for-the-cluster-and-services", "effects": [ "NOT_STATED" ], "alone": 0, "shared": 0 }, { "option": "keep-the-networks-and-place-by-tier", "effects": [ "NOT_STATED" ], "alone": 0, "shared": 0 }, { "option": "redesign-the-network-placement", "effects": [ "NOT_STATED" ], "alone": 0, "shared": 0 }, { "option": "accept-the-consumers-outside-the-network", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 1, "shared": 0 } ] }, "why": "The converter could not prove what the source means by the workload placement (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides.", "required_evidence": [ "the source splits these workloads over subnets, and STACKIT places them differently: an SKE cluster is deployed into one network (network.id) and its node pools state no network, a managed database, cache or broker takes an access list and no network id; no one-to-one placement of the consumers in stackit_network.vpc_vpc_private follows from the source, so the network's step waits for the decision", "for each source consumer the record names (an ECS service, a cluster, a load balancer, a database, cache or broker): the STACKIT network it is placed in, or the access list that admits its clients, in the layout chosen", "for a Kubernetes cluster: the STACKIT Network Area network its network.id names, and that the target project can use it; the task-level subnet split of the source has no counterpart in the cluster", "for a network that holds none of its consumers after the choice: whether its address range is still needed" ], "resolution": { "decision_id": "DEC-GEN-CONVERT-WORKLOAD-PLACEMENT", "source_family": "convert", "source_semantic": "WORKLOAD_PLACEMENT", "affected_units": [ "module.vpc.module.vpc.aws_subnet.private" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "TARGET_DESIGN_OPEN", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The plan leaves this decision open on module.vpc.module.vpc.aws_subnet.private.", "generated_target_behavior": "The draft holds TF/stackit_network.vpc_vpc_private until this decision is answered by an answer that frees it.", "residual_difference": "the target design is open until the decision is answered", "execution_effect": "1 step waits for it until it is answered: TF/stackit_network.vpc_vpc_private.", "next_action": "Decide where the workloads of a drafted network are placed for module.vpc.module.vpc.aws_subnet.private: choose one of the 4 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "The converter could not prove what the source means by the workload placement (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides." ], "closes_when": [ "an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option" ], "required_inputs": [ "the source splits these workloads over subnets, and STACKIT places them differently: an SKE cluster is deployed into one network (network.id) and its node pools state no network, a managed database, cache or broker takes an access list and no network id; no one-to-one placement of the consumers in stackit_network.vpc_vpc_private follows from the source, so the network's step waits for the decision", "for each source consumer the record names (an ECS service, a cluster, a load balancer, a database, cache or broker): the STACKIT network it is placed in, or the access list that admits its clients, in the layout chosen", "for a Kubernetes cluster: the STACKIT Network Area network its network.id names, and that the target project can use it; the task-level subnet split of the source has no counterpart in the cluster", "for a network that holds none of its consumers after the choice: whether its address range is still needed" ], "resolution_paths": [ { "id": "one-network-for-the-cluster-and-services", "title": "Place the cluster and the servers in one STACKIT network, and admit the clients of the managed services by access lists naming its range", "prerequisites": [], "effects": [ "The Kubernetes cluster is deployed into one network (network.id of stackit_ske_cluster names a STACKIT Network Area network; a node pool states no network, so the tasks the source spread over several subnets share it), the servers are placed in it by their network interfaces (network_id of stackit_network_interface), and a managed database or cache is not placed in a network: its access list (acl of stackit_postgresflex_instance and stackit_mongodbflex_instance) names the range of that network. The other drafted networks of the subnets hold none of these consumers. The draft writes the cluster half of this option by default (network = { id = ... } on the drafted stackit_ske_cluster, marked DEFAULT) where the target project is not stated to be outside a Network Area, the draft asks for no such project, the cluster serves workloads of exactly one drafted network, and every other consumer of that network has a decision of its own; where one of these does not hold it writes no network.id and a person carries the cluster half out. The access lists of the managed services are a separate default of the draft and not written by this option: a person (or that default) carries the services half out, and the network's step stays held until the decision is answered where the draft binds nothing." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L79-L101", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_instance.md#L44", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_instance.md#L104" ], "regeneration_required": false }, { "id": "keep-the-networks-and-place-by-tier", "title": "Keep the drafted networks and place each consumer in the network of its tier", "prerequisites": [], "effects": [ "A network is kept per source subnet class and each consumer is placed where STACKIT can place it: a server by its network interface, a load balancer by its networks (networks.network_id of stackit_application_load_balancer), the Kubernetes cluster by network.id in one network (its node pools state no network, so one cluster cannot follow a split of its tasks over several networks), and a managed database or cache by an access list naming the range of its tier's network. The draft does not write this placement: a person carries it out, and the network's step stays held." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L79-L101", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L397-L398", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_instance.md#L44" ], "regeneration_required": false }, { "id": "redesign-the-network-placement", "title": "Redesign the network placement of the workloads", "prerequisites": [], "effects": [ "The architect designs the placement outside the draft (for example the cluster in an existing Network Area network of the target environment, or the workloads on servers in the drafted networks); the drafted network is replaced by that design. The draft carries none of it, and the network's step stays held." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29" ], "regeneration_required": false }, { "id": "accept-the-consumers-outside-the-network", "title": "Accept that the drafted network holds none of the source's consumers of its subnet", "prerequisites": [], "effects": [ "The network is applied as the draft writes it, and none of the consumers the record names is placed in it: the cluster is created without network.id as drafted (which network then holds its nodes is not stated by the sources read), a load balancer takes the network its variable is set to, and a managed database or cache admits the clients of its access list. The source's placement of these workloads in the subnet is not kept; a person accepts that difference, and whether the network's range is still needed is decided with it." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L67", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242" ], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L79-L101", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_instance.md#L44", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_instance.md#L104", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L397-L398", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L67" ], "related_execution_steps": [ { "id": "TF/stackit_network.vpc_vpc_private", "mode": "TERRAFORM", "phase": "FOUNDATION", "executable": false, "waits_for_this": true } ] } }, { "id": "DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS", "kind": "retention_over_180_days", "family": "stackitlogs", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-stackitlogs", "block": "retention_over_180_days", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "TECHNICAL_VALIDATION_PASSED", "owner_role": "Platform Architect", "required_by_phase": "CUTOVER_PREREQUISITE", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "artifact": "assessment.json", "pointer": "/units/1" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "stackitlogs:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks:retention_over_180_days", "artifact": "workspace.json", "pointer": "/units/26/deployment_prerequisites/open_decisions/0" } ], "options": [ { "id": "set-retention-within-the-platform-range", "title": "Keep the logs for the 180 days of the Logs instance only", "effect": "The Logs instance is applied as the draft writes it, with a retention of 180 days (the API accepts 1 to 180 days and the FAQ states that retention beyond 180 days is not supported). Logs older than 180 days are not kept by it and no archive is configured, so the retention the source keeps beyond 180 days is not carried. No step is added.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json#L164-L169", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-10-12", "quote": "CreateLogsInstancePayload.retentionDays: \"The log retention time in days.\", format int32, maximum 180, minimum 1; required with displayName" }, { "url": "https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-12", "quote": "Can I extend the retention period of \"Logs\" beyond 180 days? No. As the Logs-Service is a fully managed service, we do not support individual retention configurations beyond 180 days." } ], "default": true }, { "id": "archive-longer-retention-elsewhere", "title": "For the period beyond 180 days, also stream the logs to long-term storage", "effect": "The Logs instance keeps at most 180 days and is applied as the draft writes it. The FAQ recommends a cold-storage approach for longer periods: stream the log data in parallel to a long-term storage such as a separate Object Storage bucket. The plan holds a step for it that a person carries out (the archive store, the stream and the retention of the archive are not generated); choosing this option takes that step. A requirement of more than 180 days inside STACKIT Logs with no external archive cannot be met by STACKIT Logs alone: it is stated by rejecting this option.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-12", "quote": "For long-term retention (e.g., 1 year or more), we recommend implementing a \"Cold Storage\" strategy. The Approach: Stream your log data to a low-cost long-term storage solution (such as a separate Object Storage bucket) in parallel to sending it to \"STACKIT Logs\"." } ] } ], "recommended_option": "set-retention-within-the-platform-range", "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "artifact": "workspace.json", "pointer": "/units/26/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:7098dc52d2c6183a8387b8e707e8001532ae3f4483e9dbd7a0e4f826acc8a0ff", "artifact_sha256": "sha256:0fd1c4ea746073abd592bcc4489b34673f50fda951496c9a3f15f5009f1f4539", "kb_dependencies": [ { "kind": "decision_kind", "id": "stackitlogs/retention_over_180_days", "sha256": "sha256:f2f5fe2f9ecb21ea11330873f4fff853d8e99bdf11b33a56d874e6630a769eac" }, { "kind": "review_cause", "id": "stackitlogs/retention_over_180_days", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" } ], "kb_dependencies_sha256": "sha256:8b541d850bc366f0bb88d4fa96b68a13df34bd549295919c5c1c9f0ee460fccd" }, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "unblocks": { "holds": 2, "stuck": 1, "alone": 1, "shared": 0, "steps": [ "MAN/logs/archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" ], "best_option": "archive-longer-retention-elsewhere", "options": [ { "option": "set-retention-within-the-platform-range", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 0, "shared": 0 }, { "option": "archive-longer-retention-elsewhere", "effects": [ "MANUAL_ALTERNATIVE" ], "alone": 1, "shared": 0 } ] }, "why": "The plan of the draft lists the question \"Decide how logs are kept beyond 180 days\" as open (1 plan decision): a person decides it, and nothing the plan states about it is carried until it is decided.", "required_evidence": [ "the source keeps its logs for ever and a STACKIT Logs instance keeps at most 180 days, so the instance drafted for it (stackit_logs_instance.logs_retention_180d) holds only the last 180 days; logs older than that exist only if a person configures an archive beside it. Choose the archive if the workload needs them; reject it if the requirement is that more than 180 days stay inside STACKIT Logs with no external archive, which STACKIT Logs alone cannot meet", "the retention period, in days, the workload's logs need, and whether an archive outside STACKIT Logs is accepted for the period beyond 180 days" ], "resolution": { "decision_id": "DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS", "source_family": "stackitlogs", "source_semantic": "retention_over_180_days", "affected_units": [ "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "CUTOVER_PREREQUISITE", "raw_semantic_status": "TARGET_DESIGN_OPEN", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": "set-retention-within-the-platform-range", "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The plan leaves this decision open on module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks.", "generated_target_behavior": "The draft holds MAN/logs/archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks until this decision is answered by an answer that frees it.", "residual_difference": "the target design is open until the decision is answered", "execution_effect": "1 step waits for it until it is answered: MAN/logs/archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks.", "next_action": "Decide how logs are kept beyond 180 days for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: choose one of the 2 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "The plan of the draft lists the question \"Decide how logs are kept beyond 180 days\" as open (1 plan decision): a person decides it, and nothing the plan states about it is carried until it is decided." ], "closes_when": [ "an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option" ], "required_inputs": [ "the source keeps its logs for ever and a STACKIT Logs instance keeps at most 180 days, so the instance drafted for it (stackit_logs_instance.logs_retention_180d) holds only the last 180 days; logs older than that exist only if a person configures an archive beside it. Choose the archive if the workload needs them; reject it if the requirement is that more than 180 days stay inside STACKIT Logs with no external archive, which STACKIT Logs alone cannot meet", "the retention period, in days, the workload's logs need, and whether an archive outside STACKIT Logs is accepted for the period beyond 180 days" ], "resolution_paths": [ { "id": "set-retention-within-the-platform-range", "title": "Keep the logs for the 180 days of the Logs instance only", "prerequisites": [], "effects": [ "The Logs instance is applied as the draft writes it, with a retention of 180 days (the API accepts 1 to 180 days and the FAQ states that retention beyond 180 days is not supported). Logs older than 180 days are not kept by it and no archive is configured, so the retention the source keeps beyond 180 days is not carried. No step is added." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json#L164-L169", "https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/" ], "regeneration_required": false }, { "id": "archive-longer-retention-elsewhere", "title": "For the period beyond 180 days, also stream the logs to long-term storage", "prerequisites": [], "effects": [ "The Logs instance keeps at most 180 days and is applied as the draft writes it. The FAQ recommends a cold-storage approach for longer periods: stream the log data in parallel to a long-term storage such as a separate Object Storage bucket. The plan holds a step for it that a person carries out (the archive store, the stream and the retention of the archive are not generated); choosing this option takes that step. A requirement of more than 180 days inside STACKIT Logs with no external archive cannot be met by STACKIT Logs alone: it is stated by rejecting this option." ], "risk": [], "evidence": [ "https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/" ], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json#L164-L169", "https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/" ], "related_execution_steps": [ { "id": "MAN/logs/archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "mode": "MANUAL", "phase": "PLATFORM", "executable": false, "waits_for_this": true } ] } }, { "id": "DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST", "kind": "NAT_FIXED_EGRESS_ADDRESS_LOST", "family": "stackitroute", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-stackitroute", "block": "NAT_FIXED_EGRESS_ADDRESS_LOST", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "TECHNICAL_VALIDATION_PASSED", "owner_role": "Network Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "module.vpc.module.vpc.aws_route_table.private", "artifact": "assessment.json", "pointer": "/units/78" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "stackitroute:module.vpc.module.vpc.aws_route_table.private:NAT_FIXED_EGRESS_ADDRESS_LOST", "artifact": "workspace.json", "pointer": "/units/77/plan_statements/0/open_decisions/0" } ], "options": [ { "id": "accept-the-platform-egress-address", "title": "Accept the address STACKIT assigns to the network for outbound traffic", "effect": "Outbound traffic of servers without a public IP leaves through source NAT with the public IP STACKIT creates and assigns to the project's Virtual Networks, not with an address the owner chose. A destination allow-list that names the source's fixed NAT address does not match it.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-12", "quote": "Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading. When creating the first network in a public project, STACKIT automatically creates and assigns a public IP for all Virtual Networks. It supports outbound internet access but does not allow traffic initiated from the public internet to reach your resources." } ] }, { "id": "reserve-a-public-ip-per-server", "title": "Give each server that an allow-list names a STACKIT public IP", "effect": "A stackit_public_ip is reserved and associated with the network interface of each such server (network_interface_id of stackit_public_ip, or stackit_public_ip_associate). The pages read do not state which source address the outbound connections of such a server then use; confirm it on the target before relying on it.", "execution_effect": "REGENERATE_REQUIRED", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip.md#L35", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-12", "quote": "network_interface_id (String) Associates the public IP with a network interface or a virtual IP (ID)." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip_associate.md#L13", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-12", "quote": "Associates an existing public IP to a network interface. This is useful for situations where you have a pre-allocated public IP or unable to use the stackit_public_ip resource to create a new public IP." } ] } ], "recommended_option": null, "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.vpc.module.vpc.aws_route_table.private", "artifact": "workspace.json", "pointer": "/units/77/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:cbfcbf1e12e98cb3608485caffc5de82e33e3517a0845fc9ca14cbcf7e207d0e", "artifact_sha256": "sha256:37a4992d7cb1b57ebe73b1567f6fec7b6f2f3de527370a9ba50c9d2e600bccea", "kb_dependencies": [ { "kind": "decision_kind", "id": "stackitroute/NAT_FIXED_EGRESS_ADDRESS_LOST", "sha256": "sha256:17cf428a90ab34e60d48ed853cee407ece79c8054b0b392d3985cf5c1b434441" }, { "kind": "review_cause", "id": "stackitroute/NAT_FIXED_EGRESS_ADDRESS_LOST", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" } ], "kb_dependencies_sha256": "sha256:b7b1559abec6cce3207e0a1fc245a3c875b27a798d1bb922309519ace4b7642c" }, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "unblocks": { "holds": 8, "stuck": 7, "alone": 1, "shared": 0, "steps": [ "DEC/routing/stackitroute:module.vpc.module.vpc.aws_route_table.private:NAT_FIXED_EGRESS_ADDRESS_LOST" ], "best_option": "accept-the-platform-egress-address", "options": [ { "option": "accept-the-platform-egress-address", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 1, "shared": 0 }, { "option": "reserve-a-public-ip-per-server", "effects": [ "REGENERATE_REQUIRED" ], "alone": 0, "shared": 0 } ] }, "why": "The plan of the draft lists the question \"Decide the outbound address of the servers an allow-list names\" as open (1 plan decision): a person decides it, and nothing the plan states about it is carried until it is decided.", "required_evidence": [ "a NAT gateway's fixed egress address is lost on STACKIT: the address a routed network leaves by is the network's own, shared by every routed network of the project, not fixed and not settable", "the servers whose outbound address a destination allow-list names, and the allow-lists that name it" ], "resolution": { "decision_id": "DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST", "source_family": "stackitroute", "source_semantic": "NAT_FIXED_EGRESS_ADDRESS_LOST", "affected_units": [ "module.vpc.module.vpc.aws_route_table.private" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "TARGET_DESIGN_OPEN", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The plan leaves this decision open on module.vpc.module.vpc.aws_route_table.private.", "generated_target_behavior": "The draft holds DEC/routing/DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST until this decision is answered by an answer that frees it.", "residual_difference": "the target design is open until the decision is answered", "execution_effect": "1 step waits for it until it is answered: DEC/routing/DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST.", "next_action": "Decide the outbound address of the servers an allow-list names for module.vpc.module.vpc.aws_route_table.private: choose one of the 2 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "The plan of the draft lists the question \"Decide the outbound address of the servers an allow-list names\" as open (1 plan decision): a person decides it, and nothing the plan states about it is carried until it is decided." ], "closes_when": [ "the decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST is answered (accepted or rejected, with its evidence) in the inputs of the run and is no longer open when the run is repeated" ], "required_inputs": [ "a NAT gateway's fixed egress address is lost on STACKIT: the address a routed network leaves by is the network's own, shared by every routed network of the project, not fixed and not settable", "the servers whose outbound address a destination allow-list names, and the allow-lists that name it", "the answer to the decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST" ], "resolution_paths": [ { "id": "accept-the-platform-egress-address", "title": "Accept the address STACKIT assigns to the network for outbound traffic", "prerequisites": [], "effects": [ "Outbound traffic of servers without a public IP leaves through source NAT with the public IP STACKIT creates and assigns to the project's Virtual Networks, not with an address the owner chose. A destination allow-list that names the source's fixed NAT address does not match it." ], "risk": [], "evidence": [ "https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/" ], "regeneration_required": false }, { "id": "reserve-a-public-ip-per-server", "title": "Give each server that an allow-list names a STACKIT public IP", "prerequisites": [], "effects": [ "A stackit_public_ip is reserved and associated with the network interface of each such server (network_interface_id of stackit_public_ip, or stackit_public_ip_associate). The pages read do not state which source address the outbound connections of such a server then use; confirm it on the target before relying on it." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip.md#L35", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip_associate.md#L13" ], "regeneration_required": true } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip.md#L35", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip_associate.md#L13" ], "related_execution_steps": [ { "id": "DEC/routing/stackitroute:module.vpc.module.vpc.aws_route_table.private:NAT_FIXED_EGRESS_ADDRESS_LOST", "mode": "MANUAL", "phase": "PREPARE", "executable": false, "waits_for_this": true } ] } }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-CLOUDWATCH-LOG-GROUP-ECS-TASKS", "kind": "unit-review", "family": "aws.cloudwatch_log_group", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.cloudwatch_log_group", "block": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "artifact": "assessment.json", "pointer": "/units/1" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks|tc-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/91" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "artifact": "workspace.json", "pointer": "/units/26/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:e71bb0607c0a5ebb2ed51336e2dafb83d87e2ea428ba9c2c59f10bff5d5552d6", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.cloudwatch_log_group/tc-name", "sha256": "sha256:decaededd077c51dd06b3f6705368759028414cc23ebef4f9eb0798cf0765dc6" }, { "kind": "review_cause", "id": "aws.cloudwatch_log_group/tc-name", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:5774655a1d63aa238425b6099fc69a5a26fd5b9b39b1bcac21ee61ed7f554738" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-OPS-AWS-CLOUDWATCH-LOG-GROUP-TC-NAME", "kind": "tc-name", "family": "aws.cloudwatch_log_group", "title": "Confirm the name of the log group", "block": "name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-name\" of the aws.cloudwatch_log_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks|tc-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-CLOUDWATCH-LOG-GROUP-ECS-TASKS", "source_family": "aws.cloudwatch_log_group", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "observability-audit", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance names a manual step as the only path", "source_observation": "The source states 1 critical setting on module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks that the knowledge base cannot decide: Confirm the name of the log group.", "generated_target_behavior": "Confirm the name of the log group: The draft does not carry the setting on module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks; a manual step stands for it (MAN/logs/label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Confirm the name of the log group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/logs/label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks now.", "next_action": "Confirm the name of the log group: Carry out the manual work the plan names for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks outside the draft; the plan states no title for it.", "why_open": [ "Confirm the name of the log group: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_cloudwatch_log_group.name is the address a log producer writes to (awslogs-group, PutLogEvents logGroupName). The name is therefore not carried by anything the draft generates, and no producer is rewired: a person decides the label convention and reconfigures each producer - REVIEW (the plan holds it as a label convention manual action). Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract)." ], "closes_when": [ "Confirm the name of the log group: A person decides the label convention under which the log group name survives in STACKIT Logs and reconfigures each producer to send it; the draft configures no shipper." ], "required_inputs": [], "resolution_paths": [ { "id": "tc-name/decide-and-carry-out", "title": "Confirm the name of the log group: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.", "regeneration: not stated — treated as required" ], "risk": [ "The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes." ], "evidence": [ "contract note aws.cloudwatch_log_group/tc-name: \"A person decides the label convention under which the log group name survives in STACKIT Logs and reconfigures each producer to send it; the draft configures no shipper.\"" ], "regeneration_required": true } ], "required_verification": [ "Confirm the name of the log group: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Confirm the name of the log group: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.cloudwatch_log_group/tc-name: \"A person decides the label convention under which the log group name survives in STACKIT Logs and reconfigures each producer to send it; the draft configures no shipper.\"" ], "related_execution_steps": [ { "id": "MAN/logs/label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE", "kind": "unit-review", "family": "aws.dynamodb_table", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.dynamodb_table", "block": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Data Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this", "artifact": "assessment.json", "pointer": "/units/0" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|key-schema", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/71" }, { "kind": "semantic", "id": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|point-in-time-recovery", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/72" }, { "kind": "semantic", "id": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|ttl", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/74" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this", "artifact": "workspace.json", "pointer": "/units/19/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:be230134eb933993e87d2acca45d6600aaef296e10ea3f5acfe1bc2868503c4c", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.dynamodb_table/key-schema", "sha256": "sha256:d72ac0d9f3ce245bfe0572afdb10ebc237986a2efd99b92c5f95646e8baabfe8" }, { "kind": "contract_semantic", "id": "aws.dynamodb_table/point-in-time-recovery", "sha256": "sha256:c1e63b7d92c5073ff87c177fd49780a7165b0953b0f9174ffcee2c1fd69aabbd" }, { "kind": "contract_semantic", "id": "aws.dynamodb_table/ttl", "sha256": "sha256:85a70b34e985a2faa71591202ec5b38e42c2022b38bc74cfb291a09ef1e20bed" }, { "kind": "review_cause", "id": "aws.dynamodb_table/key-schema", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.dynamodb_table/point-in-time-recovery", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.dynamodb_table/ttl", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:f253dc1a178fa55575e3271a5dc6885b281fd306dbc95942af5eaa8225297c89" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 3 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 3 critical settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect.", "required_evidence": [], "items": [ { "id": "DEC-DATA-AWS-DYNAMODB-TABLE-KEY-SCHEMA", "kind": "key-schema", "family": "aws.dynamodb_table", "title": "Review the key schema setting", "block": "attribute", "category": "data-semantics", "why": "The knowledge base cannot decide \"key-schema\" of the aws.dynamodb_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|key-schema" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this outside the draft; the plan states no title for it." }, { "id": "DEC-DATA-AWS-DYNAMODB-TABLE-POINT-IN-TIME-RECOVERY", "kind": "point-in-time-recovery", "family": "aws.dynamodb_table", "title": "Review the point in time recovery setting", "block": "point_in_time_recovery", "category": "backup-retention", "why": "The knowledge base cannot decide \"point-in-time-recovery\" of the aws.dynamodb_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|point-in-time-recovery" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the point in time recovery setting for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-DATA-AWS-DYNAMODB-TABLE-TTL", "kind": "ttl", "family": "aws.dynamodb_table", "title": "Review the TTL setting", "block": "ttl", "category": "backup-retention", "why": "The knowledge base cannot decide \"ttl\" of the aws.dynamodb_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|ttl" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the TTL setting for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE", "source_family": "aws.dynamodb_table", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Data Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the point in time recovery setting; the 3 settings of the record state their own.", "source_observation": "The source states 3 critical settings on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this that the knowledge base cannot decide: Review the key schema setting; Review the point in time recovery setting; Review the TTL setting.", "generated_target_behavior": "Review the key schema setting: The draft does not carry the setting on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; a manual step stands for it (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the point in time recovery setting: The draft does not carry the setting on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; a manual step stands for it (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect). Review the TTL setting: The draft does not carry the setting on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; a manual step stands for it (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect).", "residual_difference": "Review the key schema setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the point in time recovery setting: the target behaviour of this setting is not established Review the TTL setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect now.", "next_action": "Review the point in time recovery setting: Review the point in time recovery setting for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the key schema setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The draft names the partition/sort key as the collection's unique index; the data model is rewritten by people.", "Review the point in time recovery setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. MongoDB Flex has a point-in-time window in hours (options.point_in_time_window_hours); its maximum is not documented in the provider schema. The draft carries no value for it.", "Review the TTL setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. DynamoDB TTL reads epoch seconds; a MongoDB TTL index expires only BSON dates, so the attribute changes type. The time-to-live check still fires only for enabled = true; the case handler REVIEW covers the other states." ], "closes_when": [ "Review the key schema setting: A person designs the keys and indexes of the replacement collection (partition and sort key, attribute names and types, secondary index keys), because the draft names only the key as the collection's unique index.", "Review the point in time recovery setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the TTL setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [ { "id": "key-schema/decide-and-carry-out", "title": "Review the key schema setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.", "regeneration: not stated — treated as required" ], "risk": [ "The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes." ], "evidence": [ "contract note aws.dynamodb_table/key-schema: \"A person designs the keys and indexes of the replacement collection (partition and sort key, attribute names and types, secondary index keys), because the draft names only the key as the collection's unique index.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the key schema setting: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the key schema setting: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.dynamodb_table/key-schema: \"A person designs the keys and indexes of the replacement collection (partition and sort key, attribute names and types, secondary index keys), because the draft names only the key as the collection's unique index.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE", "kind": "unit-review", "family": "aws.dynamodb_table", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.dynamodb_table", "block": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this", "artifact": "assessment.json", "pointer": "/units/0" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|index-projection-and-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/70" }, { "kind": "semantic", "id": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|tc-dynamodb-table-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/73" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this", "artifact": "workspace.json", "pointer": "/units/19/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:376e1fb33723b9c06d87ddd508b5b8413291ae6a06d048c7410dbf9c03e42876", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.dynamodb_table/index-projection-and-name", "sha256": "sha256:3664c74a677b94c0c9b77c73a22659cfaf6f4077978edd564ec80e392eb778f4" }, { "kind": "contract_semantic", "id": "aws.dynamodb_table/tc-dynamodb-table-name", "sha256": "sha256:e8e1d7d8330e8515007afe18f7b2aa727e0cfb6ee98e869f9f723c8c05cf04e1" }, { "kind": "review_cause", "id": "aws.dynamodb_table/index-projection-and-name", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.dynamodb_table/tc-dynamodb-table-name", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:bc69719ca67a8a6cb0a7dbb03987ea3abd9d872b00f99be4b5c8a2db76828a44" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 2 critical settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect.", "required_evidence": [], "items": [ { "id": "DEC-OPS-AWS-DYNAMODB-TABLE-INDEX-PROJECTION-AND-NAME", "kind": "index-projection-and-name", "family": "aws.dynamodb_table", "title": "Review the index projection and name setting", "block": "global_secondary_index", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"index-projection-and-name\" of the aws.dynamodb_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|index-projection-and-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the index projection and name setting for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-AWS-DYNAMODB-TABLE-TC-DYNAMODB-TABLE-NAME", "kind": "tc-dynamodb-table-name", "family": "aws.dynamodb_table", "title": "Confirm the name of the DynamoDB table", "block": "name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-dynamodb-table-name\" of the aws.dynamodb_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|tc-dynamodb-table-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: the check, proof or closing evidence is recorded with its result." } ], "resolution": { "decision_id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE", "source_family": "aws.dynamodb_table", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the index projection and name setting; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this that the knowledge base cannot decide: Review the index projection and name setting; Confirm the name of the DynamoDB table.", "generated_target_behavior": "Review the index projection and name setting: The draft does not carry the setting on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; a manual step stands for it (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect). Confirm the name of the DynamoDB table: The draft does not carry the setting on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; a manual step stands for it (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the index projection and name setting: the target behaviour of this setting is not established Confirm the name of the DynamoDB table: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect now.", "next_action": "Review the index projection and name setting: Review the index projection and name setting for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the index projection and name setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The projection of a secondary index (keys only, INCLUDE with its non_key_attributes, ALL) decides which attributes an index query can return, and the index name is what every Query / Scan on the index selects it by (API Query IndexName). STACKIT has no provider resource for an index (pinned provider), a person re-creates the indexes and the queries that name them in the chosen engine — REVIEW.", "Confirm the name of the DynamoDB table: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_dynamodb_table.name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). No semantic of this family has verified it as carried." ], "closes_when": [ "Review the index projection and name setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the name of the DynamoDB table: A person confirms the name the replacement collection carries on the target against what refers to the source name, or accepts the new name." ], "required_inputs": [], "resolution_paths": [ { "id": "tc-dynamodb-table-name/verify-on-target", "title": "Confirm the name of the DynamoDB table: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.dynamodb_table/tc-dynamodb-table-name: \"A person confirms the name the replacement collection carries on the target against what refers to the source name, or accepts the new name.\"" ], "regeneration_required": true } ], "required_verification": [ "Confirm the name of the DynamoDB table: the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Confirm the name of the DynamoDB table: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.dynamodb_table/tc-dynamodb-table-name: \"A person confirms the name the replacement collection carries on the target against what refers to the source name, or accepts the new name.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE", "kind": "unit-review", "family": "aws.dynamodb_table", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.dynamodb_table", "block": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this", "artifact": "assessment.json", "pointer": "/units/0" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|encryption-at-rest", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/69" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this", "artifact": "workspace.json", "pointer": "/units/19/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:d1f3a830429052e0e3744c4e3ab5b71cad9aa7b33241a35e16b57107591f512f", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.dynamodb_table/encryption-at-rest", "sha256": "sha256:36e8791d896b46fdfeae3cbccd6cd403b2a06f56597ae8816abdf67f619905cf" }, { "kind": "review_cause", "id": "aws.dynamodb_table/encryption-at-rest", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:6c34d3ca5f92fe1a1fe2ecbb48b9debfdfa82ea1d7512faa7ab7dd98db1e5a09" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-SEC-AWS-DYNAMODB-TABLE-ENCRYPTION-AT-REST", "kind": "encryption-at-rest", "family": "aws.dynamodb_table", "title": "Review the encryption at rest setting", "block": "server_side_encryption", "category": "encryption", "why": "The knowledge base cannot decide \"encryption-at-rest\" of the aws.dynamodb_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|encryption-at-rest" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the encryption at rest setting for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE", "source_family": "aws.dynamodb_table", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this that the knowledge base cannot decide: Review the encryption at rest setting.", "generated_target_behavior": "Review the encryption at rest setting: The draft does not carry the setting on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; a manual step stands for it (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/encryption-at-rest).", "residual_difference": "Review the encryption at rest setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/encryption-at-rest now.", "next_action": "Review the encryption at rest setting: Review the encryption at rest setting for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the encryption at rest setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. It is not stated in stackit_mongodbflex_instance (no encryption attribute) whether STACKIT MongoDB Flex encrypts data at rest: REVIEW (the customer managed key setting reads the key)." ], "closes_when": [ "Review the encryption at rest setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/encryption-at-rest", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/29" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|task-definition", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/129" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/40/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:5049a4a2c775c1575d3ddd82422180bceb433bf018864e226e722dd02283029d", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/task-definition", "sha256": "sha256:476e0e0c737f084c603bc78ab53b91a94f6b3a364e0bcb27c94e08f802faae15" }, { "kind": "review_cause", "id": "aws.ecs/task-definition", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-d2eec00d6c00", "subject": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/29" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-execute-command", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/125" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-task-definition", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/128" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-execution-role-arn", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/134" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-task-role-arn", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/136" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/40/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:7c029bf6912dd7e466ba3f83acb8125e103ae34e47e23de3a15e3579e13c7302", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-execute-command", "sha256": "sha256:c64bac7f837a289c4e08b5f91a04b77b20f155dcf1b846087f682060368f91e9" }, { "kind": "contract_semantic", "id": "aws.ecs/service-task-definition", "sha256": "sha256:5480a6310eb5a357692cf5f45726f13be78ba9568494a72a86adb3262f3b692e" }, { "kind": "contract_semantic", "id": "aws.ecs/td-execution-role-arn", "sha256": "sha256:05303acec15ddebdf1f9dc3615d3b09c3015719a8a6b29a0d4850c29bce5a5cf" }, { "kind": "contract_semantic", "id": "aws.ecs/td-task-role-arn", "sha256": "sha256:97b6b3f2d93d75d8f10b65a361809e3244b9e7a999786dfea7573333fe9ff510" }, { "kind": "review_cause", "id": "aws.ecs/service-execute-command", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-task-definition", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-execution-role-arn", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-task-role-arn", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 4 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-33ed39910304", "subject": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/29" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-connect-values", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/122" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-discovery", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/124" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-network-placement", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/126" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-public-ip-setting", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/127" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-network-mode", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/135" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/40/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:2884efd954f2c3166b542350df1a4b1da31abe480928a9ae49c5b5ec6e816f03", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-connect-values", "sha256": "sha256:f1b181314ae348d9e2eb1eea5ec79c35c135ca12adfb1d06e12a2bce6056ccb4" }, { "kind": "contract_semantic", "id": "aws.ecs/service-discovery", "sha256": "sha256:c62d964a7ff0195201cdca8fce6390d98f30e47a8213cd6ded24581fe0a27d09" }, { "kind": "contract_semantic", "id": "aws.ecs/service-network-placement", "sha256": "sha256:f5e3c25a28f19efa0e9a8aaf8329034aefec61787230decdda4cc5206ca8bcc7" }, { "kind": "contract_semantic", "id": "aws.ecs/service-public-ip-setting", "sha256": "sha256:cb514897c5bd4c7eee752087ace261549506ad50837ae1395060c4af6ea5a8bb" }, { "kind": "contract_semantic", "id": "aws.ecs/td-network-mode", "sha256": "sha256:7ef4b282c2eebe3ad6e185ae66ce565e9f43a599f59176820c82575f9d325b40" }, { "kind": "review_cause", "id": "aws.ecs/service-connect-values", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.ecs/service-discovery", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-network-placement", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-public-ip-setting", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.ecs/td-network-mode", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:740b2adc13bea6b71c5b1d64e72ccad5fc1c818dc112516074cfe17a9241851e" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "IMPLEMENTATION_GAP", "members": 3 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-36efe43b05d1", "subject": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/29" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-desired-count", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/123" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/40/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:ad056df0eb4026158ba41d1e9bd51c3acb82966bbafea534e35a1c48bcc88e3c", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-desired-count", "sha256": "sha256:be70b32151976e7f500dcab6412263663d1cc7a542d3da9fc51e2e4436d99f88" }, { "kind": "review_cause", "id": "aws.ecs/service-desired-count", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-cb0cea16aa72", "subject": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/29" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-definitions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/130" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-image-registry", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/131" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-plaintext-secret-env", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/132" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-secret-references", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/133" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/40/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:8fc8c7f0b478f96951ae2ef830884975f85854c85e40dc0f90397cfd96fe7297", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/td-container-definitions", "sha256": "sha256:e7c91d92538ff2f5976609c24864f7bf934892edfa4feef60b2781af1e2c9013" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-image-registry", "sha256": "sha256:79d5abfce805f7da64940bbf6c381eb27b7edb6544308d53a14d0ca4430c07f2" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-plaintext-secret-env", "sha256": "sha256:201d5a19d4db37095f00e316829d661442e27664d5638497c41b248d091ef735" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-secret-references", "sha256": "sha256:21d75939335fd82849b7f6b47374d9056214fe02f236c7405490ffc9422b0c15" }, { "kind": "review_cause", "id": "aws.ecs/td-container-definitions", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-container-image-registry", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.ecs/td-container-plaintext-secret-env", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.ecs/td-container-secret-references", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 3 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect.", "required_evidence": [], "items": [ { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-DEFINITIONS", "kind": "td-container-definitions", "family": "aws.ecs", "title": "Confirm the container definitions of the ECS task definition", "block": "td-container-definitions", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-definitions\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-definitions" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container definitions of the ECS task definition for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-IMAGE-REGISTRY", "kind": "td-container-image-registry", "family": "aws.ecs", "title": "Confirm the container image registry", "block": "td-container-image-registry", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-image-registry\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-image-registry" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container image registry for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-PLAINTEXT-SECRET-ENV", "kind": "td-container-plaintext-secret-env", "family": "aws.ecs", "title": "Confirm the container plaintext secret env", "block": "td-container-plaintext-secret-env", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-plaintext-secret-env\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-plaintext-secret-env" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container plaintext secret env for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-SECRET-REFERENCES", "kind": "td-container-secret-references", "family": "aws.ecs", "title": "Confirm the container secret references", "block": "td-container-secret-references", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-secret-references\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-secret-references" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container secret references for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm the container definitions of the ECS task definition; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.retail_app_ecs.module.carts_service.aws_ecs_service.this that the knowledge base cannot decide: Confirm the container definitions of the ECS task definition; Confirm the container image registry; Confirm the container plaintext secret env; Confirm the container secret references.", "generated_target_behavior": "Confirm the container definitions of the ECS task definition: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container image registry: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container plaintext secret env: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container secret references: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect).", "residual_difference": "Confirm the container definitions of the ECS task definition: the target behaviour of this setting is not established Confirm the container image registry: the target behaviour of this setting is not established Confirm the container plaintext secret env: the target behaviour of this setting is not established Confirm the container secret references: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect now.", "next_action": "Confirm the container definitions of the ECS task definition: Confirm the container definitions of the ECS task definition for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm the container definitions of the ECS task definition: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry. The unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) through this setting (the target does not carry it: it is REDESIGN), so what the reference becomes is part of this setting.", "Confirm the container image registry: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses.", "Confirm the container plaintext secret env: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated.", "Confirm the container secret references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, \"the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store\", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own)." ], "closes_when": [ "Confirm the container definitions of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the container image registry: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the container plaintext secret env: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the container secret references: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/40" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|task-definition", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/159" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/44/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:bd5bc5f42f2ccdd48a73d45fd65cc7d9a1889bd33e8ed34e32675b48cd9d43a6", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/task-definition", "sha256": "sha256:476e0e0c737f084c603bc78ab53b91a94f6b3a364e0bcb27c94e08f802faae15" }, { "kind": "review_cause", "id": "aws.ecs/task-definition", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-d2eec00d6c00", "subject": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/40" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-execute-command", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/155" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-task-definition", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/158" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-execution-role-arn", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/164" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-task-role-arn", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/166" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/44/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:269c883e5118d2289881d64bad4bc6c1a8026b09e6b86d27706930ba115e503d", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-execute-command", "sha256": "sha256:c64bac7f837a289c4e08b5f91a04b77b20f155dcf1b846087f682060368f91e9" }, { "kind": "contract_semantic", "id": "aws.ecs/service-task-definition", "sha256": "sha256:5480a6310eb5a357692cf5f45726f13be78ba9568494a72a86adb3262f3b692e" }, { "kind": "contract_semantic", "id": "aws.ecs/td-execution-role-arn", "sha256": "sha256:05303acec15ddebdf1f9dc3615d3b09c3015719a8a6b29a0d4850c29bce5a5cf" }, { "kind": "contract_semantic", "id": "aws.ecs/td-task-role-arn", "sha256": "sha256:97b6b3f2d93d75d8f10b65a361809e3244b9e7a999786dfea7573333fe9ff510" }, { "kind": "review_cause", "id": "aws.ecs/service-execute-command", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-task-definition", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-execution-role-arn", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-task-role-arn", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 4 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-33ed39910304", "subject": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/40" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-connect-values", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/152" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-discovery", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/154" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-network-placement", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/156" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-public-ip-setting", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/157" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-network-mode", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/165" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/44/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:a7b1d712f11c89a96ee56918ef329084ce43708b20a3f11098a99baba0b9f33c", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-connect-values", "sha256": "sha256:f1b181314ae348d9e2eb1eea5ec79c35c135ca12adfb1d06e12a2bce6056ccb4" }, { "kind": "contract_semantic", "id": "aws.ecs/service-discovery", "sha256": "sha256:c62d964a7ff0195201cdca8fce6390d98f30e47a8213cd6ded24581fe0a27d09" }, { "kind": "contract_semantic", "id": "aws.ecs/service-network-placement", "sha256": "sha256:f5e3c25a28f19efa0e9a8aaf8329034aefec61787230decdda4cc5206ca8bcc7" }, { "kind": "contract_semantic", "id": "aws.ecs/service-public-ip-setting", "sha256": "sha256:cb514897c5bd4c7eee752087ace261549506ad50837ae1395060c4af6ea5a8bb" }, { "kind": "contract_semantic", "id": "aws.ecs/td-network-mode", "sha256": "sha256:7ef4b282c2eebe3ad6e185ae66ce565e9f43a599f59176820c82575f9d325b40" }, { "kind": "review_cause", "id": "aws.ecs/service-connect-values", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.ecs/service-discovery", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-network-placement", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-public-ip-setting", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.ecs/td-network-mode", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:740b2adc13bea6b71c5b1d64e72ccad5fc1c818dc112516074cfe17a9241851e" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "IMPLEMENTATION_GAP", "members": 3 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-36efe43b05d1", "subject": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/40" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-desired-count", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/153" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/44/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:73e2e43b1b9a4861741108c4c531cf9c63a53c75ee5e01b4b73dff8acf27e7f2", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-desired-count", "sha256": "sha256:be70b32151976e7f500dcab6412263663d1cc7a542d3da9fc51e2e4436d99f88" }, { "kind": "review_cause", "id": "aws.ecs/service-desired-count", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-cb0cea16aa72", "subject": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/40" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-definitions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/160" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-image-registry", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/161" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-plaintext-secret-env", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/162" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-secret-references", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/163" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/44/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:12a0c54a0723669691b414ab9cfc18d1b7c1a075bd4a331607a44ac5ce805152", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/td-container-definitions", "sha256": "sha256:e7c91d92538ff2f5976609c24864f7bf934892edfa4feef60b2781af1e2c9013" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-image-registry", "sha256": "sha256:79d5abfce805f7da64940bbf6c381eb27b7edb6544308d53a14d0ca4430c07f2" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-plaintext-secret-env", "sha256": "sha256:201d5a19d4db37095f00e316829d661442e27664d5638497c41b248d091ef735" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-secret-references", "sha256": "sha256:21d75939335fd82849b7f6b47374d9056214fe02f236c7405490ffc9422b0c15" }, { "kind": "review_cause", "id": "aws.ecs/td-container-definitions", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-container-image-registry", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.ecs/td-container-plaintext-secret-env", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.ecs/td-container-secret-references", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 3 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect.", "required_evidence": [], "items": [ { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-DEFINITIONS", "kind": "td-container-definitions", "family": "aws.ecs", "title": "Confirm the container definitions of the ECS task definition", "block": "td-container-definitions", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-definitions\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-definitions" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container definitions of the ECS task definition for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-IMAGE-REGISTRY", "kind": "td-container-image-registry", "family": "aws.ecs", "title": "Confirm the container image registry", "block": "td-container-image-registry", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-image-registry\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-image-registry" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container image registry for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-PLAINTEXT-SECRET-ENV", "kind": "td-container-plaintext-secret-env", "family": "aws.ecs", "title": "Confirm the container plaintext secret env", "block": "td-container-plaintext-secret-env", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-plaintext-secret-env\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-plaintext-secret-env" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container plaintext secret env for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-SECRET-REFERENCES", "kind": "td-container-secret-references", "family": "aws.ecs", "title": "Confirm the container secret references", "block": "td-container-secret-references", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-secret-references\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-secret-references" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container secret references for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm the container definitions of the ECS task definition; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.retail_app_ecs.module.catalog_service.aws_ecs_service.this that the knowledge base cannot decide: Confirm the container definitions of the ECS task definition; Confirm the container image registry; Confirm the container plaintext secret env; Confirm the container secret references.", "generated_target_behavior": "Confirm the container definitions of the ECS task definition: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container image registry: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container plaintext secret env: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container secret references: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect).", "residual_difference": "Confirm the container definitions of the ECS task definition: the target behaviour of this setting is not established Confirm the container image registry: the target behaviour of this setting is not established Confirm the container plaintext secret env: the target behaviour of this setting is not established Confirm the container secret references: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect now.", "next_action": "Confirm the container definitions of the ECS task definition: Confirm the container definitions of the ECS task definition for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm the container definitions of the ECS task definition: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db (aws_secretsmanager_secret_version), module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch (aws_secretsmanager_secret_version). What each reference becomes is part of this setting.", "Confirm the container image registry: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses.", "Confirm the container plaintext secret env: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated.", "Confirm the container secret references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, \"the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store\", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own)." ], "closes_when": [ "Confirm the container definitions of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the container image registry: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the container plaintext secret env: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the container secret references: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/42" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|task-definition", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/189" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/48/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:623898041d449cd3e3c2d56f8809be431447e9c525cd8532005e86be1b16a734", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/task-definition", "sha256": "sha256:476e0e0c737f084c603bc78ab53b91a94f6b3a364e0bcb27c94e08f802faae15" }, { "kind": "review_cause", "id": "aws.ecs/task-definition", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-d2eec00d6c00", "subject": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/42" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-execute-command", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/185" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-task-definition", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/188" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-execution-role-arn", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/194" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-task-role-arn", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/196" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/48/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:b6de1150e6debd14d0a9aa3604ac089dfcfeba7948cdbead286de7bd9595abde", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-execute-command", "sha256": "sha256:c64bac7f837a289c4e08b5f91a04b77b20f155dcf1b846087f682060368f91e9" }, { "kind": "contract_semantic", "id": "aws.ecs/service-task-definition", "sha256": "sha256:5480a6310eb5a357692cf5f45726f13be78ba9568494a72a86adb3262f3b692e" }, { "kind": "contract_semantic", "id": "aws.ecs/td-execution-role-arn", "sha256": "sha256:05303acec15ddebdf1f9dc3615d3b09c3015719a8a6b29a0d4850c29bce5a5cf" }, { "kind": "contract_semantic", "id": "aws.ecs/td-task-role-arn", "sha256": "sha256:97b6b3f2d93d75d8f10b65a361809e3244b9e7a999786dfea7573333fe9ff510" }, { "kind": "review_cause", "id": "aws.ecs/service-execute-command", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-task-definition", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-execution-role-arn", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-task-role-arn", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 4 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-33ed39910304", "subject": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/42" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-connect-values", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/182" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-discovery", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/184" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-network-placement", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/186" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-public-ip-setting", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/187" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-network-mode", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/195" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/48/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:182803b416e449e90a1a14eb9db44d8d5c0bef7a7f4e34722f4e90a13b95e587", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-connect-values", "sha256": "sha256:f1b181314ae348d9e2eb1eea5ec79c35c135ca12adfb1d06e12a2bce6056ccb4" }, { "kind": "contract_semantic", "id": "aws.ecs/service-discovery", "sha256": "sha256:c62d964a7ff0195201cdca8fce6390d98f30e47a8213cd6ded24581fe0a27d09" }, { "kind": "contract_semantic", "id": "aws.ecs/service-network-placement", "sha256": "sha256:f5e3c25a28f19efa0e9a8aaf8329034aefec61787230decdda4cc5206ca8bcc7" }, { "kind": "contract_semantic", "id": "aws.ecs/service-public-ip-setting", "sha256": "sha256:cb514897c5bd4c7eee752087ace261549506ad50837ae1395060c4af6ea5a8bb" }, { "kind": "contract_semantic", "id": "aws.ecs/td-network-mode", "sha256": "sha256:7ef4b282c2eebe3ad6e185ae66ce565e9f43a599f59176820c82575f9d325b40" }, { "kind": "review_cause", "id": "aws.ecs/service-connect-values", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.ecs/service-discovery", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-network-placement", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-public-ip-setting", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.ecs/td-network-mode", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:740b2adc13bea6b71c5b1d64e72ccad5fc1c818dc112516074cfe17a9241851e" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "IMPLEMENTATION_GAP", "members": 3 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-36efe43b05d1", "subject": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/42" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-desired-count", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/183" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/48/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:2a81745ad63beb643a056962323f1bed54efeeb2e2761acae2698f863e5ffbb2", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-desired-count", "sha256": "sha256:be70b32151976e7f500dcab6412263663d1cc7a542d3da9fc51e2e4436d99f88" }, { "kind": "review_cause", "id": "aws.ecs/service-desired-count", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-cb0cea16aa72", "subject": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/42" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-container-definitions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/190" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-container-image-registry", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/191" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-container-plaintext-secret-env", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/192" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-container-secret-references", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/193" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/48/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:e14fe5e69f14c70daaa5e1cb8fb1b01b17f0cf1b730d6634665513ae538a7be6", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/td-container-definitions", "sha256": "sha256:e7c91d92538ff2f5976609c24864f7bf934892edfa4feef60b2781af1e2c9013" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-image-registry", "sha256": "sha256:79d5abfce805f7da64940bbf6c381eb27b7edb6544308d53a14d0ca4430c07f2" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-plaintext-secret-env", "sha256": "sha256:201d5a19d4db37095f00e316829d661442e27664d5638497c41b248d091ef735" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-secret-references", "sha256": "sha256:21d75939335fd82849b7f6b47374d9056214fe02f236c7405490ffc9422b0c15" }, { "kind": "review_cause", "id": "aws.ecs/td-container-definitions", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-container-image-registry", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.ecs/td-container-plaintext-secret-env", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.ecs/td-container-secret-references", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 3 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-be63643f5df1", "subject": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/41" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|task-definition", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/219" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/52/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:c0df273c3ce35360ad2de7275bf8232309dfe3548560c2d2bf71e5f5209e4108", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/task-definition", "sha256": "sha256:476e0e0c737f084c603bc78ab53b91a94f6b3a364e0bcb27c94e08f802faae15" }, { "kind": "review_cause", "id": "aws.ecs/task-definition", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-d2eec00d6c00", "subject": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/41" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-execute-command", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/215" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-task-definition", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/218" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-execution-role-arn", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/224" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-task-role-arn", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/226" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/52/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:9355891040e968a2302882459fd2e541f14ac72d084e886cfe7bd6401c5668d1", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-execute-command", "sha256": "sha256:c64bac7f837a289c4e08b5f91a04b77b20f155dcf1b846087f682060368f91e9" }, { "kind": "contract_semantic", "id": "aws.ecs/service-task-definition", "sha256": "sha256:5480a6310eb5a357692cf5f45726f13be78ba9568494a72a86adb3262f3b692e" }, { "kind": "contract_semantic", "id": "aws.ecs/td-execution-role-arn", "sha256": "sha256:05303acec15ddebdf1f9dc3615d3b09c3015719a8a6b29a0d4850c29bce5a5cf" }, { "kind": "contract_semantic", "id": "aws.ecs/td-task-role-arn", "sha256": "sha256:97b6b3f2d93d75d8f10b65a361809e3244b9e7a999786dfea7573333fe9ff510" }, { "kind": "review_cause", "id": "aws.ecs/service-execute-command", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-task-definition", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-execution-role-arn", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-task-role-arn", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 4 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-33ed39910304", "subject": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/41" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-connect-values", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/212" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-discovery", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/214" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-network-placement", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/216" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-public-ip-setting", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/217" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-network-mode", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/225" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/52/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:c3fbe4584e6bfa97ed29b1ba37ed5b2284ee1bf2f21e5df2d762845bfcc9bcce", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-connect-values", "sha256": "sha256:f1b181314ae348d9e2eb1eea5ec79c35c135ca12adfb1d06e12a2bce6056ccb4" }, { "kind": "contract_semantic", "id": "aws.ecs/service-discovery", "sha256": "sha256:c62d964a7ff0195201cdca8fce6390d98f30e47a8213cd6ded24581fe0a27d09" }, { "kind": "contract_semantic", "id": "aws.ecs/service-network-placement", "sha256": "sha256:f5e3c25a28f19efa0e9a8aaf8329034aefec61787230decdda4cc5206ca8bcc7" }, { "kind": "contract_semantic", "id": "aws.ecs/service-public-ip-setting", "sha256": "sha256:cb514897c5bd4c7eee752087ace261549506ad50837ae1395060c4af6ea5a8bb" }, { "kind": "contract_semantic", "id": "aws.ecs/td-network-mode", "sha256": "sha256:7ef4b282c2eebe3ad6e185ae66ce565e9f43a599f59176820c82575f9d325b40" }, { "kind": "review_cause", "id": "aws.ecs/service-connect-values", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.ecs/service-discovery", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-network-placement", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-public-ip-setting", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.ecs/td-network-mode", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:740b2adc13bea6b71c5b1d64e72ccad5fc1c818dc112516074cfe17a9241851e" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "IMPLEMENTATION_GAP", "members": 3 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-36efe43b05d1", "subject": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/41" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-desired-count", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/213" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/52/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:a99af72e26244afeba9183b468016c2f97d481f9ef9e344f8b0cd66bc4f96e85", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-desired-count", "sha256": "sha256:be70b32151976e7f500dcab6412263663d1cc7a542d3da9fc51e2e4436d99f88" }, { "kind": "review_cause", "id": "aws.ecs/service-desired-count", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-cb0cea16aa72", "subject": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/41" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-definitions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/220" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-image-registry", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/221" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-plaintext-secret-env", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/222" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-secret-references", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/223" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/52/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:be34e739bc39a8d7f9a75ec54e4a06207f7b84000f5f784e735bcc8fac34a2be", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/td-container-definitions", "sha256": "sha256:e7c91d92538ff2f5976609c24864f7bf934892edfa4feef60b2781af1e2c9013" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-image-registry", "sha256": "sha256:79d5abfce805f7da64940bbf6c381eb27b7edb6544308d53a14d0ca4430c07f2" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-plaintext-secret-env", "sha256": "sha256:201d5a19d4db37095f00e316829d661442e27664d5638497c41b248d091ef735" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-secret-references", "sha256": "sha256:21d75939335fd82849b7f6b47374d9056214fe02f236c7405490ffc9422b0c15" }, { "kind": "review_cause", "id": "aws.ecs/td-container-definitions", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-container-image-registry", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.ecs/td-container-plaintext-secret-env", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.ecs/td-container-secret-references", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 3 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect.", "required_evidence": [], "items": [ { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-DEFINITIONS", "kind": "td-container-definitions", "family": "aws.ecs", "title": "Confirm the container definitions of the ECS task definition", "block": "td-container-definitions", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-definitions\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-definitions" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container definitions of the ECS task definition for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-IMAGE-REGISTRY", "kind": "td-container-image-registry", "family": "aws.ecs", "title": "Confirm the container image registry", "block": "td-container-image-registry", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-image-registry\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-image-registry" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container image registry for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-PLAINTEXT-SECRET-ENV", "kind": "td-container-plaintext-secret-env", "family": "aws.ecs", "title": "Confirm the container plaintext secret env", "block": "td-container-plaintext-secret-env", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-plaintext-secret-env\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-plaintext-secret-env" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container plaintext secret env for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-SECRET-REFERENCES", "kind": "td-container-secret-references", "family": "aws.ecs", "title": "Confirm the container secret references", "block": "td-container-secret-references", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-secret-references\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-secret-references" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container secret references for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm the container definitions of the ECS task definition; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.retail_app_ecs.module.orders_service.aws_ecs_service.this that the knowledge base cannot decide: Confirm the container definitions of the ECS task definition; Confirm the container image registry; Confirm the container plaintext secret env; Confirm the container secret references.", "generated_target_behavior": "Confirm the container definitions of the ECS task definition: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container image registry: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container plaintext secret env: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container secret references: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect).", "residual_difference": "Confirm the container definitions of the ECS task definition: the target behaviour of this setting is not established Confirm the container image registry: the target behaviour of this setting is not established Confirm the container plaintext secret env: the target behaviour of this setting is not established Confirm the container secret references: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect now.", "next_action": "Confirm the container definitions of the ECS task definition: Confirm the container definitions of the ECS task definition for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm the container definitions of the ECS task definition: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret_version.mq (aws_secretsmanager_secret_version), module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db (aws_secretsmanager_secret_version). What each reference becomes is part of this setting.", "Confirm the container image registry: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses.", "Confirm the container plaintext secret env: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated.", "Confirm the container secret references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, \"the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store\", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own)." ], "closes_when": [ "Confirm the container definitions of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the container image registry: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the container plaintext secret env: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the container secret references: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/43" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|task-definition", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/250" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/56/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:cd84cdba0aa722b0700f256589172631f462ab3a79939d8703d4dcf136e51830", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/task-definition", "sha256": "sha256:476e0e0c737f084c603bc78ab53b91a94f6b3a364e0bcb27c94e08f802faae15" }, { "kind": "review_cause", "id": "aws.ecs/task-definition", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-d2eec00d6c00", "subject": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/43" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-execute-command", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/245" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-task-definition", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/249" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-execution-role-arn", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/255" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-task-role-arn", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/257" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/56/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:13b648f793c6330d876e75b4a9e7de9a954b1465c6fd5e915538b738c05650ba", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-execute-command", "sha256": "sha256:c64bac7f837a289c4e08b5f91a04b77b20f155dcf1b846087f682060368f91e9" }, { "kind": "contract_semantic", "id": "aws.ecs/service-task-definition", "sha256": "sha256:5480a6310eb5a357692cf5f45726f13be78ba9568494a72a86adb3262f3b692e" }, { "kind": "contract_semantic", "id": "aws.ecs/td-execution-role-arn", "sha256": "sha256:05303acec15ddebdf1f9dc3615d3b09c3015719a8a6b29a0d4850c29bce5a5cf" }, { "kind": "contract_semantic", "id": "aws.ecs/td-task-role-arn", "sha256": "sha256:97b6b3f2d93d75d8f10b65a361809e3244b9e7a999786dfea7573333fe9ff510" }, { "kind": "review_cause", "id": "aws.ecs/service-execute-command", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-task-definition", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-execution-role-arn", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-task-role-arn", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 4 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-33ed39910304", "subject": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/43" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-connect-values", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/242" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-discovery", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/244" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-load-balancer-target", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/246" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-network-placement", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/247" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-public-ip-setting", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/248" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-network-mode", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/256" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/56/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:a803971360a7c14f2d1f59ef457345625b6b24b4ab02a4c951935921fa6b197c", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-connect-values", "sha256": "sha256:f1b181314ae348d9e2eb1eea5ec79c35c135ca12adfb1d06e12a2bce6056ccb4" }, { "kind": "contract_semantic", "id": "aws.ecs/service-discovery", "sha256": "sha256:c62d964a7ff0195201cdca8fce6390d98f30e47a8213cd6ded24581fe0a27d09" }, { "kind": "contract_semantic", "id": "aws.ecs/service-load-balancer-target", "sha256": "sha256:20f8b4832e8f81dae417b4af4d28e7b59725fffa69da208566c0688ebd81e43e" }, { "kind": "contract_semantic", "id": "aws.ecs/service-network-placement", "sha256": "sha256:f5e3c25a28f19efa0e9a8aaf8329034aefec61787230decdda4cc5206ca8bcc7" }, { "kind": "contract_semantic", "id": "aws.ecs/service-public-ip-setting", "sha256": "sha256:cb514897c5bd4c7eee752087ace261549506ad50837ae1395060c4af6ea5a8bb" }, { "kind": "contract_semantic", "id": "aws.ecs/td-network-mode", "sha256": "sha256:7ef4b282c2eebe3ad6e185ae66ce565e9f43a599f59176820c82575f9d325b40" }, { "kind": "review_cause", "id": "aws.ecs/service-connect-values", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.ecs/service-discovery", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-load-balancer-target", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.ecs/service-network-placement", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/service-public-ip-setting", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.ecs/td-network-mode", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:e7d39dd26d25e95decbc7941cd521cd27187f04056ac8fbb3d6a588d2780ea49" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "IMPLEMENTATION_GAP", "members": 3 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 6 critical settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-ECS-SERVICE-CONNECT-VALUES", "kind": "service-connect-values", "family": "aws.ecs", "title": "Review the service connect values setting", "block": "service_connect_configuration", "category": "network-exposure", "why": "The knowledge base cannot decide \"service-connect-values\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-connect-values" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the service connect values setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ECS-SERVICE-DISCOVERY", "kind": "service-discovery", "family": "aws.ecs", "title": "Review the service discovery setting", "block": "service_connect_configuration", "category": "network-exposure", "why": "The knowledge base cannot decide \"service-discovery\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-discovery" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the service discovery setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ECS-SERVICE-LOAD-BALANCER-TARGET", "kind": "service-load-balancer-target", "family": "aws.ecs", "title": "Review the service load balancer target setting", "block": "load_balancer", "category": "network-exposure", "why": "The knowledge base cannot decide \"service-load-balancer-target\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-load-balancer-target" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the service load balancer target setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ECS-SERVICE-NETWORK-PLACEMENT", "kind": "service-network-placement", "family": "aws.ecs", "title": "Review the service network placement setting", "block": "network_configuration", "category": "network-exposure", "why": "The knowledge base cannot decide \"service-network-placement\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-network-placement" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the service network placement setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ECS-SERVICE-PUBLIC-IP-SETTING", "kind": "service-public-ip-setting", "family": "aws.ecs", "title": "Review the service public IP setting setting", "block": "network_configuration", "category": "network-exposure", "why": "The knowledge base cannot decide \"service-public-ip-setting\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-public-ip-setting" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the service public IP setting setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ECS-TD-NETWORK-MODE", "kind": "td-network-mode", "family": "aws.ecs", "title": "Confirm the network mode of the ECS task definition", "block": "td-network-mode", "category": "network-exposure", "why": "The knowledge base cannot decide \"td-network-mode\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-network-mode" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the network mode of the ECS task definition for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the service connect values setting; the 6 settings of the record state their own.", "source_observation": "The source states 6 critical settings on module.retail_app_ecs.module.ui_service.aws_ecs_service.this that the knowledge base cannot decide: Review the service connect values setting; Review the service discovery setting; Review the service load balancer target setting; Review the service network placement setting; Review the service public IP setting setting; Confirm the network mode of the ECS task definition.", "generated_target_behavior": "Review the service connect values setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect). Review the service discovery setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect). Review the service load balancer target setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect). Review the service network placement setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect). Review the service public IP setting setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect). Confirm the network mode of the ECS task definition: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect).", "residual_difference": "Review the service connect values setting: the target behaviour of this setting is not established Review the service discovery setting: the target behaviour of this setting is not established Review the service load balancer target setting: the target behaviour of this setting is not established Review the service network placement setting: the target behaviour of this setting is not established Review the service public IP setting setting: the target behaviour of this setting is not established Confirm the network mode of the ECS task definition: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect now.", "next_action": "Review the service connect values setting: Review the service connect values setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the service connect values setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Service Connect's switch, namespace, service names, client aliases (DNS name and port), traffic-test header rules, mTLS settings (KMS key, role, private CA) and proxy logging: an AWS-managed service mesh with no draft counterpart; discovery on SKE is Kubernetes Services and DNS, mesh features a person's choice.", "Review the service discovery setting: A check of the knowledge base (ecs service discovery) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states how ECS services find each other: AWS Cloud Map registries and namespaces, or ECS Service Connect.", "Review the service load balancer target setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states which container and port receive the load balancer's traffic, the target group or classic load balancer name, and the blue/green listener rules and role: the wiring becomes a Kubernetes Service / Ingress selector and a STACKIT load balancer target pool, written by a person (the draft has no service block to carry it).", "Review the service network placement setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The subnets and security groups the tasks' network interfaces use (awsvpc mode); on SKE pods take the cluster's network and NetworkPolicies decide reachability — a person re-expresses the security group rules.", "Review the service public IP setting setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. assign_public_ip in either state (the public ip setting reads only true through the public address check): tasks with a public address are exposed unless a person decides the exposure on SKE explicitly (LoadBalancer services, network policies); false is the private default and is still re-checked, the draft carries no service block.", "Confirm the network mode of the ECS task definition: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.network_mode of the template the group builds its instances from: How the containers are networked (awsvpc, bridge, host, none): whether each task has its own interface and security groups or shares the host's network. Not verified as carried by any semantic of this family — reviewed." ], "closes_when": [ "Review the service connect values setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the service discovery setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE.", "Review the service load balancer target setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the service network placement setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the service public IP setting setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the network mode of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/43" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-desired-count", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/243" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/56/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:892d8be364574bea145cb905c22d892bdcf013b62b24306a5e72cfd27f92bb59", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/service-desired-count", "sha256": "sha256:be70b32151976e7f500dcab6412263663d1cc7a542d3da9fc51e2e4436d99f88" }, { "kind": "review_cause", "id": "aws.ecs/service-desired-count", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-cb0cea16aa72", "subject": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "kind": "unit-review", "family": "aws.ecs", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.ecs", "block": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/43" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-container-definitions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/251" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-container-image-registry", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/252" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-container-plaintext-secret-env", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/253" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-container-secret-references", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/254" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/56/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:e4bca6f80507db70550fa30296dcb1663d180045b12ab84aef82f90af4d4591f", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.ecs/td-container-definitions", "sha256": "sha256:e7c91d92538ff2f5976609c24864f7bf934892edfa4feef60b2781af1e2c9013" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-image-registry", "sha256": "sha256:79d5abfce805f7da64940bbf6c381eb27b7edb6544308d53a14d0ca4430c07f2" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-plaintext-secret-env", "sha256": "sha256:201d5a19d4db37095f00e316829d661442e27664d5638497c41b248d091ef735" }, { "kind": "contract_semantic", "id": "aws.ecs/td-container-secret-references", "sha256": "sha256:21d75939335fd82849b7f6b47374d9056214fe02f236c7405490ffc9422b0c15" }, { "kind": "review_cause", "id": "aws.ecs/td-container-definitions", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.ecs/td-container-image-registry", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.ecs/td-container-plaintext-secret-env", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.ecs/td-container-secret-references", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 3 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-be63643f5df1", "subject": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "resolution": { "decision_id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "source_family": "aws.ecs", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-EIP-NAT", "kind": "unit-review", "family": "aws.eip", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.eip", "block": "module.vpc.module.vpc.aws_eip.nat", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.vpc.module.vpc.aws_eip.nat", "artifact": "assessment.json", "pointer": "/units/7" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.vpc.module.vpc.aws_eip.nat|public-address", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/273" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:8d53b9492e347facc4402eb7bb6e29a11778a63c708b92d5e683cc85fb10dcd9", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.eip/public-address", "sha256": "sha256:ad87ab1b8a9aae8dfe053e7c119349a2f08a9a552d5788ea718c6f1993c4622a" }, { "kind": "review_cause", "id": "aws.eip/public-address", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" } ], "kb_dependencies_sha256": "sha256:4bc458f7128cf963a901fb482f5f02839c79dbf8761eb465d1d4257468472a2f" }, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of module.vpc.module.vpc.aws_eip.nat: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-EIP-PUBLIC-ADDRESS", "kind": "public-address", "family": "aws.eip", "title": "Review the public address setting", "block": "public-address", "category": "network-exposure", "why": "The knowledge base cannot decide \"public-address\" of the aws.eip contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.vpc.module.vpc.aws_eip.nat|public-address" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.vpc.module.vpc.aws_eip.nat outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-EIP-NAT", "source_family": "aws.eip", "source_semantic": "unit-review", "affected_units": [ "module.vpc.module.vpc.aws_eip.nat" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "private-egress-dns", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance names a manual step as the only path", "source_observation": "The source states 1 critical setting on module.vpc.module.vpc.aws_eip.nat that the knowledge base cannot decide: Review the public address setting.", "generated_target_behavior": "Review the public address setting: The draft does not carry the setting on module.vpc.module.vpc.aws_eip.nat; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_eip.nat/public-address). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the public address setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_eip.nat/public-address now.", "next_action": "Review the public address setting: Carry out the manual work the plan names for module.vpc.module.vpc.aws_eip.nat outside the draft; the plan states no title for it.", "why_open": [ "Review the public address setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The address changes. An Elastic IP of a NAT gateway is its fixed egress address, an open question on STACKIT (fixed egress ip of the NAT gateway rule)." ], "closes_when": [ "Review the public address setting: A person decides how peers that allow-list the Elastic IP are served: STACKIT egress uses the project's shared address, which differs from the Elastic IP, cannot be set and can change; a STACKIT public IP per server keeps its address." ], "required_inputs": [], "resolution_paths": [ { "id": "public-address/decide-and-carry-out", "title": "Review the public address setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.", "regeneration: not stated — treated as required" ], "risk": [ "The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes." ], "evidence": [ "contract note aws.eip/public-address: \"A person decides how peers that allow-list the Elastic IP are served: STACKIT egress uses the project's shared address, which differs from the Elastic IP, cannot be set and can change; a STACKIT public IP per server keeps its address.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the public address setting: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the public address setting: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.eip/public-address: \"A person decides how peers that allow-list the Elastic IP are served: STACKIT egress uses the project's shared address, which differs from the Elastic IP, cannot be set and can change; a STACKIT public IP per server keeps its address.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.vpc.module.vpc.aws_eip.nat/public-address", "mode": "MANUAL", "phase": "FOUNDATION", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-DATA-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "kind": "unit-review", "family": "aws.elasticache", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.elasticache", "block": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Data Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "artifact": "assessment.json", "pointer": "/units/33" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|seed-snapshot", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/58" }, { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|snapshots-off", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/59" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "artifact": "workspace.json", "pointer": "/units/13/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:a81099a7a19d0a70e93099ba046b0f6ffe0b067d5d7d330a726223a11b4a8a71", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.elasticache/seed-snapshot", "sha256": "sha256:918d050d0c513cf90918d8d39f3feb1dc7d75ea84079031dbd95d0f8ec91828e" }, { "kind": "contract_semantic", "id": "aws.elasticache/snapshots-off", "sha256": "sha256:bc4e62ab74d15522de0ca5150e79e1e1d03ec5f0d77be1dc71337bba2747b75e" }, { "kind": "review_cause", "id": "aws.elasticache/seed-snapshot", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.elasticache/snapshots-off", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:1ee3357c1d90f2bef2277d76647a933f82410caff1d0177f1f0e28eaee2ee43a" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 2 critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect.", "required_evidence": [], "items": [ { "id": "DEC-DATA-AWS-ELASTICACHE-SEED-SNAPSHOT", "kind": "seed-snapshot", "family": "aws.elasticache", "title": "Review the seed snapshot setting", "block": "snapshot_arns", "category": "backup-retention", "why": "The knowledge base cannot decide \"seed-snapshot\" of the aws.elasticache contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|seed-snapshot" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the seed snapshot setting for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-DATA-AWS-ELASTICACHE-SNAPSHOTS-OFF", "kind": "snapshots-off", "family": "aws.elasticache", "title": "Review the snapshots off setting", "block": "snapshot_retention_limit", "category": "backup-retention", "why": "The knowledge base cannot decide \"snapshots-off\" of the aws.elasticache contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|snapshots-off" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the snapshots off setting for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-DATA-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "source_family": "aws.elasticache", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Data Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the seed snapshot setting; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default that the knowledge base cannot decide: Review the seed snapshot setting; Review the snapshots off setting.", "generated_target_behavior": "Review the seed snapshot setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect). Review the snapshots off setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect).", "residual_difference": "Review the seed snapshot setting: the target behaviour of this setting is not established Review the snapshots off setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect now.", "next_action": "Review the seed snapshot setting: Review the seed snapshot setting for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the seed snapshot setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The instance is created empty: the data is migrated by a person (RDB export and import, or replication); stackit_valkey_instance and stackit_redis_instance have no snapshot or restore attribute (pinned provider). snapshot_arns is observed for every set value, an empty list included: the draft names snapshot_arns NOT CARRIED even when it is empty; a conditional with a null branch stays undecided, hence REVIEW.", "Review the snapshots off setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. No snapshots in the source; whether a STACKIT Valkey instance takes snapshots by default (parameters.snapshot, not generated) is not documented — REVIEW." ], "closes_when": [ "Review the seed snapshot setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the snapshots off setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "kind": "unit-review", "family": "aws.elasticache", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.elasticache", "block": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "artifact": "assessment.json", "pointer": "/units/33" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|network-placement", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/55" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "artifact": "workspace.json", "pointer": "/units/13/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:6a0885338cdc784fa0469bff7f3e328048bdf0779f8fe6695463e4f84db89ece", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.elasticache/network-placement", "sha256": "sha256:aef4b7dcef884965953638a9dcf166d3bca1bf3cf42604974a8c7b5202317153" }, { "kind": "review_cause", "id": "aws.elasticache/network-placement", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:d1f381c53c8452030abb8fadded9bf0c6eb8d656d37128d0d538bd6b4f33a8dc" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-ELASTICACHE-NETWORK-PLACEMENT", "kind": "network-placement", "family": "aws.elasticache", "title": "Review the network placement setting", "block": "network_type", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-placement\" of the aws.elasticache contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|network-placement" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "source_family": "aws.elasticache", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "managed-data-services", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance names a manual step as the only path", "source_observation": "The source states 1 critical setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default that the knowledge base cannot decide: Review the network placement setting.", "generated_target_behavior": "Review the network placement setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/network-placement). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the network placement setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/network-placement now.", "next_action": "Review the network placement setting: Carry out the manual work the plan names for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default outside the draft; the plan states no title for it.", "why_open": [ "Review the network placement setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_valkey_instance has no subnet, security-group, zone or IP-family attribute; client access can be limited by CIDR with parameters.sgw_acl, which the draft does not generate — a person decides it." ], "closes_when": [ "Review the network placement setting: A person decides how clients reach the Valkey instance, which has no subnet or security-group setting, for example by limiting client CIDR ranges with its access parameter." ], "required_inputs": [], "resolution_paths": [ { "id": "network-placement/decide-and-carry-out", "title": "Review the network placement setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.", "regeneration: not stated — treated as required" ], "risk": [ "The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes." ], "evidence": [ "contract note aws.elasticache/auth-token-rotation: \"A person decides the rotation strategy for the access credential on the target, where a rotated credential is a new Valkey credential.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the network placement setting: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the network placement setting: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.elasticache/auth-token-rotation: \"A person decides the rotation strategy for the access credential on the target, where a rotated credential is a new Valkey credential.\"", "contract note aws.elasticache/customer-managed-key: \"A person decides whether encryption without a customer-managed key is acceptable for this cache: stackit_valkey_instance takes no customer key.\"", "contract note aws.elasticache/failover-replicas: \"A person chooses a replica service plan for the Key Value Store: replica plans run across availability zones with automatic recovery, single-node plans do not.\"", "contract note aws.elasticache/network-placement: \"A person decides how clients reach the Valkey instance, which has no subnet or security-group setting, for example by limiting client CIDR ranges with its access parameter.\"", "contract note aws.elasticache/parameter-group: \"A person maps each parameter the group changes to the parameters of the Valkey instance (for example the memory policy and the keyspace notifications) and sets them there.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/network-placement", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "kind": "unit-review", "family": "aws.elasticache", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.elasticache", "block": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "artifact": "assessment.json", "pointer": "/units/33" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|failover-off", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/54" }, { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|parameter-group", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/56" }, { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|parameter-group-default", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/57" }, { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|tc-elasticache-replication-group-replication-group-id", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/60" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "artifact": "workspace.json", "pointer": "/units/13/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:22903c56db5911aeb017374334c4c459471b44cc52549e1be5fc3e282b7f0382", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.elasticache/failover-off", "sha256": "sha256:c1dbdfdb376ec942ff579d6259ca3fbc19a5351cd493bce31d9d52fc83d8adc0" }, { "kind": "contract_semantic", "id": "aws.elasticache/parameter-group", "sha256": "sha256:9d49a53aa09435ec73d3818ec44ab5963647e517c97f095baa4e777cc090905c" }, { "kind": "contract_semantic", "id": "aws.elasticache/parameter-group-default", "sha256": "sha256:52abc7b4f0a79c13dfd9f0a483b1a72b7635382d5253cb8f44dcdb325a8fcbb4" }, { "kind": "contract_semantic", "id": "aws.elasticache/tc-elasticache-replication-group-replication-group-id", "sha256": "sha256:ac1d4f2dfd9acc071e675c239975442a4854f07c2c5c87243418282fe72feea5" }, { "kind": "review_cause", "id": "aws.elasticache/failover-off", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.elasticache/parameter-group", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.elasticache/parameter-group-default", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.elasticache/tc-elasticache-replication-group-replication-group-id", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:5d0001ac4c605ad621214b69352a2f2bad9716a15d2f911df0e9d0cdcedea51b" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect.", "required_evidence": [], "items": [ { "id": "DEC-OPS-AWS-ELASTICACHE-FAILOVER-OFF", "kind": "failover-off", "family": "aws.elasticache", "title": "Review the failover off setting", "block": "automatic_failover_enabled", "category": "availability-durability", "why": "The knowledge base cannot decide \"failover-off\" of the aws.elasticache contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|failover-off" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the failover off setting for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-AWS-ELASTICACHE-PARAMETER-GROUP", "kind": "parameter-group", "family": "aws.elasticache", "title": "Review the parameter group setting", "block": "parameter_group_name", "category": "availability-durability", "why": "The knowledge base cannot decide \"parameter-group\" of the aws.elasticache contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|parameter-group" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default outside the draft; the plan states no title for it." }, { "id": "DEC-OPS-AWS-ELASTICACHE-PARAMETER-GROUP-DEFAULT", "kind": "parameter-group-default", "family": "aws.elasticache", "title": "Review the parameter group default setting", "block": "parameter_group_name", "category": "availability-durability", "why": "The knowledge base cannot decide \"parameter-group-default\" of the aws.elasticache contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|parameter-group-default" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-OPS-AWS-ELASTICACHE-TC-ELASTICACHE-REPLICATION-GROUP-REPLIC-D383F7A4", "kind": "tc-elasticache-replication-group-replication-group-id", "family": "aws.elasticache", "title": "Confirm the replication group ID of the ElastiCache replication group", "block": "replication_group_id", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-elasticache-replication-group-replication-group-id\" of the aws.elasticache contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|tc-elasticache-replication-group-replication-group-id" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: the check, proof or closing evidence is recorded with its result." } ], "resolution": { "decision_id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "source_family": "aws.elasticache", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the failover off setting; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default that the knowledge base cannot decide: Review the failover off setting; Review the parameter group setting; Review the parameter group default setting; Confirm the replication group ID of the ElastiCache replication group.", "generated_target_behavior": "Review the failover off setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect). Review the parameter group setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the parameter group default setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the replication group ID of the ElastiCache replication group: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the failover off setting: the target behaviour of this setting is not established Review the parameter group setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the parameter group default setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the replication group ID of the ElastiCache replication group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect now.", "next_action": "Review the failover off setting: Review the failover off setting for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the failover off setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A single node without failover: the draft asks for the plan (plan_name is a variable), so whether the target is a Single plan is a person's choice — REVIEW, not PRESERVED.", "Review the parameter group setting: A check of the knowledge base (redis parameter group) needs a value the scan cannot read statically, so it could not decide. The setting states which custom set of engine parameters (a parameter group) the cache runs with.", "Review the parameter group default setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A parameter group named default.\u003cfamily\u003e carries the AWS default settings of that engine family and version, and its name can carry the topology: a group with cluster.on in its name enables cluster mode.", "Confirm the replication group ID of the ElastiCache replication group: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The identifier of the cache replication group. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract)." ], "closes_when": [ "Review the failover off setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the parameter group setting: A person maps each parameter the group changes to the parameters of the Valkey instance (for example the memory policy and the keyspace notifications) and sets them there.", "Review the parameter group setting: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value.", "Review the parameter group default setting: A person confirms that the defaults of the source parameter group family are what the application needs on the target and, for a cluster-mode group, treats it as the cluster-mode question.", "Confirm the replication group ID of the ElastiCache replication group: A person confirms the instance name the target uses against what refers to the replication group id, or accepts the new name." ], "required_inputs": [], "resolution_paths": [ { "id": "parameter-group/decide-and-carry-out", "title": "Review the parameter group setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.", "regeneration: not stated — treated as required" ], "risk": [ "The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes." ], "evidence": [ "contract note aws.elasticache/auth-token-rotation: \"A person decides the rotation strategy for the access credential on the target, where a rotated credential is a new Valkey credential.\"" ], "regeneration_required": true }, { "id": "parameter-group-default/verify-on-target", "title": "Review the parameter group default setting: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.elasticache/at-rest-encryption: \"A person confirms the encryption at rest of the Key Value Store plan on the target; the instance has no encryption setting that could carry the value (pinned provider), and no STACKIT fact about it is documented here.\"" ], "regeneration_required": true }, { "id": "tc-elasticache-replication-group-replication-group-id/verify-on-target", "title": "Confirm the replication group ID of the ElastiCache replication group: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.elasticache/at-rest-encryption: \"A person confirms the encryption at rest of the Key Value Store plan on the target; the instance has no encryption setting that could carry the value (pinned provider), and no STACKIT fact about it is documented here.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the parameter group setting: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Review the parameter group default setting: the check, proof or closing evidence is recorded with its result", "Confirm the replication group ID of the ElastiCache replication group: the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the parameter group setting: Manual work remains: a person closes the semantic, the draft does not.", "Review the parameter group default setting: Manual work remains: a person closes the semantic, the draft does not.", "Confirm the replication group ID of the ElastiCache replication group: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.elasticache/auth-token-rotation: \"A person decides the rotation strategy for the access credential on the target, where a rotated credential is a new Valkey credential.\"", "contract note aws.elasticache/customer-managed-key: \"A person decides whether encryption without a customer-managed key is acceptable for this cache: stackit_valkey_instance takes no customer key.\"", "contract note aws.elasticache/failover-replicas: \"A person chooses a replica service plan for the Key Value Store: replica plans run across availability zones with automatic recovery, single-node plans do not.\"", "contract note aws.elasticache/network-placement: \"A person decides how clients reach the Valkey instance, which has no subnet or security-group setting, for example by limiting client CIDR ranges with its access parameter.\"", "contract note aws.elasticache/parameter-group: \"A person maps each parameter the group changes to the parameters of the Valkey instance (for example the memory policy and the keyspace notifications) and sets them there.\"", "contract note aws.elasticache/at-rest-encryption: \"A person confirms the encryption at rest of the Key Value Store plan on the target; the instance has no encryption setting that could carry the value (pinned provider), and no STACKIT fact about it is documented here.\"", "contract note aws.elasticache/parameter-group-default: \"A person confirms that the defaults of the source parameter group family are what the application needs on the target and, for a cluster-mode group, treats it as the cluster-mode question.\"", "contract note aws.elasticache/tc-elasticache-replication-group-replication-group-id: \"A person confirms the instance name the target uses against what refers to the replication group id, or accepts the new name.\"", "contract note aws.elasticache/tcp-elasticache-replication-group-at-rest-encryption-enabled: \"A person confirms that the cache data and snapshots are encrypted at rest on the target, as the source setting requires.\"", "contract note aws.elasticache/tcp-elasticache-replication-group-num-cache-clusters: \"A person confirms that the target keeps at least one replica as a failover target when the source had primary and replicas.\"", "contract note aws.elasticache/tcp-elasticache-replication-group-transit-encryption-enabled: \"A person confirms that clients reach the cache over TLS on the target, so that data and the authentication token are not sent in clear.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "kind": "unit-review", "family": "aws.elasticache", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.elasticache", "block": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "artifact": "assessment.json", "pointer": "/units/33" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|at-rest-encryption-off", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/53" }, { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|tcp-elasticache-replication-group-transit-encryption-enabled", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/61" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default", "artifact": "workspace.json", "pointer": "/units/13/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:7a84420d04b71d9952e3521b09fbde28030d59bd2678d039f0ea48f4d8c6eec5", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.elasticache/at-rest-encryption-off", "sha256": "sha256:e71af479f20ea7ba038c754804e305625782795cfff34baf4621562f11a6866f" }, { "kind": "contract_semantic", "id": "aws.elasticache/tcp-elasticache-replication-group-transit-encryption-enabled", "sha256": "sha256:6f70c221c6a38f6e5262c154ded76ba5f05eb3345540b7c6480d187ed55862a2" }, { "kind": "decision_kind", "id": "aws.elasticache/tcp-elasticache-replication-group-transit-encryption-enabled", "sha256": "sha256:23724898cf3ea8747083da6828e99a9c97f07ba8537f4107ec5eb7cbcd2bd838" }, { "kind": "review_cause", "id": "aws.elasticache/at-rest-encryption-off", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.elasticache/tcp-elasticache-replication-group-transit-encryption-enabled", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:2c0d94a3cf7416d1d38ee33a2c9aee2886f57b65508423676b010d17130cd4c4" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 2 critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect.", "required_evidence": [ "an observation on a STACKIT instance (or STACKIT's statement) of whether a connection without TLS is accepted, since the pages read do not state it", "the clients of the cache and whether each can connect with TLS (and verify the certificate)" ], "items": [ { "id": "DEC-SEC-AWS-ELASTICACHE-AT-REST-ENCRYPTION-OFF", "kind": "at-rest-encryption-off", "family": "aws.elasticache", "title": "Review the at rest encryption off setting", "block": "at_rest_encryption_enabled", "category": "encryption", "why": "The knowledge base cannot decide \"at-rest-encryption-off\" of the aws.elasticache contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|at-rest-encryption-off" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the at rest encryption off setting for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-ELASTICACHE-TCP-ELASTICACHE-REPLICATION-GROUP-TRANS-B5C85484", "kind": "tcp-elasticache-replication-group-transit-encryption-enabled", "family": "aws.elasticache", "title": "Confirm the transit encryption enabled setting of the ElastiCache replication group", "block": "transit_encryption_enabled", "category": "encryption", "why": "The knowledge base cannot decide \"tcp-elasticache-replication-group-transit-encryption-enabled\" of the aws.elasticache contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|tcp-elasticache-replication-group-transit-encryption-enabled" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "clients-connect-with-tls", "title": "Switch every client to TLS against the Key Value Store", "effect": "The clients connect to the instance with TLS (the migration tutorial uses the --tls option, and a public SwissSign certificate that modern systems trust, or the SwissSign root and intermediate certificates passed to the client). Whether the instance also accepts a connection without TLS is not stated in the pages read, so the customer checks it on the instance and does not rely on the platform to refuse a plain connection. A review records the choice and closes no critical setting by itself.", "evidence": [ { "url": "https://docs.stackit.cloud/products/databases/key-value-store/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "Protect your deployments with TLS encryption, network-level access control lists (ACLs), and restricted access keys." }, { "url": "https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "If your instance uses public certificates issued by SwissSign: Public projects: Modern operating systems natively trust SwissSign. You can usually connect by using the --tls flag. If your system does not trust it, download the SwissSign Root and Intermediate CAs from the SwissSign Repository and pass them through the --cacert flag." } ] } ], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: the check, proof or closing evidence is recorded with its result." } ], "resolution": { "decision_id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "source_family": "aws.elasticache", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the at rest encryption off setting; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default that the knowledge base cannot decide: Review the at rest encryption off setting; Confirm the transit encryption enabled setting of the ElastiCache replication group.", "generated_target_behavior": "Review the at rest encryption off setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect). Confirm the transit encryption enabled setting of the ElastiCache replication group: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the at rest encryption off setting: the target behaviour of this setting is not established Confirm the transit encryption enabled setting of the ElastiCache replication group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect now.", "next_action": "Review the at rest encryption off setting: Review the at rest encryption off setting for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the at rest encryption off setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. No at-rest encryption in the source; stackit_valkey_instance states nothing about at-rest encryption (pinned provider) — REVIEW, not PRESERVED.", "Confirm the transit encryption enabled setting of the ElastiCache replication group: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_elasticache_replication_group.transit_encryption_enabled: Encryption in transit (TLS) between clients and the cache; losing it sends data and AUTH in clear. Held CRITICAL: it decides whether and with which key data or metadata is encrypted; dropping it silently could leave data unencrypted on the target." ], "closes_when": [ "Review the at rest encryption off setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the transit encryption enabled setting of the ElastiCache replication group: A person confirms that clients reach the cache over TLS on the target, so that data and the authentication token are not sent in clear." ], "required_inputs": [ "the clients of the cache and whether each can connect with TLS (and verify the certificate)", "an observation on a STACKIT instance (or STACKIT's statement) of whether a connection without TLS is accepted, since the pages read do not state it" ], "resolution_paths": [ { "id": "tcp-elasticache-replication-group-transit-encryption-enabled/verify-on-target", "title": "Confirm the transit encryption enabled setting of the ElastiCache replication group: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.elasticache/at-rest-encryption: \"A person confirms the encryption at rest of the Key Value Store plan on the target; the instance has no encryption setting that could carry the value (pinned provider), and no STACKIT fact about it is documented here.\"" ], "regeneration_required": true }, { "id": "tcp-elasticache-replication-group-transit-encryption-enabled/clients-connect-with-tls", "title": "Confirm the transit encryption enabled setting of the ElastiCache replication group: Switch every client to TLS against the Key Value Store", "prerequisites": [], "effects": [ "The clients connect to the instance with TLS (the migration tutorial uses the --tls option, and a public SwissSign certificate that modern systems trust, or the SwissSign root and intermediate certificates passed to the client). Whether the instance also accepts a connection without TLS is not stated in the pages read, so the customer checks it on the instance and does not rely on the platform to refuse a plain connection. A review records the choice and closes no critical setting by itself." ], "risk": [], "evidence": [ "https://docs.stackit.cloud/products/databases/key-value-store/", "https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/" ], "regeneration_required": false } ], "required_verification": [ "Confirm the transit encryption enabled setting of the ElastiCache replication group: the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Confirm the transit encryption enabled setting of the ElastiCache replication group: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.elasticache/at-rest-encryption: \"A person confirms the encryption at rest of the Key Value Store plan on the target; the instance has no encryption setting that could carry the value (pinned provider), and no STACKIT fact about it is documented here.\"", "contract note aws.elasticache/parameter-group-default: \"A person confirms that the defaults of the source parameter group family are what the application needs on the target and, for a cluster-mode group, treats it as the cluster-mode question.\"", "contract note aws.elasticache/tc-elasticache-replication-group-replication-group-id: \"A person confirms the instance name the target uses against what refers to the replication group id, or accepts the new name.\"", "contract note aws.elasticache/tcp-elasticache-replication-group-at-rest-encryption-enabled: \"A person confirms that the cache data and snapshots are encrypted at rest on the target, as the source setting requires.\"", "contract note aws.elasticache/tcp-elasticache-replication-group-num-cache-clusters: \"A person confirms that the target keeps at least one replica as a failover target when the source had primary and replicas.\"", "contract note aws.elasticache/tcp-elasticache-replication-group-transit-encryption-enabled: \"A person confirms that clients reach the cache over TLS on the target, so that data and the authentication token are not sent in clear.\"", "https://docs.stackit.cloud/products/databases/key-value-store/", "https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/" ], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885", "kind": "unit-review", "family": "aws.iam_role", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.iam_role", "block": "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role", "artifact": "assessment.json", "pointer": "/units/4" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|iam-managed-ecs", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/137" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|iam-trust-service-workload", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/138" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|permissions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/139" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|trust", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/140" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role", "artifact": "workspace.json", "pointer": "/units/41/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:854ada05e50ac04e13e60fc48160978911c675e9023d17869e5df35f06130e06", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.iam_role/iam-managed-ecs", "sha256": "sha256:565bedda331b222e4bf38c6755993bb0ec57c18b29c0b5b3293cce72b57bacbb" }, { "kind": "contract_semantic", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:b7e47ec9d5e3013948401988e917d162ca27d4ff802024b7151661b015d73a79" }, { "kind": "contract_semantic", "id": "aws.iam_role/permissions", "sha256": "sha256:b31c03a103b02b6971a499a5f78da7423c7374c3daf49f7a2c4e8ebb6d7b47b7" }, { "kind": "contract_semantic", "id": "aws.iam_role/trust", "sha256": "sha256:56af09798205064a43e77598b08e7be8d0ae6b533d1982573e0e6287ab0ce160" }, { "kind": "decision_kind", "id": "aws.iam_role/permissions", "sha256": "sha256:dc77789941d2c88475740a8dbc1f94071b316f05a5a899d86261634492a0701d" }, { "kind": "review_cause", "id": "aws.iam_role/iam-managed-ecs", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.iam_role/permissions", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.iam_role/trust", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 2 }, { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings.", "required_evidence": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "items": [ { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-MANAGED-ECS", "kind": "iam-managed-ecs", "family": "aws.iam_role", "title": "Review the IAM managed ECS setting", "block": "iam-managed-ecs", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-managed-ecs\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|iam-managed-ecs" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the IAM managed ECS setting for module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-TRUST-SERVICE-WORKLOAD", "kind": "iam-trust-service-workload", "family": "aws.iam_role", "title": "Review the IAM trust service workload setting", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-trust-service-workload\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|iam-trust-service-workload" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-PERMISSIONS", "kind": "permissions", "family": "aws.iam_role", "title": "Translate the IAM permissions into STACKIT roles", "block": "inline_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"permissions\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|permissions" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "bind-minimum-stackit-roles", "title": "Bind the minimum STACKIT roles the workload needs to the account", "effect": "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`resource_id` (String) Project Resource to assign the role to. `role` (String) Role to be assigned. Available roles can be queried using stackit-cli: `stackit curl https://authorization.api.stackit.cloud/v2/{resourceType}/{resourceId}/roles` `subject` (String) Identifier of user, service account or client." }, { "url": "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Be sure to give the service account the correct permissions or roles for the intended tasks. ... Then we can use the client as usual as the service account permissions allow." } ] } ], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it." }, { "id": "DEC-IAM-AWS-IAM-ROLE-TRUST", "kind": "trust", "family": "aws.iam_role", "title": "Decide who may assume each IAM role", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"trust\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|trust" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885", "source_family": "aws.iam_role", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the IAM managed ECS setting; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role that the knowledge base cannot decide: Review the IAM managed ECS setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.", "generated_target_behavior": "Review the IAM managed ECS setting: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the IAM managed ECS setting: the target behaviour of this setting is not established Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings now.", "next_action": "Review the IAM managed ECS setting: Review the IAM managed ECS setting for module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the IAM managed ECS setting: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.", "Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).", "Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.", "Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role AWS managed policy AmazonECSTaskExecutionRolePolicy (module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_execution_role_policy): a person translates each into STACKIT role assignments; the list decides nothing.", "Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried." ], "closes_when": [ "Review the IAM managed ECS setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.", "Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it." ], "required_inputs": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "resolution_paths": [ { "id": "iam-trust-service-workload/bring-the-closing-evidence", "title": "Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "permissions/carry-out-by-hand", "title": "Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true }, { "id": "permissions/bind-minimum-stackit-roles", "title": "Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account", "prerequisites": [], "effects": [ "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "regeneration_required": false }, { "id": "trust/carry-out-by-hand", "title": "Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result", "Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.", "Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.", "Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"", "contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"", "contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"", "contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"", "contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"", "contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"", "contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"", "contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"", "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"", "contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"", "contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"", "contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"", "contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"", "contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA", "kind": "unit-review", "family": "aws.iam_role", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.iam_role", "block": "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role", "artifact": "assessment.json", "pointer": "/units/12" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|iam-managed-customer-policy", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/141" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|iam-trust-service-workload", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/142" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|permissions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/143" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|trust", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/144" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role", "artifact": "workspace.json", "pointer": "/units/42/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:51ceb0018ab2bfda815b7e25eead649fca3447af44bcb92f28bf7b0af815f4a4", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.iam_role/iam-managed-customer-policy", "sha256": "sha256:c6f67b800f9a6ab609363f1c6c5804d0191e40cdc79d0401ed89dec596567678" }, { "kind": "contract_semantic", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:b7e47ec9d5e3013948401988e917d162ca27d4ff802024b7151661b015d73a79" }, { "kind": "contract_semantic", "id": "aws.iam_role/permissions", "sha256": "sha256:b31c03a103b02b6971a499a5f78da7423c7374c3daf49f7a2c4e8ebb6d7b47b7" }, { "kind": "contract_semantic", "id": "aws.iam_role/trust", "sha256": "sha256:56af09798205064a43e77598b08e7be8d0ae6b533d1982573e0e6287ab0ce160" }, { "kind": "decision_kind", "id": "aws.iam_role/permissions", "sha256": "sha256:dc77789941d2c88475740a8dbc1f94071b316f05a5a899d86261634492a0701d" }, { "kind": "review_cause", "id": "aws.iam_role/iam-managed-customer-policy", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.iam_role/permissions", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.iam_role/trust", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 2 }, { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings.", "required_evidence": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "items": [ { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-MANAGED-CUSTOMER-POLICY", "kind": "iam-managed-customer-policy", "family": "aws.iam_role", "title": "Review the IAM managed customer policy setting", "block": "iam-managed-customer-policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-managed-customer-policy\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|iam-managed-customer-policy" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-TRUST-SERVICE-WORKLOAD", "kind": "iam-trust-service-workload", "family": "aws.iam_role", "title": "Review the IAM trust service workload setting", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-trust-service-workload\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|iam-trust-service-workload" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-PERMISSIONS", "kind": "permissions", "family": "aws.iam_role", "title": "Translate the IAM permissions into STACKIT roles", "block": "inline_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"permissions\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|permissions" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "bind-minimum-stackit-roles", "title": "Bind the minimum STACKIT roles the workload needs to the account", "effect": "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`resource_id` (String) Project Resource to assign the role to. `role` (String) Role to be assigned. Available roles can be queried using stackit-cli: `stackit curl https://authorization.api.stackit.cloud/v2/{resourceType}/{resourceId}/roles` `subject` (String) Identifier of user, service account or client." }, { "url": "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Be sure to give the service account the correct permissions or roles for the intended tasks. ... Then we can use the client as usual as the service account permissions allow." } ] } ], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role outside the draft; the plan states no title for it." }, { "id": "DEC-IAM-AWS-IAM-ROLE-TRUST", "kind": "trust", "family": "aws.iam_role", "title": "Decide who may assume each IAM role", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"trust\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|trust" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA", "source_family": "aws.iam_role", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "identity-access-secrets", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Translate the IAM permissions into STACKIT roles; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.retail_app_ecs.module.carts_service.aws_iam_role.task_role that the knowledge base cannot decide: Review the IAM managed customer policy setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.", "generated_target_behavior": "Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the IAM managed customer policy setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings now.", "next_action": "Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role outside the draft; the plan states no title for it.", "why_open": [ "Review the IAM managed customer policy setting: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.", "Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).", "Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) through this setting (the target does not carry it: it is REDESIGN), so what the reference becomes is part of this setting.", "Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.carts_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.ecs_exec), a policy the scan cannot read (module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_role_additional): a person translates each into STACKIT role assignments; the list decides nothing.", "Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried." ], "closes_when": [ "Review the IAM managed customer policy setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM managed customer policy setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.", "Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it." ], "required_inputs": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "resolution_paths": [ { "id": "iam-managed-customer-policy/bring-the-closing-evidence", "title": "Review the IAM managed customer policy setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "iam-trust-service-workload/bring-the-closing-evidence", "title": "Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "permissions/carry-out-by-hand", "title": "Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true }, { "id": "permissions/bind-minimum-stackit-roles", "title": "Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account", "prerequisites": [], "effects": [ "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "regeneration_required": false }, { "id": "trust/carry-out-by-hand", "title": "Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the IAM managed customer policy setting: the check, proof or closing evidence is recorded with its result", "Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result", "Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the IAM managed customer policy setting: Manual work remains: a person closes the semantic, the draft does not.", "Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.", "Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.", "Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"", "contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"", "contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"", "contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"", "contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"", "contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"", "contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"", "contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"", "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"", "contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"", "contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"", "contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"", "contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"", "contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913", "kind": "unit-review", "family": "aws.iam_role", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.iam_role", "block": "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role", "artifact": "assessment.json", "pointer": "/units/38" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|iam-managed-ecs", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/167" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|iam-trust-service-workload", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/168" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|permissions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/169" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|trust", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/170" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role", "artifact": "workspace.json", "pointer": "/units/45/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:473be156256464a573dc12f091fa5a8c4239899c98d3c87587560d5613b7f301", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.iam_role/iam-managed-ecs", "sha256": "sha256:565bedda331b222e4bf38c6755993bb0ec57c18b29c0b5b3293cce72b57bacbb" }, { "kind": "contract_semantic", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:b7e47ec9d5e3013948401988e917d162ca27d4ff802024b7151661b015d73a79" }, { "kind": "contract_semantic", "id": "aws.iam_role/permissions", "sha256": "sha256:b31c03a103b02b6971a499a5f78da7423c7374c3daf49f7a2c4e8ebb6d7b47b7" }, { "kind": "contract_semantic", "id": "aws.iam_role/trust", "sha256": "sha256:56af09798205064a43e77598b08e7be8d0ae6b533d1982573e0e6287ab0ce160" }, { "kind": "decision_kind", "id": "aws.iam_role/permissions", "sha256": "sha256:dc77789941d2c88475740a8dbc1f94071b316f05a5a899d86261634492a0701d" }, { "kind": "review_cause", "id": "aws.iam_role/iam-managed-ecs", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.iam_role/permissions", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.iam_role/trust", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 2 }, { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings.", "required_evidence": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "items": [ { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-MANAGED-ECS", "kind": "iam-managed-ecs", "family": "aws.iam_role", "title": "Review the IAM managed ECS setting", "block": "iam-managed-ecs", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-managed-ecs\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|iam-managed-ecs" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the IAM managed ECS setting for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-TRUST-SERVICE-WORKLOAD", "kind": "iam-trust-service-workload", "family": "aws.iam_role", "title": "Review the IAM trust service workload setting", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-trust-service-workload\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|iam-trust-service-workload" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-PERMISSIONS", "kind": "permissions", "family": "aws.iam_role", "title": "Translate the IAM permissions into STACKIT roles", "block": "inline_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"permissions\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|permissions" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "bind-minimum-stackit-roles", "title": "Bind the minimum STACKIT roles the workload needs to the account", "effect": "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`resource_id` (String) Project Resource to assign the role to. `role` (String) Role to be assigned. Available roles can be queried using stackit-cli: `stackit curl https://authorization.api.stackit.cloud/v2/{resourceType}/{resourceId}/roles` `subject` (String) Identifier of user, service account or client." }, { "url": "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Be sure to give the service account the correct permissions or roles for the intended tasks. ... Then we can use the client as usual as the service account permissions allow." } ] } ], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it." }, { "id": "DEC-IAM-AWS-IAM-ROLE-TRUST", "kind": "trust", "family": "aws.iam_role", "title": "Decide who may assume each IAM role", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"trust\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|trust" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913", "source_family": "aws.iam_role", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the IAM managed ECS setting; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role that the knowledge base cannot decide: Review the IAM managed ECS setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.", "generated_target_behavior": "Review the IAM managed ECS setting: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the IAM managed ECS setting: the target behaviour of this setting is not established Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings now.", "next_action": "Review the IAM managed ECS setting: Review the IAM managed ECS setting for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the IAM managed ECS setting: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.", "Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).", "Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret), module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret). What each reference becomes is part of this setting.", "Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role AWS managed policy AmazonECSTaskExecutionRolePolicy (module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_policy), a policy the scan cannot read (module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_additional): a person translates each into STACKIT role assignments; the list decides nothing.", "Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried." ], "closes_when": [ "Review the IAM managed ECS setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.", "Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it." ], "required_inputs": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "resolution_paths": [ { "id": "iam-trust-service-workload/bring-the-closing-evidence", "title": "Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "permissions/carry-out-by-hand", "title": "Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true }, { "id": "permissions/bind-minimum-stackit-roles", "title": "Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account", "prerequisites": [], "effects": [ "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "regeneration_required": false }, { "id": "trust/carry-out-by-hand", "title": "Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result", "Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.", "Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.", "Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"", "contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"", "contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"", "contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"", "contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"", "contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"", "contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"", "contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"", "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"", "contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"", "contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"", "contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"", "contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"", "contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1", "kind": "unit-review", "family": "aws.iam_role", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.iam_role", "block": "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role", "artifact": "assessment.json", "pointer": "/units/14" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|iam-managed-customer-policy", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/171" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|iam-trust-service-workload", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/172" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|permissions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/173" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|trust", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/174" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role", "artifact": "workspace.json", "pointer": "/units/46/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:4c1cdaf163c1329c050b9bb8c155cd2416b67516dfdcc85c9ebc37487c1c62ec", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.iam_role/iam-managed-customer-policy", "sha256": "sha256:c6f67b800f9a6ab609363f1c6c5804d0191e40cdc79d0401ed89dec596567678" }, { "kind": "contract_semantic", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:b7e47ec9d5e3013948401988e917d162ca27d4ff802024b7151661b015d73a79" }, { "kind": "contract_semantic", "id": "aws.iam_role/permissions", "sha256": "sha256:b31c03a103b02b6971a499a5f78da7423c7374c3daf49f7a2c4e8ebb6d7b47b7" }, { "kind": "contract_semantic", "id": "aws.iam_role/trust", "sha256": "sha256:56af09798205064a43e77598b08e7be8d0ae6b533d1982573e0e6287ab0ce160" }, { "kind": "decision_kind", "id": "aws.iam_role/permissions", "sha256": "sha256:dc77789941d2c88475740a8dbc1f94071b316f05a5a899d86261634492a0701d" }, { "kind": "review_cause", "id": "aws.iam_role/iam-managed-customer-policy", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.iam_role/permissions", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.iam_role/trust", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 2 }, { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings.", "required_evidence": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "items": [ { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-MANAGED-CUSTOMER-POLICY", "kind": "iam-managed-customer-policy", "family": "aws.iam_role", "title": "Review the IAM managed customer policy setting", "block": "iam-managed-customer-policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-managed-customer-policy\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|iam-managed-customer-policy" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-TRUST-SERVICE-WORKLOAD", "kind": "iam-trust-service-workload", "family": "aws.iam_role", "title": "Review the IAM trust service workload setting", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-trust-service-workload\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|iam-trust-service-workload" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-PERMISSIONS", "kind": "permissions", "family": "aws.iam_role", "title": "Translate the IAM permissions into STACKIT roles", "block": "inline_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"permissions\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|permissions" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "bind-minimum-stackit-roles", "title": "Bind the minimum STACKIT roles the workload needs to the account", "effect": "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`resource_id` (String) Project Resource to assign the role to. `role` (String) Role to be assigned. Available roles can be queried using stackit-cli: `stackit curl https://authorization.api.stackit.cloud/v2/{resourceType}/{resourceId}/roles` `subject` (String) Identifier of user, service account or client." }, { "url": "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Be sure to give the service account the correct permissions or roles for the intended tasks. ... Then we can use the client as usual as the service account permissions allow." } ] } ], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role outside the draft; the plan states no title for it." }, { "id": "DEC-IAM-AWS-IAM-ROLE-TRUST", "kind": "trust", "family": "aws.iam_role", "title": "Decide who may assume each IAM role", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"trust\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|trust" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1", "source_family": "aws.iam_role", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "identity-access-secrets", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Translate the IAM permissions into STACKIT roles; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role that the knowledge base cannot decide: Review the IAM managed customer policy setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.", "generated_target_behavior": "Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the IAM managed customer policy setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings now.", "next_action": "Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role outside the draft; the plan states no title for it.", "why_open": [ "Review the IAM managed customer policy setting: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.", "Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).", "Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.", "Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.ecs_exec): a person translates each into STACKIT role assignments; the list decides nothing.", "Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried." ], "closes_when": [ "Review the IAM managed customer policy setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM managed customer policy setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.", "Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it." ], "required_inputs": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "resolution_paths": [ { "id": "iam-managed-customer-policy/bring-the-closing-evidence", "title": "Review the IAM managed customer policy setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "iam-trust-service-workload/bring-the-closing-evidence", "title": "Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "permissions/carry-out-by-hand", "title": "Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true }, { "id": "permissions/bind-minimum-stackit-roles", "title": "Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account", "prerequisites": [], "effects": [ "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "regeneration_required": false }, { "id": "trust/carry-out-by-hand", "title": "Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the IAM managed customer policy setting: the check, proof or closing evidence is recorded with its result", "Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result", "Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the IAM managed customer policy setting: Manual work remains: a person closes the semantic, the draft does not.", "Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.", "Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.", "Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"", "contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"", "contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"", "contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"", "contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"", "contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"", "contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"", "contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"", "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"", "contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"", "contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"", "contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"", "contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"", "contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673", "kind": "unit-review", "family": "aws.iam_role", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.iam_role", "block": "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role", "artifact": "assessment.json", "pointer": "/units/5" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|iam-managed-ecs", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/197" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|iam-trust-service-workload", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/198" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|permissions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/199" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|trust", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/200" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role", "artifact": "workspace.json", "pointer": "/units/49/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:b7d645453be730367ca644e3bab971d447c08ed019d765ed139181f4eae4d09c", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.iam_role/iam-managed-ecs", "sha256": "sha256:565bedda331b222e4bf38c6755993bb0ec57c18b29c0b5b3293cce72b57bacbb" }, { "kind": "contract_semantic", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:b7e47ec9d5e3013948401988e917d162ca27d4ff802024b7151661b015d73a79" }, { "kind": "contract_semantic", "id": "aws.iam_role/permissions", "sha256": "sha256:b31c03a103b02b6971a499a5f78da7423c7374c3daf49f7a2c4e8ebb6d7b47b7" }, { "kind": "contract_semantic", "id": "aws.iam_role/trust", "sha256": "sha256:56af09798205064a43e77598b08e7be8d0ae6b533d1982573e0e6287ab0ce160" }, { "kind": "decision_kind", "id": "aws.iam_role/permissions", "sha256": "sha256:dc77789941d2c88475740a8dbc1f94071b316f05a5a899d86261634492a0701d" }, { "kind": "review_cause", "id": "aws.iam_role/iam-managed-ecs", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.iam_role/permissions", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.iam_role/trust", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 2 }, { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings.", "required_evidence": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "items": [ { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-MANAGED-ECS", "kind": "iam-managed-ecs", "family": "aws.iam_role", "title": "Review the IAM managed ECS setting", "block": "iam-managed-ecs", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-managed-ecs\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|iam-managed-ecs" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the IAM managed ECS setting for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-TRUST-SERVICE-WORKLOAD", "kind": "iam-trust-service-workload", "family": "aws.iam_role", "title": "Review the IAM trust service workload setting", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-trust-service-workload\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|iam-trust-service-workload" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-PERMISSIONS", "kind": "permissions", "family": "aws.iam_role", "title": "Translate the IAM permissions into STACKIT roles", "block": "inline_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"permissions\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|permissions" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "bind-minimum-stackit-roles", "title": "Bind the minimum STACKIT roles the workload needs to the account", "effect": "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`resource_id` (String) Project Resource to assign the role to. `role` (String) Role to be assigned. Available roles can be queried using stackit-cli: `stackit curl https://authorization.api.stackit.cloud/v2/{resourceType}/{resourceId}/roles` `subject` (String) Identifier of user, service account or client." }, { "url": "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Be sure to give the service account the correct permissions or roles for the intended tasks. ... Then we can use the client as usual as the service account permissions allow." } ] } ], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it." }, { "id": "DEC-IAM-AWS-IAM-ROLE-TRUST", "kind": "trust", "family": "aws.iam_role", "title": "Decide who may assume each IAM role", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"trust\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|trust" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673", "source_family": "aws.iam_role", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the IAM managed ECS setting; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role that the knowledge base cannot decide: Review the IAM managed ECS setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.", "generated_target_behavior": "Review the IAM managed ECS setting: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the IAM managed ECS setting: the target behaviour of this setting is not established Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings now.", "next_action": "Review the IAM managed ECS setting: Review the IAM managed ECS setting for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the IAM managed ECS setting: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.", "Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).", "Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.", "Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role AWS managed policy AmazonECSTaskExecutionRolePolicy (module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_execution_role_policy): a person translates each into STACKIT role assignments; the list decides nothing.", "Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried." ], "closes_when": [ "Review the IAM managed ECS setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.", "Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it." ], "required_inputs": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "resolution_paths": [ { "id": "iam-trust-service-workload/bring-the-closing-evidence", "title": "Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "permissions/carry-out-by-hand", "title": "Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true }, { "id": "permissions/bind-minimum-stackit-roles", "title": "Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account", "prerequisites": [], "effects": [ "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "regeneration_required": false }, { "id": "trust/carry-out-by-hand", "title": "Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result", "Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.", "Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.", "Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"", "contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"", "contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"", "contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"", "contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"", "contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"", "contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"", "contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"", "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"", "contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"", "contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"", "contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"", "contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"", "contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6", "kind": "unit-review", "family": "aws.iam_role", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.iam_role", "block": "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role", "artifact": "assessment.json", "pointer": "/units/16" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|iam-managed-customer-policy", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/201" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|iam-trust-service-workload", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/202" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|permissions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/203" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|trust", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/204" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role", "artifact": "workspace.json", "pointer": "/units/50/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:4cc70f00b75b15f677d467aad39fca316ea2386384bb118334f60d1b56671a18", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.iam_role/iam-managed-customer-policy", "sha256": "sha256:c6f67b800f9a6ab609363f1c6c5804d0191e40cdc79d0401ed89dec596567678" }, { "kind": "contract_semantic", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:b7e47ec9d5e3013948401988e917d162ca27d4ff802024b7151661b015d73a79" }, { "kind": "contract_semantic", "id": "aws.iam_role/permissions", "sha256": "sha256:b31c03a103b02b6971a499a5f78da7423c7374c3daf49f7a2c4e8ebb6d7b47b7" }, { "kind": "contract_semantic", "id": "aws.iam_role/trust", "sha256": "sha256:56af09798205064a43e77598b08e7be8d0ae6b533d1982573e0e6287ab0ce160" }, { "kind": "decision_kind", "id": "aws.iam_role/permissions", "sha256": "sha256:dc77789941d2c88475740a8dbc1f94071b316f05a5a899d86261634492a0701d" }, { "kind": "review_cause", "id": "aws.iam_role/iam-managed-customer-policy", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.iam_role/permissions", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.iam_role/trust", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 2 }, { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings.", "required_evidence": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "items": [ { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-MANAGED-CUSTOMER-POLICY", "kind": "iam-managed-customer-policy", "family": "aws.iam_role", "title": "Review the IAM managed customer policy setting", "block": "iam-managed-customer-policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-managed-customer-policy\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|iam-managed-customer-policy" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-TRUST-SERVICE-WORKLOAD", "kind": "iam-trust-service-workload", "family": "aws.iam_role", "title": "Review the IAM trust service workload setting", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-trust-service-workload\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|iam-trust-service-workload" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-PERMISSIONS", "kind": "permissions", "family": "aws.iam_role", "title": "Translate the IAM permissions into STACKIT roles", "block": "inline_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"permissions\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|permissions" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "bind-minimum-stackit-roles", "title": "Bind the minimum STACKIT roles the workload needs to the account", "effect": "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`resource_id` (String) Project Resource to assign the role to. `role` (String) Role to be assigned. Available roles can be queried using stackit-cli: `stackit curl https://authorization.api.stackit.cloud/v2/{resourceType}/{resourceId}/roles` `subject` (String) Identifier of user, service account or client." }, { "url": "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Be sure to give the service account the correct permissions or roles for the intended tasks. ... Then we can use the client as usual as the service account permissions allow." } ] } ], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role outside the draft; the plan states no title for it." }, { "id": "DEC-IAM-AWS-IAM-ROLE-TRUST", "kind": "trust", "family": "aws.iam_role", "title": "Decide who may assume each IAM role", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"trust\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|trust" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6", "source_family": "aws.iam_role", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "identity-access-secrets", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Translate the IAM permissions into STACKIT roles; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role that the knowledge base cannot decide: Review the IAM managed customer policy setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.", "generated_target_behavior": "Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the IAM managed customer policy setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings now.", "next_action": "Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role outside the draft; the plan states no title for it.", "why_open": [ "Review the IAM managed customer policy setting: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.", "Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).", "Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) through this setting (the target does not carry it: it is REDESIGN), so what the reference becomes is part of this setting.", "Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.ecs_exec), a policy the scan cannot read (module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_role_additional): a person translates each into STACKIT role assignments; the list decides nothing.", "Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried." ], "closes_when": [ "Review the IAM managed customer policy setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM managed customer policy setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.", "Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it." ], "required_inputs": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "resolution_paths": [ { "id": "iam-managed-customer-policy/bring-the-closing-evidence", "title": "Review the IAM managed customer policy setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "iam-trust-service-workload/bring-the-closing-evidence", "title": "Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "permissions/carry-out-by-hand", "title": "Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true }, { "id": "permissions/bind-minimum-stackit-roles", "title": "Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account", "prerequisites": [], "effects": [ "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "regeneration_required": false }, { "id": "trust/carry-out-by-hand", "title": "Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the IAM managed customer policy setting: the check, proof or closing evidence is recorded with its result", "Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result", "Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the IAM managed customer policy setting: Manual work remains: a person closes the semantic, the draft does not.", "Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.", "Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.", "Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"", "contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"", "contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"", "contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"", "contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"", "contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"", "contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"", "contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"", "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"", "contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"", "contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"", "contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"", "contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"", "contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202", "kind": "unit-review", "family": "aws.iam_role", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.iam_role", "block": "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role", "artifact": "assessment.json", "pointer": "/units/39" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|iam-managed-ecs", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/227" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|iam-trust-service-workload", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/228" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|permissions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/229" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|trust", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/230" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role", "artifact": "workspace.json", "pointer": "/units/53/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:5cb92f5482d71bb1a60742351a8f0e11a6f28348d2ec19149d8368eb6def2cf7", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.iam_role/iam-managed-ecs", "sha256": "sha256:565bedda331b222e4bf38c6755993bb0ec57c18b29c0b5b3293cce72b57bacbb" }, { "kind": "contract_semantic", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:b7e47ec9d5e3013948401988e917d162ca27d4ff802024b7151661b015d73a79" }, { "kind": "contract_semantic", "id": "aws.iam_role/permissions", "sha256": "sha256:b31c03a103b02b6971a499a5f78da7423c7374c3daf49f7a2c4e8ebb6d7b47b7" }, { "kind": "contract_semantic", "id": "aws.iam_role/trust", "sha256": "sha256:56af09798205064a43e77598b08e7be8d0ae6b533d1982573e0e6287ab0ce160" }, { "kind": "decision_kind", "id": "aws.iam_role/permissions", "sha256": "sha256:dc77789941d2c88475740a8dbc1f94071b316f05a5a899d86261634492a0701d" }, { "kind": "review_cause", "id": "aws.iam_role/iam-managed-ecs", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.iam_role/permissions", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.iam_role/trust", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 2 }, { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings.", "required_evidence": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "items": [ { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-MANAGED-ECS", "kind": "iam-managed-ecs", "family": "aws.iam_role", "title": "Review the IAM managed ECS setting", "block": "iam-managed-ecs", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-managed-ecs\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|iam-managed-ecs" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the IAM managed ECS setting for module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-TRUST-SERVICE-WORKLOAD", "kind": "iam-trust-service-workload", "family": "aws.iam_role", "title": "Review the IAM trust service workload setting", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-trust-service-workload\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|iam-trust-service-workload" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-PERMISSIONS", "kind": "permissions", "family": "aws.iam_role", "title": "Translate the IAM permissions into STACKIT roles", "block": "inline_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"permissions\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|permissions" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "bind-minimum-stackit-roles", "title": "Bind the minimum STACKIT roles the workload needs to the account", "effect": "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`resource_id` (String) Project Resource to assign the role to. `role` (String) Role to be assigned. Available roles can be queried using stackit-cli: `stackit curl https://authorization.api.stackit.cloud/v2/{resourceType}/{resourceId}/roles` `subject` (String) Identifier of user, service account or client." }, { "url": "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Be sure to give the service account the correct permissions or roles for the intended tasks. ... Then we can use the client as usual as the service account permissions allow." } ] } ], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it." }, { "id": "DEC-IAM-AWS-IAM-ROLE-TRUST", "kind": "trust", "family": "aws.iam_role", "title": "Decide who may assume each IAM role", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"trust\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|trust" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202", "source_family": "aws.iam_role", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the IAM managed ECS setting; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role that the knowledge base cannot decide: Review the IAM managed ECS setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.", "generated_target_behavior": "Review the IAM managed ECS setting: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the IAM managed ECS setting: the target behaviour of this setting is not established Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings now.", "next_action": "Review the IAM managed ECS setting: Review the IAM managed ECS setting for module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the IAM managed ECS setting: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.", "Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).", "Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret), module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret). What each reference becomes is part of this setting.", "Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role AWS managed policy AmazonECSTaskExecutionRolePolicy (module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_policy), a policy the scan cannot read (module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_additional): a person translates each into STACKIT role assignments; the list decides nothing.", "Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried." ], "closes_when": [ "Review the IAM managed ECS setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.", "Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it." ], "required_inputs": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "resolution_paths": [ { "id": "iam-trust-service-workload/bring-the-closing-evidence", "title": "Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "permissions/carry-out-by-hand", "title": "Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true }, { "id": "permissions/bind-minimum-stackit-roles", "title": "Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account", "prerequisites": [], "effects": [ "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "regeneration_required": false }, { "id": "trust/carry-out-by-hand", "title": "Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result", "Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.", "Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.", "Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"", "contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"", "contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"", "contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"", "contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"", "contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"", "contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"", "contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"", "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"", "contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"", "contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"", "contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"", "contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"", "contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65", "kind": "unit-review", "family": "aws.iam_role", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.iam_role", "block": "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role", "artifact": "assessment.json", "pointer": "/units/18" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|iam-managed-customer-policy", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/231" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|iam-trust-service-workload", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/232" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|permissions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/233" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|trust", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/234" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role", "artifact": "workspace.json", "pointer": "/units/54/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:2f0bb0ed7fec154e45a2cb12fe4064f9f20b82d2c47f71a7c542e4a2c02b85d2", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.iam_role/iam-managed-customer-policy", "sha256": "sha256:c6f67b800f9a6ab609363f1c6c5804d0191e40cdc79d0401ed89dec596567678" }, { "kind": "contract_semantic", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:b7e47ec9d5e3013948401988e917d162ca27d4ff802024b7151661b015d73a79" }, { "kind": "contract_semantic", "id": "aws.iam_role/permissions", "sha256": "sha256:b31c03a103b02b6971a499a5f78da7423c7374c3daf49f7a2c4e8ebb6d7b47b7" }, { "kind": "contract_semantic", "id": "aws.iam_role/trust", "sha256": "sha256:56af09798205064a43e77598b08e7be8d0ae6b533d1982573e0e6287ab0ce160" }, { "kind": "decision_kind", "id": "aws.iam_role/permissions", "sha256": "sha256:dc77789941d2c88475740a8dbc1f94071b316f05a5a899d86261634492a0701d" }, { "kind": "review_cause", "id": "aws.iam_role/iam-managed-customer-policy", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.iam_role/permissions", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.iam_role/trust", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 2 }, { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings.", "required_evidence": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "items": [ { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-MANAGED-CUSTOMER-POLICY", "kind": "iam-managed-customer-policy", "family": "aws.iam_role", "title": "Review the IAM managed customer policy setting", "block": "iam-managed-customer-policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-managed-customer-policy\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|iam-managed-customer-policy" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-TRUST-SERVICE-WORKLOAD", "kind": "iam-trust-service-workload", "family": "aws.iam_role", "title": "Review the IAM trust service workload setting", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-trust-service-workload\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|iam-trust-service-workload" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-PERMISSIONS", "kind": "permissions", "family": "aws.iam_role", "title": "Translate the IAM permissions into STACKIT roles", "block": "inline_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"permissions\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|permissions" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "bind-minimum-stackit-roles", "title": "Bind the minimum STACKIT roles the workload needs to the account", "effect": "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`resource_id` (String) Project Resource to assign the role to. `role` (String) Role to be assigned. Available roles can be queried using stackit-cli: `stackit curl https://authorization.api.stackit.cloud/v2/{resourceType}/{resourceId}/roles` `subject` (String) Identifier of user, service account or client." }, { "url": "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Be sure to give the service account the correct permissions or roles for the intended tasks. ... Then we can use the client as usual as the service account permissions allow." } ] } ], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role outside the draft; the plan states no title for it." }, { "id": "DEC-IAM-AWS-IAM-ROLE-TRUST", "kind": "trust", "family": "aws.iam_role", "title": "Decide who may assume each IAM role", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"trust\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|trust" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65", "source_family": "aws.iam_role", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "identity-access-secrets", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Translate the IAM permissions into STACKIT roles; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.retail_app_ecs.module.orders_service.aws_iam_role.task_role that the knowledge base cannot decide: Review the IAM managed customer policy setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.", "generated_target_behavior": "Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the IAM managed customer policy setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings now.", "next_action": "Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role outside the draft; the plan states no title for it.", "why_open": [ "Review the IAM managed customer policy setting: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.", "Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).", "Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.", "Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.orders_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.ecs_exec): a person translates each into STACKIT role assignments; the list decides nothing.", "Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried." ], "closes_when": [ "Review the IAM managed customer policy setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM managed customer policy setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.", "Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it." ], "required_inputs": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "resolution_paths": [ { "id": "iam-managed-customer-policy/bring-the-closing-evidence", "title": "Review the IAM managed customer policy setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "iam-trust-service-workload/bring-the-closing-evidence", "title": "Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "permissions/carry-out-by-hand", "title": "Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true }, { "id": "permissions/bind-minimum-stackit-roles", "title": "Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account", "prerequisites": [], "effects": [ "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "regeneration_required": false }, { "id": "trust/carry-out-by-hand", "title": "Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the IAM managed customer policy setting: the check, proof or closing evidence is recorded with its result", "Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result", "Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the IAM managed customer policy setting: Manual work remains: a person closes the semantic, the draft does not.", "Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.", "Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.", "Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"", "contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"", "contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"", "contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"", "contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"", "contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"", "contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"", "contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"", "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"", "contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"", "contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"", "contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"", "contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"", "contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0", "kind": "unit-review", "family": "aws.iam_role", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.iam_role", "block": "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role", "artifact": "assessment.json", "pointer": "/units/6" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|iam-managed-ecs", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/258" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|iam-trust-service-workload", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/259" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|permissions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/260" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|trust", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/261" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role", "artifact": "workspace.json", "pointer": "/units/57/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:0d3abc1d1e4e02ab819f5eb020fea10c4d78955084f9cfbda065762de79660b4", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.iam_role/iam-managed-ecs", "sha256": "sha256:565bedda331b222e4bf38c6755993bb0ec57c18b29c0b5b3293cce72b57bacbb" }, { "kind": "contract_semantic", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:b7e47ec9d5e3013948401988e917d162ca27d4ff802024b7151661b015d73a79" }, { "kind": "contract_semantic", "id": "aws.iam_role/permissions", "sha256": "sha256:b31c03a103b02b6971a499a5f78da7423c7374c3daf49f7a2c4e8ebb6d7b47b7" }, { "kind": "contract_semantic", "id": "aws.iam_role/trust", "sha256": "sha256:56af09798205064a43e77598b08e7be8d0ae6b533d1982573e0e6287ab0ce160" }, { "kind": "decision_kind", "id": "aws.iam_role/permissions", "sha256": "sha256:dc77789941d2c88475740a8dbc1f94071b316f05a5a899d86261634492a0701d" }, { "kind": "review_cause", "id": "aws.iam_role/iam-managed-ecs", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.iam_role/permissions", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.iam_role/trust", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 2 }, { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings.", "required_evidence": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "items": [ { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-MANAGED-ECS", "kind": "iam-managed-ecs", "family": "aws.iam_role", "title": "Review the IAM managed ECS setting", "block": "iam-managed-ecs", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-managed-ecs\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|iam-managed-ecs" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the IAM managed ECS setting for module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-TRUST-SERVICE-WORKLOAD", "kind": "iam-trust-service-workload", "family": "aws.iam_role", "title": "Review the IAM trust service workload setting", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-trust-service-workload\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|iam-trust-service-workload" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-PERMISSIONS", "kind": "permissions", "family": "aws.iam_role", "title": "Translate the IAM permissions into STACKIT roles", "block": "inline_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"permissions\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|permissions" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "bind-minimum-stackit-roles", "title": "Bind the minimum STACKIT roles the workload needs to the account", "effect": "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`resource_id` (String) Project Resource to assign the role to. `role` (String) Role to be assigned. Available roles can be queried using stackit-cli: `stackit curl https://authorization.api.stackit.cloud/v2/{resourceType}/{resourceId}/roles` `subject` (String) Identifier of user, service account or client." }, { "url": "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Be sure to give the service account the correct permissions or roles for the intended tasks. ... Then we can use the client as usual as the service account permissions allow." } ] } ], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it." }, { "id": "DEC-IAM-AWS-IAM-ROLE-TRUST", "kind": "trust", "family": "aws.iam_role", "title": "Decide who may assume each IAM role", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"trust\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|trust" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0", "source_family": "aws.iam_role", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the IAM managed ECS setting; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role that the knowledge base cannot decide: Review the IAM managed ECS setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.", "generated_target_behavior": "Review the IAM managed ECS setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the IAM managed ECS setting: the target behaviour of this setting is not established Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings now.", "next_action": "Review the IAM managed ECS setting: Review the IAM managed ECS setting for module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the IAM managed ECS setting: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.", "Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).", "Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.", "Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role AWS managed policy AmazonECSTaskExecutionRolePolicy (module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.task_execution_role_policy): a person translates each into STACKIT role assignments; the list decides nothing.", "Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried." ], "closes_when": [ "Review the IAM managed ECS setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.", "Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it." ], "required_inputs": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "resolution_paths": [ { "id": "iam-trust-service-workload/bring-the-closing-evidence", "title": "Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "permissions/carry-out-by-hand", "title": "Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true }, { "id": "permissions/bind-minimum-stackit-roles", "title": "Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account", "prerequisites": [], "effects": [ "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "regeneration_required": false }, { "id": "trust/carry-out-by-hand", "title": "Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result", "Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.", "Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.", "Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"", "contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"", "contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"", "contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"", "contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"", "contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"", "contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"", "contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"", "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"", "contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"", "contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"", "contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"", "contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"", "contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE", "kind": "unit-review", "family": "aws.iam_role", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.iam_role", "block": "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role", "artifact": "assessment.json", "pointer": "/units/20" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|iam-managed-customer-policy", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/262" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|iam-trust-service-workload", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/263" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|permissions", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/264" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|trust", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/265" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role", "artifact": "workspace.json", "pointer": "/units/58/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:c2be12d3d2e2fb732e8477e43439fd19dffa3bc19f7641e8a62de8194da707fb", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.iam_role/iam-managed-customer-policy", "sha256": "sha256:c6f67b800f9a6ab609363f1c6c5804d0191e40cdc79d0401ed89dec596567678" }, { "kind": "contract_semantic", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:b7e47ec9d5e3013948401988e917d162ca27d4ff802024b7151661b015d73a79" }, { "kind": "contract_semantic", "id": "aws.iam_role/permissions", "sha256": "sha256:b31c03a103b02b6971a499a5f78da7423c7374c3daf49f7a2c4e8ebb6d7b47b7" }, { "kind": "contract_semantic", "id": "aws.iam_role/trust", "sha256": "sha256:56af09798205064a43e77598b08e7be8d0ae6b533d1982573e0e6287ab0ce160" }, { "kind": "decision_kind", "id": "aws.iam_role/permissions", "sha256": "sha256:dc77789941d2c88475740a8dbc1f94071b316f05a5a899d86261634492a0701d" }, { "kind": "review_cause", "id": "aws.iam_role/iam-managed-customer-policy", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.iam_role/iam-trust-service-workload", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.iam_role/permissions", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.iam_role/trust", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 2 }, { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings.", "required_evidence": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "items": [ { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-MANAGED-CUSTOMER-POLICY", "kind": "iam-managed-customer-policy", "family": "aws.iam_role", "title": "Review the IAM managed customer policy setting", "block": "iam-managed-customer-policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-managed-customer-policy\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|iam-managed-customer-policy" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-IAM-TRUST-SERVICE-WORKLOAD", "kind": "iam-trust-service-workload", "family": "aws.iam_role", "title": "Review the IAM trust service workload setting", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-trust-service-workload\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|iam-trust-service-workload" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-IAM-AWS-IAM-ROLE-PERMISSIONS", "kind": "permissions", "family": "aws.iam_role", "title": "Translate the IAM permissions into STACKIT roles", "block": "inline_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"permissions\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|permissions" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "bind-minimum-stackit-roles", "title": "Bind the minimum STACKIT roles the workload needs to the account", "effect": "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "`resource_id` (String) Project Resource to assign the role to. `role` (String) Role to be assigned. Available roles can be queried using stackit-cli: `stackit curl https://authorization.api.stackit.cloud/v2/{resourceType}/{resourceId}/roles` `subject` (String) Identifier of user, service account or client." }, { "url": "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-26", "quote": "Be sure to give the service account the correct permissions or roles for the intended tasks. ... Then we can use the client as usual as the service account permissions allow." } ] } ], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role outside the draft; the plan states no title for it." }, { "id": "DEC-IAM-AWS-IAM-ROLE-TRUST", "kind": "trust", "family": "aws.iam_role", "title": "Decide who may assume each IAM role", "block": "assume_role_policy", "category": "identity-access", "why": "The knowledge base cannot decide \"trust\" of the aws.iam_role contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|trust" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE", "source_family": "aws.iam_role", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "identity-access-secrets", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Translate the IAM permissions into STACKIT roles; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.retail_app_ecs.module.ui_service.aws_iam_role.task_role that the knowledge base cannot decide: Review the IAM managed customer policy setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.", "generated_target_behavior": "Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the IAM managed customer policy setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings now.", "next_action": "Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role outside the draft; the plan states no title for it.", "why_open": [ "Review the IAM managed customer policy setting: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.", "Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).", "Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.", "Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.ui_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.ecs_exec): a person translates each into STACKIT role assignments; the list decides nothing.", "Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried." ], "closes_when": [ "Review the IAM managed customer policy setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM managed customer policy setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.", "Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it." ], "required_inputs": [ "the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it", "who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)" ], "resolution_paths": [ { "id": "iam-managed-customer-policy/bring-the-closing-evidence", "title": "Review the IAM managed customer policy setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "iam-trust-service-workload/bring-the-closing-evidence", "title": "Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"" ], "regeneration_required": true }, { "id": "permissions/carry-out-by-hand", "title": "Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true }, { "id": "permissions/bind-minimum-stackit-roles", "title": "Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account", "prerequisites": [], "effects": [ "A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "regeneration_required": false }, { "id": "trust/carry-out-by-hand", "title": "Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the IAM managed customer policy setting: the check, proof or closing evidence is recorded with its result", "Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result", "Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the IAM managed customer policy setting: Manual work remains: a person closes the semantic, the draft does not.", "Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.", "Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.", "Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"", "contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"", "contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"", "contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"", "contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"", "contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"", "contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"", "contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"", "contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"", "contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"", "contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"", "contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"", "contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"", "contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40", "https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/" ], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-INTERNET-GATEWAY-THIS", "kind": "unit-review", "family": "aws.internet_gateway", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.internet_gateway", "block": "module.vpc.module.vpc.aws_internet_gateway.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.vpc.module.vpc.aws_internet_gateway.this", "artifact": "assessment.json", "pointer": "/units/67" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.vpc.module.vpc.aws_internet_gateway.this|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/0" } ], "instances": [ { "unit": "module.vpc.module.vpc.aws_internet_gateway.this", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "network-topology-boundary" } ], "conditional_members": 1, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:47c616336e5e1ad5768b91bfcb1100491e0fcda692c9b1fee7c3c8ca251f277e", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.internet_gateway/network-topology-boundary", "sha256": "sha256:724a570db1c2c339b89529c834493b3bcb86f16cc9556c3f1530924886b406e9" }, { "kind": "review_cause", "id": "aws.internet_gateway/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:06c50d347eb940460d3e20bd1422b491e8cd3f0defdee5b724acc00958dd3fa1" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "why": "The knowledge base cannot decide 1 critical setting of module.vpc.module.vpc.aws_internet_gateway.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-INTERNET-GATEWAY-NETWORK-TOPOLOGY-BOUNDARY", "kind": "network-topology-boundary", "family": "aws.internet_gateway", "title": "Confirm that the project is the boundary of one network", "block": "network-topology-boundary", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-topology-boundary\" of the aws.internet_gateway contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_internet_gateway.this|network-topology-boundary" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.vpc.module.vpc.aws_internet_gateway.this: the check, proof or closing evidence is recorded with its result." } ], "resolution": { "decision_id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-INTERNET-GATEWAY-THIS", "source_family": "aws.internet_gateway", "source_semantic": "unit-review", "affected_units": [ "module.vpc.module.vpc.aws_internet_gateway.this" ], "affected_application": [], "action_type": "VERIFY_BEHAVIOR", "work_package": "routing-architecture", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "REQUIRES_VERIFICATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance closes it by a runtime or validation result", "source_observation": "The source states 1 critical setting on module.vpc.module.vpc.aws_internet_gateway.this that the knowledge base cannot decide: Confirm that the project is the boundary of one network.", "generated_target_behavior": "Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_internet_gateway.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_internet_gateway.this/network-topology-boundary). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_internet_gateway.this/network-topology-boundary now.", "next_action": "Confirm that the project is the boundary of one network: Verify on the target for module.vpc.module.vpc.aws_internet_gateway.this: the check, proof or closing evidence is recorded with its result.", "why_open": [ "Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this gateway included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project." ], "closes_when": [ "Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded." ], "required_inputs": [], "resolution_paths": [ { "id": "network-topology-boundary/bring-the-closing-evidence", "title": "Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.internet_gateway/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "regeneration_required": true } ], "required_verification": [ "Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.internet_gateway/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.vpc.module.vpc.aws_internet_gateway.this/network-topology-boundary", "mode": "MANUAL", "phase": "FOUNDATION", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-AWS-KMS-KEY-CMK", "kind": "unit-review", "family": "aws.kms_key", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.kms_key", "block": "module.retail_app_ecs.aws_kms_key.cmk", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_kms_key.cmk", "artifact": "assessment.json", "pointer": "/units/3" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.aws_kms_key.cmk|deletion-window", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/92" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_kms_key.cmk", "artifact": "workspace.json", "pointer": "/units/29/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:f89900f92525e7c55732bc4918958a09715b21610264e9c769a83f22f3d3d990", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.kms_key/deletion-window", "sha256": "sha256:1f6b2406f2d021e48be7aa155d17fb1442096df22c5afab8c726e4a6292b0ba5" }, { "kind": "review_cause", "id": "aws.kms_key/deletion-window", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" } ], "kb_dependencies_sha256": "sha256:5cc7d34282526a9ba869dfbc29b4eeab68615cecc701d8ccbc66e89c7cea4d13" }, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_kms_key.cmk: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-DATA-AWS-KMS-KEY-DELETION-WINDOW", "kind": "deletion-window", "family": "aws.kms_key", "title": "Review the deletion window setting", "block": "deletion_window_in_days", "category": "deletion-protection", "why": "The knowledge base cannot decide \"deletion-window\" of the aws.kms_key contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.aws_kms_key.cmk|deletion-window" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the deletion window setting for module.retail_app_ecs.aws_kms_key.cmk, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-IAM-MODULE-RETAIL-APP-ECS-AWS-KMS-KEY-CMK", "source_family": "aws.kms_key", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.aws_kms_key.cmk" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on module.retail_app_ecs.aws_kms_key.cmk that the knowledge base cannot decide: Review the deletion window setting.", "generated_target_behavior": "Review the deletion window setting: The draft does not carry the setting on module.retail_app_ecs.aws_kms_key.cmk; a manual step stands for it (MAN/semantic/module.retail_app_ecs.aws_kms_key.cmk/deletion-window).", "residual_difference": "Review the deletion window setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.aws_kms_key.cmk/deletion-window now.", "next_action": "Review the deletion window setting: Review the deletion window setting for module.retail_app_ecs.aws_kms_key.cmk, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the deletion window setting: A check of the knowledge base (kms deletion window) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). STACKIT KMS deletes a key scheduled for deletion after 30 days (docs create-and-manage-keys, 'Delete a key'), with no setting: 30 is PRESERVED, another window REVIEW." ], "closes_when": [ "Review the deletion window setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.aws_kms_key.cmk/deletion-window", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS", "kind": "unit-review", "family": "aws.lb", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.lb", "block": "module.retail_app_ecs.module.alb.aws_lb.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.alb.aws_lb.this", "artifact": "assessment.json", "pointer": "/units/28" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.alb.aws_lb.this|client-restriction", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/103" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb.aws_lb.this|lb-routing-and-addressing", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/105" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb.aws_lb.this|lb-subnets", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/106" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb.aws_lb.this|network-exposure", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/107" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb.aws_lb.this|request-handling", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/108" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.alb.aws_lb.this", "artifact": "workspace.json", "pointer": "/units/35/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:f757f9ce3f4966d7d8803d03f11e2b3a0e09c8f5cfa0e4a9c5081c4883698607", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.lb/client-restriction", "sha256": "sha256:83cf9da3fe08fb98d5d3f53c08e4994dc6ce331ce66db1bcf44a3d36bde5fb82" }, { "kind": "contract_semantic", "id": "aws.lb/lb-routing-and-addressing", "sha256": "sha256:b670f101867aca662315398034296713f7e1288107d4d90abeccfc0af6e6d0f0" }, { "kind": "contract_semantic", "id": "aws.lb/lb-subnets", "sha256": "sha256:dee89acbb6c65a806539c1bf51c4c32b10e0870a74f6c4373a7247536e9281f2" }, { "kind": "contract_semantic", "id": "aws.lb/network-exposure", "sha256": "sha256:882e84a96291d16926f21d55f2fb3f0b29b40be837cdc2f05a5927e469ce64e9" }, { "kind": "contract_semantic", "id": "aws.lb/request-handling", "sha256": "sha256:01c352ef3d05bf3d8345f69ecf55c11bf9b10a43b0b657b5aea1d5d8cc8c75d5" }, { "kind": "review_cause", "id": "aws.lb/client-restriction", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.lb/lb-routing-and-addressing", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.lb/lb-subnets", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.lb/network-exposure", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.lb/request-handling", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:ddcf6e6a242b2d5dfe5aae8e00904e05e839215e95782b4cdf84013b73814c1a" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 3 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 5 critical settings of module.retail_app_ecs.module.alb.aws_lb.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-LB-CLIENT-RESTRICTION", "kind": "client-restriction", "family": "aws.lb", "title": "Decide the ALB client access", "block": "load_balancer_type", "category": "network-exposure", "why": "The knowledge base cannot decide \"client-restriction\" of the aws.lb contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb.aws_lb.this|client-restriction" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide the ALB client access for module.retail_app_ecs.module.alb.aws_lb.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-LB-LB-ROUTING-AND-ADDRESSING", "kind": "lb-routing-and-addressing", "family": "aws.lb", "title": "Review the LB routing and addressing setting", "block": "customer_owned_ipv4_pool", "category": "network-exposure", "why": "The knowledge base cannot decide \"lb-routing-and-addressing\" of the aws.lb contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb.aws_lb.this|lb-routing-and-addressing" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the LB routing and addressing setting for module.retail_app_ecs.module.alb.aws_lb.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-LB-LB-SUBNETS", "kind": "lb-subnets", "family": "aws.lb", "title": "Review the LB subnets setting", "block": "subnets", "category": "network-exposure", "why": "The knowledge base cannot decide \"lb-subnets\" of the aws.lb contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb.aws_lb.this|lb-subnets" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.alb.aws_lb.this: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-LB-NETWORK-EXPOSURE", "kind": "network-exposure", "family": "aws.lb", "title": "Decide who may reach the service over the network", "block": "internal", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-exposure\" of the aws.lb contract for 1 unit (LEDGER): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb.aws_lb.this|network-exposure" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.retail_app_ecs.module.alb.aws_lb.this outside the draft; the plan states no title for it." }, { "id": "DEC-NET-AWS-LB-REQUEST-HANDLING", "kind": "request-handling", "family": "aws.lb", "title": "Review the request handling setting", "block": "desync_mitigation_mode", "category": "network-exposure", "why": "The knowledge base cannot decide \"request-handling\" of the aws.lb contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb.aws_lb.this|request-handling" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the request handling setting for module.retail_app_ecs.module.alb.aws_lb.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS", "source_family": "aws.lb", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.alb.aws_lb.this" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "lb-network-access", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, LEDGER", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Decide the ALB client access; the 5 settings of the record state their own.", "source_observation": "The source states 5 critical settings on module.retail_app_ecs.module.alb.aws_lb.this that the knowledge base cannot decide: Decide the ALB client access; Review the LB routing and addressing setting; Review the LB subnets setting; Decide who may reach the service over the network; Review the request handling setting.", "generated_target_behavior": "Decide the ALB client access: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect). Two states. When the draft carries the restriction (the source rules name ranges the scan proves), the load balancer is written with those ranges as its allowed source ranges (options.access_control.allowed_source_ranges), and the critical-settings record of the run names the step that carries them. When it does not (a group reference, a prefix list, a variable, or a range admitted on some ports only), the target admits more clients than the source: the load balancer waits for the decision on the widened exposure, and the plan holds a manual step of the Security Architect that restricts its clients; where no range at all can be proven, no access control is written. Review the LB routing and addressing setting: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect). Review the LB subnets setting: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may reach the service over the network: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the request handling setting: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect).", "residual_difference": "Decide the ALB client access: That the target admits only the clients the source admitted. Review the LB routing and addressing setting: the target behaviour of this setting is not established Review the LB subnets setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may reach the service over the network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the request handling setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect now.", "next_action": "Decide the ALB client access: Decide the ALB client access for module.retail_app_ecs.module.alb.aws_lb.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Decide the ALB client access: A check of the knowledge base (lb security groups) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Who may reach the load balancer, read from the ingress rules of the security groups that filter its clients. A group reference, a prefix list, an IPv6 range or a variable is not carried: the plan lists the clients the target would block and adds the client-access manual step for the Security Architect.", "Review the LB routing and addressing setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states how the load balancer answers DNS for clients (Availability Zone affinity), whether it still forwards to targets when AWS WAF cannot be reached (fail open), zonal shift, customer-owned address pools and IPv6 source NAT prefixes.", "Review the LB subnets setting: The value is not visible statically (a case of the mapping rule for this kind of unit), so nothing is credited for it. The load balancer takes the network of its one converted subnet (networks.network_id; several subnets are lb subnets several, REVIEW): STACKIT networks are regional, one network holds what the source spread over zonal subnets.", "Decide who may reach the service over the network: Whether the draft carries this setting is decided by its semantic ledger entry \"network exposure\", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). internal not visible statically (a variable): the source states no exposure and the draft carries nothing for it; a person decides whether the STACKIT load balancer is private_network_only (REVIEW).", "Review the request handling setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states how the load balancer treats HTTP requests that may carry a request-smuggling (desync) risk, and how it rewrites the X-Forwarded-For header before the target sees it." ], "closes_when": [ "Decide the ALB client access: A person confirms the carried ranges against the source rules, or decides the open client-access step, and the regenerated draft carries the result.", "Decide the ALB client access: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the carried ranges against the source rules, or decides the open client-access step, and the regenerated draft carries the result.", "Review the LB routing and addressing setting: A person decides whether the STACKIT load balancer needs an equivalent for each of them, because the STACKIT application and network load balancers have no setting for any of them (pinned provider).", "Review the LB subnets setting: The knowledge base states no closing condition for this setting; the run closes it when a literal value or a resolved reference in the source closes it, or when a person confirms the value.", "Review the LB subnets setting: A literal value or a resolved reference in the source closes it, or a person confirms the value.", "Decide who may reach the service over the network: A person decides whether the STACKIT load balancer is private network only; the draft picks no side and leaves a boolean variable without default and a comment, because the source's internal flag is not visible statically.", "Decide who may reach the service over the network: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.", "Review the request handling setting: A person confirms that the application does not depend on either behaviour: the STACKIT application load balancer has neither setting and its documentation does not state the behaviour (pinned provider), also for the AWS default values." ], "required_inputs": [], "resolution_paths": [ { "id": "client-restriction/confirm-the-carried-ranges", "title": "Decide the ALB client access: When the draft carries the ranges: confirm them against the source rules", "prerequisites": [ "the critical-settings record of the run names the step that carries the ranges, and the ranges are written as the load balancer's allowed source ranges", "the ingress rules of every security group on the source load balancer" ], "effects": [ "Nothing in the draft changes; the restriction applies to the whole load balancer, not per listener or port." ], "risk": [ "Per-port restrictions of the source are merged into one list for all listeners." ], "evidence": [ "STACKIT provider schema 0.120.0: \"Use this option to limit the IP ranges that can use the Application Load Balancer.\"", "STACKIT provider schema 0.120.0: \"Application Load Balancer is accessible only from an IP address in this range.\"" ], "regeneration_required": false }, { "id": "client-restriction/restrict-the-clients-by-hand", "title": "Decide the ALB client access: When it does not: the Security Architect restricts the clients of the load balancer (the manual step of the plan)", "prerequisites": [ "the ingress rules of every security group on the source load balancer, with the listener ports they cover", "for each rule whose source is not a range (another group, a prefix list): the ranges that stand for it, or the decision that it is dropped" ], "effects": [ "The ranges are written on options.access_control.allowed_source_ranges after the load balancer exists (or before apply, in the draft by hand)." ], "risk": [ "A range written for a group source is an approximation; until the step is done the load balancer admits every client." ], "evidence": [ "rule aws.lb/lb-security-groups of the knowledge base: \"Security groups restrict clients of the load balancer; on STACKIT this becomes options.access_control.allowed_source_ranges (ALB) or options.acl (NLB).\"", "provider-docs mirror stackit/stackit-api-specifications/services/alb/v2/alb.json:647: \"Traffic originating from any IP in the referenced list is denied access to the Application Load Balancer.\"" ], "regeneration_required": false }, { "id": "client-restriction/keep-the-network-private", "title": "Decide the ALB client access: Keep the load balancer on a private address only", "prerequisites": [ "the source load balancer is internal, or its clients reach it through a private network" ], "effects": [ "options.private_network_only makes the load balancer reachable only on a private address; it cannot be changed after creation.", "regeneration: not stated — treated as required" ], "risk": [ "It is no client restriction: every host on the networks that reach the private address is admitted. Clients on the internet no longer reach it, and the choice is fixed at creation." ], "evidence": [ "STACKIT provider schema 0.120.0: \"Application Load Balancer is accessible only via a private network ip address. Not changeable after creation.\"" ], "regeneration_required": true }, { "id": "client-restriction/accept-the-wider-exposure", "title": "Decide the ALB client access: Accept that more clients reach the load balancer than on the source", "prerequisites": [ "the owner's statement that the source restriction is not needed (for example a public website)" ], "effects": [ "The draft is applied as written; the exposure widened is an accepted difference." ], "risk": [ "Anything the source restricted to known clients is open to the internet." ], "evidence": [ "rule aws.lb/lb-security-groups of the knowledge base: \"Security groups restrict clients of the load balancer;\"" ], "regeneration_required": false }, { "id": "lb-subnets/verify-on-target", "title": "Review the LB subnets setting: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.lb/cross-zone: \"A person checks how the STACKIT load balancer spreads traffic over targets in several availability zones, which is not documented, and confirms that the spread is acceptable.\"" ], "regeneration_required": true }, { "id": "network-exposure/decide-and-carry-out", "title": "Decide who may reach the service over the network: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.", "regeneration: not stated — treated as required" ], "risk": [ "The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes." ], "evidence": [ "contract note aws.lb/network-exposure: \"A person decides whether the STACKIT load balancer is private network only; the draft picks no side and leaves a boolean variable without default and a comment, because the source's internal flag is not visible statically.\"" ], "regeneration_required": true } ], "required_verification": [ "Decide the ALB client access: a request from an address outside the allowed ranges is refused by the target load balancer, and one from inside is served", "Review the LB subnets setting: the check, proof or closing evidence is recorded with its result", "Decide who may reach the service over the network: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing changes from an answer: no input topic carries client ranges. A rerun on a source whose rules name ranges by exact reference lets the draft carry them.", "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Decide the ALB client access: Manual work remains: a person closes the semantic, the draft does not.", "Review the LB subnets setting: Manual work remains: a person closes the semantic, the draft does not.", "Decide who may reach the service over the network: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.lb/client-restriction: \"carries the client restriction where the sources are provable IPv4 ranges: options.access_control.allowed_source_ranges of stackit_application_load_balancer\"", "contract note aws.lb/cross-zone: \"A person checks how the STACKIT load balancer spreads traffic over targets in several availability zones, which is not documented, and confirms that the spread is acceptable.\"", "contract note aws.lb/lb-subnets: \"The load balancer takes the network of its one converted subnet (networks.network_id; several subnets are lb subnets several, REVIEW): STACKIT networks are regional, one network holds what the source spread over zonal subnets.\"", "contract note aws.lb/network-exposure: \"A person decides whether the STACKIT load balancer is private network only; the draft picks no side and leaves a boolean variable without default and a comment, because the source's internal flag is not visible statically.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS", "kind": "unit-review", "family": "aws.lb", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.lb", "block": "module.retail_app_ecs.module.alb.aws_lb.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.alb.aws_lb.this", "artifact": "assessment.json", "pointer": "/units/28" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.alb.aws_lb.this|lb-connection-timeouts", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/104" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb.aws_lb.this|request-header-options", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/109" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb.aws_lb.this|tc-lb-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/110" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.alb.aws_lb.this", "artifact": "workspace.json", "pointer": "/units/35/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:1f886639d618968c583259189057db4e9560ece36778f6e9a6944d4309935aca", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.lb/lb-connection-timeouts", "sha256": "sha256:9cca63bbe49bc2146e132128a80a9f83e9bd3344134bfd039c86c407a6367215" }, { "kind": "contract_semantic", "id": "aws.lb/request-header-options", "sha256": "sha256:69b6ec4572038a61b09b8b50ae39116247c522defd7679210400effba668adf1" }, { "kind": "contract_semantic", "id": "aws.lb/tc-lb-name", "sha256": "sha256:7f88ebc96b8ed7bb275a5cbd4c80058e484268830dd69b259c50cd5cfb1a8488" }, { "kind": "review_cause", "id": "aws.lb/lb-connection-timeouts", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.lb/request-header-options", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.lb/tc-lb-name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:7043acb60936099ccf2d02a9579423b35351e6dd828273b9d3ca0e98be258b2e" }, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 3 critical settings of module.retail_app_ecs.module.alb.aws_lb.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect.", "required_evidence": [], "items": [ { "id": "DEC-OPS-AWS-LB-LB-CONNECTION-TIMEOUTS", "kind": "lb-connection-timeouts", "family": "aws.lb", "title": "Review the LB connection timeouts setting", "block": "client_keep_alive", "category": "availability-durability", "why": "The knowledge base cannot decide \"lb-connection-timeouts\" of the aws.lb contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb.aws_lb.this|lb-connection-timeouts" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the LB connection timeouts setting for module.retail_app_ecs.module.alb.aws_lb.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-AWS-LB-REQUEST-HEADER-OPTIONS", "kind": "request-header-options", "family": "aws.lb", "title": "Review the request header options setting", "block": "enable_tls_version_and_cipher_suite_headers", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"request-header-options\" of the aws.lb contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb.aws_lb.this|request-header-options" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the request header options setting for module.retail_app_ecs.module.alb.aws_lb.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-AWS-LB-TC-LB-NAME", "kind": "tc-lb-name", "family": "aws.lb", "title": "Confirm the name of the load balancer", "block": "name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-lb-name\" of the aws.lb contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb.aws_lb.this|tc-lb-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "The draft does not carry the name of the LB for module.retail_app_ecs.module.alb.aws_lb.this: set the load balancer's name in the draft by hand, or accept the name the draft writes." } ], "resolution": { "decision_id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS", "source_family": "aws.lb", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.alb.aws_lb.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the LB connection timeouts setting; the 3 settings of the record state their own.", "source_observation": "The source states 3 critical settings on module.retail_app_ecs.module.alb.aws_lb.this that the knowledge base cannot decide: Review the LB connection timeouts setting; Review the request header options setting; Confirm the name of the load balancer.", "generated_target_behavior": "Review the LB connection timeouts setting: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect). Review the request header options setting: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect). Confirm the name of the load balancer: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect). When the draft carries it (the critical-settings record of the run names the step that writes the name, as in most estates checked when this entry was written), the source name is written on the load balancer. When it does not (the record names no carrying step, as in one estate checked), the draft does not write the source name: what it writes instead is in the unit's Terraform comments.", "residual_difference": "Review the LB connection timeouts setting: the target behaviour of this setting is not established Review the request header options setting: the target behaviour of this setting is not established Confirm the name of the load balancer: That nothing that addressed the source load balancer by its name or AWS host name is left pointing at AWS.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect now.", "next_action": "Review the LB connection timeouts setting: Review the LB connection timeouts setting for module.retail_app_ecs.module.alb.aws_lb.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the LB connection timeouts setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_lb.idle_timeout and client_keep_alive (aws 6.66.0): how long the load balancer lets a client connection idle and how long it keeps it open. The STACKIT application load balancer has no such attribute and the draft does not carry them - REVIEW: a person decides whether the applications behind the load balancer (long polling, streaming, WebSockets, slow requests) cope with the STACKIT default. aws_alb, the alias type, is not read here.", "Review the request header options setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states which extra headers the load balancer adds to the request the target receives (TLS version and cipher suite, the client port in X-Forwarded-For) and whether it keeps the original Host header.", "Confirm the name of the load balancer: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_lb.name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). No semantic of this family has verified it as carried." ], "closes_when": [ "Review the LB connection timeouts setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the request header options setting: A person decides, for each setting, what the STACKIT load balancer or the application does instead, because the STACKIT application load balancer has no setting that adds, rewrites or renames a request header towards its targets (pinned provider).", "Confirm the name of the load balancer: A person confirms the name the load balancer carries on the target against what refers to the source name, or accepts the new name." ], "required_inputs": [], "resolution_paths": [ { "id": "tc-lb-name/confirm-the-carried-name", "title": "Confirm the name of the load balancer: When the draft carries it: confirm the name the plan step writes against what refers to it", "prerequisites": [ "the critical-settings record of the run names the step that writes the name", "the list of things that refer to the source load balancer's name or AWS DNS name" ], "effects": [ "Nothing in the draft changes." ], "risk": [ "A client that used the AWS-generated host name needs the STACKIT address; the name alone does not move it." ], "evidence": [ "STACKIT provider schema 0.120.0: \"Application Load balancer name.\"" ], "regeneration_required": false }, { "id": "tc-lb-name/set-the-name-by-hand", "title": "Confirm the name of the load balancer: When it does not: set the load balancer's name in the draft by hand, or accept the name the draft writes", "prerequisites": [ "the name the load balancer should carry on the target" ], "effects": [ "The name attribute of the drafted load balancer is changed by hand before apply." ], "risk": [ "A name changed by hand after a later regeneration is lost unless it is changed again." ], "evidence": [ "contract note aws.lb/tc-lb-name: \"aws_lb.name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract)\"" ], "regeneration_required": false } ], "required_verification": [ "Confirm the name of the load balancer: the references to the name are listed and moved or accepted" ], "next_run_changes": [ "Nothing: no input topic carries the name; a carried name is written again, a name not carried stays unwritten." ], "remains_manual": [ "Confirm the name of the load balancer: Manual work remains only where the draft does not carry the setting or the input is not answered (see the paths)." ], "evidence_refs": [ "contract note aws.lb/tc-lb-name: \"aws_lb.name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract)\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "kind": "unit-review", "family": "aws.mq_broker", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.mq_broker", "block": "module.dependencies.aws_mq_broker.mq", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.aws_mq_broker.mq", "artifact": "assessment.json", "pointer": "/units/30" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.aws_mq_broker.mq|broker-users", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/1" }, { "kind": "semantic", "id": "module.dependencies.aws_mq_broker.mq|tc-user--username", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/6" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.aws_mq_broker.mq", "artifact": "workspace.json", "pointer": "/units/0/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:1d010c1b6ab6c30f34ff7ae81cdd495a8a439b7de14ec99385aea80975a5725b", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.mq_broker/broker-users", "sha256": "sha256:c2744cf1e6eb0bf1220121c2c3f29ac6930816ae18103c76be21de094397fc15" }, { "kind": "contract_semantic", "id": "aws.mq_broker/tc-user--username", "sha256": "sha256:8247cb639418bc874370857dc62490097a1ff3a153e80f7ed880026a975ad1c6" }, { "kind": "review_cause", "id": "aws.mq_broker/broker-users", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.mq_broker/tc-user--username", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:fcc72e842f52db1911a44094da0763f2f3861dca7a5764f68efe67724a1c29ff" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 2 critical settings of module.dependencies.aws_mq_broker.mq: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect.", "required_evidence": [], "items": [ { "id": "DEC-IAM-AWS-MQ-BROKER-BROKER-USERS", "kind": "broker-users", "family": "aws.mq_broker", "title": "Decide the users of the message broker", "block": "user", "category": "identity-access", "why": "The knowledge base cannot decide \"broker-users\" of the aws.mq_broker contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_mq_broker.mq|broker-users" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it." }, { "id": "DEC-IAM-AWS-MQ-BROKER-TC-USER-USERNAME", "kind": "tc-user--username", "family": "aws.mq_broker", "title": "Confirm the user name", "block": "tc-user--username", "category": "identity-access", "why": "The knowledge base cannot decide \"tc-user--username\" of the aws.mq_broker contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_mq_broker.mq|tc-user--username" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.dependencies.aws_mq_broker.mq: the check, proof or closing evidence is recorded with its result." } ], "resolution": { "decision_id": "DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "source_family": "aws.mq_broker", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.aws_mq_broker.mq" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "managed-data-services", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Decide the users of the message broker; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on module.dependencies.aws_mq_broker.mq that the knowledge base cannot decide: Decide the users of the message broker; Confirm the user name.", "generated_target_behavior": "Decide the users of the message broker: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the user name: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Decide the users of the message broker: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the user name: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect now.", "next_action": "Decide the users of the message broker: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.", "why_open": [ "Decide the users of the message broker: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Users become stackit_rabbitmq_credential entries with generated passwords; their permissions are set by a person.", "Confirm the user name: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.user.username: The broker user's login identity. Held CRITICAL: it decides who or what may use, read or change the resource or the data behind it. No semantic of this family has verified it as carried." ], "closes_when": [ "Decide the users of the message broker: A person sets the permissions of each broker user on the generated RabbitMQ credentials and hands the new passwords to the clients.", "Confirm the user name: A person confirms the user names the clients log in with; STACKIT generates each RabbitMQ credential's username, so the clients move to the new usernames." ], "required_inputs": [], "resolution_paths": [ { "id": "broker-users/carry-out-by-hand", "title": "Decide the users of the message broker: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\"" ], "regeneration_required": true }, { "id": "tc-user--username/verify-on-target", "title": "Confirm the user name: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.mq_broker/tc-mq-broker-broker-name: \"A person confirms the broker name the target uses against what refers to the source broker name, or accepts the new name.\"" ], "regeneration_required": true } ], "required_verification": [ "Decide the users of the message broker: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Confirm the user name: the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Decide the users of the message broker: Manual work remains: a person closes the semantic, the draft does not.", "Confirm the user name: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\"", "contract note aws.mq_broker/broker-users: \"A person sets the permissions of each broker user on the generated RabbitMQ credentials and hands the new passwords to the clients.\"", "contract note aws.mq_broker/engine: \"A person decides the target broker: ActiveMQ has no managed STACKIT counterpart, so JMS or OpenWire clients move to AMQP on a RabbitMQ instance, STOMP or MQTT clients keep their protocol, or ActiveMQ runs self-managed.\"", "contract note aws.mq_broker/engine-type: \"A person moves JMS and OpenWire clients to an AMQP client against the RabbitMQ instance, keeps STOMP or MQTT clients on their protocol, or runs ActiveMQ self-managed.\"", "contract note aws.mq_broker/engine-version: \"A person picks the RabbitMQ version for the target instance, since the versions STACKIT offers are not stated for this move.\"", "contract note aws.mq_broker/high-availability: \"A person chooses the STACKIT RabbitMQ plan that gives the availability the source deployment mode had; which plans are clustered across zones is not stated here.\"", "contract note aws.mq_broker/tc-user--password: \"A person hands the clients the password of the generated target credential instead of the literal in the source.\"", "contract note aws.mq_broker/tcp-deployment-mode: \"A person decides whether the target must survive a zone failure as the source deployment mode did, and finds out which RabbitMQ plan, if any, gives that, since the zone spread of the plans is not stated.\"", "contract note aws.mq_broker/tc-mq-broker-broker-name: \"A person confirms the broker name the target uses against what refers to the source broker name, or accepts the new name.\"", "contract note aws.mq_broker/tc-user--username: \"A person confirms the user names the clients log in with; STACKIT generates each RabbitMQ credential's username, so the clients move to the new usernames.\"", "contract note aws.mq_broker/tcp-engine-type: \"A RabbitMQ source keeps its engine; ActiveMQ has no managed STACKIT counterpart, so JMS or OpenWire clients move to AMQP, STOMP or MQTT clients keep their protocol, or ActiveMQ runs self-managed.\"", "contract note aws.mq_broker/tcp-engine-version: \"A person confirms that the broker engine version of the source is compatible with the version the target instance offers.\"", "contract note aws.mq_broker/tcp-subnet-ids: \"A person confirms whether the target needs a standby in another zone, as source subnets in several zones gave, and how clients reach it; the zone spread of STACKIT RabbitMQ plans is not stated.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-NET-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "kind": "unit-review", "family": "aws.mq_broker", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.mq_broker", "block": "module.dependencies.aws_mq_broker.mq", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.aws_mq_broker.mq", "artifact": "assessment.json", "pointer": "/units/30" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.aws_mq_broker.mq|broker-network", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/0" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.aws_mq_broker.mq", "artifact": "workspace.json", "pointer": "/units/0/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:0677d3c44629dc255384d38daf4d1be95731a7b0f973c9589d4bbae60eb3321a", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.mq_broker/broker-network", "sha256": "sha256:f560280485da68d7f64124ad1783552ad9a8bfc9a688410484f5abf9e277d1f8" }, { "kind": "review_cause", "id": "aws.mq_broker/broker-network", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:6b26ef76da0d040b82dfcce3823bf0c9ee2bb5dbbfaf655bb610a1b13740c547" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of module.dependencies.aws_mq_broker.mq: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-MQ-BROKER-BROKER-NETWORK", "kind": "broker-network", "family": "aws.mq_broker", "title": "Decide the network of the message broker", "block": "security_groups", "category": "network-exposure", "why": "The knowledge base cannot decide \"broker-network\" of the aws.mq_broker contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_mq_broker.mq|broker-network" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-NET-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "source_family": "aws.mq_broker", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.aws_mq_broker.mq" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "managed-data-services", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance names a manual step as the only path", "source_observation": "The source states 1 critical setting on module.dependencies.aws_mq_broker.mq that the knowledge base cannot decide: Decide the network of the message broker.", "generated_target_behavior": "Decide the network of the message broker: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/broker-network). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Decide the network of the message broker: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.aws_mq_broker.mq/broker-network now.", "next_action": "Decide the network of the message broker: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.", "why_open": [ "Decide the network of the message broker: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_rabbitmq_instance has no subnet or security-group attribute (pinned provider): clients reach the instance at the address STACKIT assigns, restricted by parameters.sgw_acl — a person decides the ranges." ], "closes_when": [ "Decide the network of the message broker: A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups." ], "required_inputs": [], "resolution_paths": [ { "id": "broker-network/carry-out-by-hand", "title": "Decide the network of the message broker: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\"" ], "regeneration_required": true } ], "required_verification": [ "Decide the network of the message broker: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Decide the network of the message broker: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\"", "contract note aws.mq_broker/broker-users: \"A person sets the permissions of each broker user on the generated RabbitMQ credentials and hands the new passwords to the clients.\"", "contract note aws.mq_broker/engine: \"A person decides the target broker: ActiveMQ has no managed STACKIT counterpart, so JMS or OpenWire clients move to AMQP on a RabbitMQ instance, STOMP or MQTT clients keep their protocol, or ActiveMQ runs self-managed.\"", "contract note aws.mq_broker/engine-type: \"A person moves JMS and OpenWire clients to an AMQP client against the RabbitMQ instance, keeps STOMP or MQTT clients on their protocol, or runs ActiveMQ self-managed.\"", "contract note aws.mq_broker/engine-version: \"A person picks the RabbitMQ version for the target instance, since the versions STACKIT offers are not stated for this move.\"", "contract note aws.mq_broker/high-availability: \"A person chooses the STACKIT RabbitMQ plan that gives the availability the source deployment mode had; which plans are clustered across zones is not stated here.\"", "contract note aws.mq_broker/tc-user--password: \"A person hands the clients the password of the generated target credential instead of the literal in the source.\"", "contract note aws.mq_broker/tcp-deployment-mode: \"A person decides whether the target must survive a zone failure as the source deployment mode did, and finds out which RabbitMQ plan, if any, gives that, since the zone spread of the plans is not stated.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.aws_mq_broker.mq/broker-network", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "kind": "unit-review", "family": "aws.mq_broker", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.mq_broker", "block": "module.dependencies.aws_mq_broker.mq", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.aws_mq_broker.mq", "artifact": "assessment.json", "pointer": "/units/30" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.aws_mq_broker.mq|engine-version", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/2" }, { "kind": "semantic", "id": "module.dependencies.aws_mq_broker.mq|tc-mq-broker-broker-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/4" }, { "kind": "semantic", "id": "module.dependencies.aws_mq_broker.mq|tcp-deployment-mode", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/7" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.aws_mq_broker.mq", "artifact": "workspace.json", "pointer": "/units/0/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:ef3bdbf036354a9489578e8cc7954091c560180b4f5f81788a824d645c25a480", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.mq_broker/engine-version", "sha256": "sha256:f1ba680a51000d8e8b96a3b3ab74adcb1a9f68eba9d93370bb69523322c8dc84" }, { "kind": "contract_semantic", "id": "aws.mq_broker/tc-mq-broker-broker-name", "sha256": "sha256:7ba5e7febb54116b766a38826dd882f1988cadc87e8050c527fc661935c9859f" }, { "kind": "contract_semantic", "id": "aws.mq_broker/tcp-deployment-mode", "sha256": "sha256:a486e48ae22aafd9b7b34986f288b5886d45fb8045c78c244526575cc37148e8" }, { "kind": "review_cause", "id": "aws.mq_broker/engine-version", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.mq_broker/tc-mq-broker-broker-name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.mq_broker/tcp-deployment-mode", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:d399c56bd61185be787a1d869bb94a3737d8820940db9567591409ba1b61ae9e" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 2 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 3 critical settings of module.dependencies.aws_mq_broker.mq: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect.", "required_evidence": [], "items": [ { "id": "DEC-OPS-AWS-MQ-BROKER-ENGINE-VERSION", "kind": "engine-version", "family": "aws.mq_broker", "title": "Choose the database engine version", "block": "engine_version", "category": "availability-durability", "why": "The knowledge base cannot decide \"engine-version\" of the aws.mq_broker contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_mq_broker.mq|engine-version" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it." }, { "id": "DEC-OPS-AWS-MQ-BROKER-TC-MQ-BROKER-BROKER-NAME", "kind": "tc-mq-broker-broker-name", "family": "aws.mq_broker", "title": "Confirm the name of the message broker", "block": "broker_name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-mq-broker-broker-name\" of the aws.mq_broker contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_mq_broker.mq|tc-mq-broker-broker-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.dependencies.aws_mq_broker.mq: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-OPS-AWS-MQ-BROKER-TCP-DEPLOYMENT-MODE", "kind": "tcp-deployment-mode", "family": "aws.mq_broker", "title": "Choose the deployment mode of the broker", "block": "deployment_mode", "category": "availability-durability", "why": "The knowledge base cannot decide \"tcp-deployment-mode\" of the aws.mq_broker contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_mq_broker.mq|tcp-deployment-mode" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "source_family": "aws.mq_broker", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.aws_mq_broker.mq" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "managed-data-services", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Choose the database engine version; the 3 settings of the record state their own.", "source_observation": "The source states 3 critical settings on module.dependencies.aws_mq_broker.mq that the knowledge base cannot decide: Choose the database engine version; Confirm the name of the message broker; Choose the deployment mode of the broker.", "generated_target_behavior": "Choose the database engine version: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the name of the message broker: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Choose the deployment mode of the broker: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Choose the database engine version: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the name of the message broker: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Choose the deployment mode of the broker: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect now.", "next_action": "Choose the database engine version: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.", "why_open": [ "Choose the database engine version: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_rabbitmq_instance takes a STACKIT RabbitMQ version (the draft asks for it: rabbitmq_version) — which versions STACKIT offers is not in the rule's evidence.", "Confirm the name of the message broker: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The name of the message broker. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract).", "Choose the deployment mode of the broker: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.deployment_mode: The family's own setting for high availability already reads this as critical: it selects single instance vs. active standby multi az vs. cluster multi az, i.e. whether the broker survives an AZ failure at all. Held CRITICAL: it decides capacity, delivery guarantees, retry or failure handling that consumers depend on." ], "closes_when": [ "Choose the database engine version: A person picks the RabbitMQ version for the target instance, since the versions STACKIT offers are not stated for this move.", "Confirm the name of the message broker: A person confirms the broker name the target uses against what refers to the source broker name, or accepts the new name.", "Choose the deployment mode of the broker: A person decides whether the target must survive a zone failure as the source deployment mode did, and finds out which RabbitMQ plan, if any, gives that, since the zone spread of the plans is not stated." ], "required_inputs": [], "resolution_paths": [ { "id": "engine-version/carry-out-by-hand", "title": "Choose the database engine version: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\"" ], "regeneration_required": true }, { "id": "tc-mq-broker-broker-name/verify-on-target", "title": "Confirm the name of the message broker: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.mq_broker/tc-mq-broker-broker-name: \"A person confirms the broker name the target uses against what refers to the source broker name, or accepts the new name.\"" ], "regeneration_required": true }, { "id": "tcp-deployment-mode/carry-out-by-hand", "title": "Choose the deployment mode of the broker: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\"" ], "regeneration_required": true } ], "required_verification": [ "Choose the database engine version: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Confirm the name of the message broker: the check, proof or closing evidence is recorded with its result", "Choose the deployment mode of the broker: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Choose the database engine version: Manual work remains: a person closes the semantic, the draft does not.", "Confirm the name of the message broker: Manual work remains: a person closes the semantic, the draft does not.", "Choose the deployment mode of the broker: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\"", "contract note aws.mq_broker/broker-users: \"A person sets the permissions of each broker user on the generated RabbitMQ credentials and hands the new passwords to the clients.\"", "contract note aws.mq_broker/engine: \"A person decides the target broker: ActiveMQ has no managed STACKIT counterpart, so JMS or OpenWire clients move to AMQP on a RabbitMQ instance, STOMP or MQTT clients keep their protocol, or ActiveMQ runs self-managed.\"", "contract note aws.mq_broker/engine-type: \"A person moves JMS and OpenWire clients to an AMQP client against the RabbitMQ instance, keeps STOMP or MQTT clients on their protocol, or runs ActiveMQ self-managed.\"", "contract note aws.mq_broker/engine-version: \"A person picks the RabbitMQ version for the target instance, since the versions STACKIT offers are not stated for this move.\"", "contract note aws.mq_broker/high-availability: \"A person chooses the STACKIT RabbitMQ plan that gives the availability the source deployment mode had; which plans are clustered across zones is not stated here.\"", "contract note aws.mq_broker/tc-user--password: \"A person hands the clients the password of the generated target credential instead of the literal in the source.\"", "contract note aws.mq_broker/tcp-deployment-mode: \"A person decides whether the target must survive a zone failure as the source deployment mode did, and finds out which RabbitMQ plan, if any, gives that, since the zone spread of the plans is not stated.\"", "contract note aws.mq_broker/tc-mq-broker-broker-name: \"A person confirms the broker name the target uses against what refers to the source broker name, or accepts the new name.\"", "contract note aws.mq_broker/tc-user--username: \"A person confirms the user names the clients log in with; STACKIT generates each RabbitMQ credential's username, so the clients move to the new usernames.\"", "contract note aws.mq_broker/tcp-engine-type: \"A RabbitMQ source keeps its engine; ActiveMQ has no managed STACKIT counterpart, so JMS or OpenWire clients move to AMQP, STOMP or MQTT clients keep their protocol, or ActiveMQ runs self-managed.\"", "contract note aws.mq_broker/tcp-engine-version: \"A person confirms that the broker engine version of the source is compatible with the version the target instance offers.\"", "contract note aws.mq_broker/tcp-subnet-ids: \"A person confirms whether the target needs a standby in another zone, as source subnets in several zones gave, and how clients reach it; the zone spread of STACKIT RabbitMQ plans is not stated.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-SEC-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "kind": "unit-review", "family": "aws.mq_broker", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.mq_broker", "block": "module.dependencies.aws_mq_broker.mq", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.aws_mq_broker.mq", "artifact": "assessment.json", "pointer": "/units/30" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.aws_mq_broker.mq|tc-user--password", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/5" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.aws_mq_broker.mq", "artifact": "workspace.json", "pointer": "/units/0/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:4e74b75b281d7cca7f66b57294584f30ce28513bc601ae4284f9e27f1e62c0fb", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.mq_broker/tc-user--password", "sha256": "sha256:b2b8dee049b1288db52233d30511b2ff1a13cc5660a2b885c774c74aa4bcdf3f" }, { "kind": "review_cause", "id": "aws.mq_broker/tc-user--password", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:e2afe9f65e46c927d6dbb417aa8c41e8885a02158b60cc03c77e11f5edd05218" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of module.dependencies.aws_mq_broker.mq: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect.", "required_evidence": [], "items": [ { "id": "DEC-SEC-AWS-MQ-BROKER-TC-USER-PASSWORD", "kind": "tc-user--password", "family": "aws.mq_broker", "title": "Decide how the user password is supplied", "block": "tc-user--password", "category": "secret-handling", "why": "The knowledge base cannot decide \"tc-user--password\" of the aws.mq_broker contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_mq_broker.mq|tc-user--password" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it." } ], "resolution": { "decision_id": "DEC-SEC-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "source_family": "aws.mq_broker", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.aws_mq_broker.mq" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "managed-data-services", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance names a manual step as the only path", "source_observation": "The source states 1 critical setting on module.dependencies.aws_mq_broker.mq that the knowledge base cannot decide: Decide how the user password is supplied.", "generated_target_behavior": "Decide how the user password is supplied: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Decide how the user password is supplied: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect now.", "next_action": "Decide how the user password is supplied: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.", "why_open": [ "Decide how the user password is supplied: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.user.password: The broker user's login credential; a literal secret. Held CRITICAL: it carries or names a credential; the value is never copied and a person re-creates it on the target. No semantic of this family has verified it as carried." ], "closes_when": [ "Decide how the user password is supplied: A person hands the clients the password of the generated target credential instead of the literal in the source." ], "required_inputs": [], "resolution_paths": [ { "id": "tc-user--password/carry-out-by-hand", "title": "Decide how the user password is supplied: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\"" ], "regeneration_required": true } ], "required_verification": [ "Decide how the user password is supplied: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Decide how the user password is supplied: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\"", "contract note aws.mq_broker/broker-users: \"A person sets the permissions of each broker user on the generated RabbitMQ credentials and hands the new passwords to the clients.\"", "contract note aws.mq_broker/engine: \"A person decides the target broker: ActiveMQ has no managed STACKIT counterpart, so JMS or OpenWire clients move to AMQP on a RabbitMQ instance, STOMP or MQTT clients keep their protocol, or ActiveMQ runs self-managed.\"", "contract note aws.mq_broker/engine-type: \"A person moves JMS and OpenWire clients to an AMQP client against the RabbitMQ instance, keeps STOMP or MQTT clients on their protocol, or runs ActiveMQ self-managed.\"", "contract note aws.mq_broker/engine-version: \"A person picks the RabbitMQ version for the target instance, since the versions STACKIT offers are not stated for this move.\"", "contract note aws.mq_broker/high-availability: \"A person chooses the STACKIT RabbitMQ plan that gives the availability the source deployment mode had; which plans are clustered across zones is not stated here.\"", "contract note aws.mq_broker/tc-user--password: \"A person hands the clients the password of the generated target credential instead of the literal in the source.\"", "contract note aws.mq_broker/tcp-deployment-mode: \"A person decides whether the target must survive a zone failure as the source deployment mode did, and finds out which RabbitMQ plan, if any, gives that, since the zone spread of the plans is not stated.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS", "kind": "unit-review", "family": "aws.nat_gateway", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.nat_gateway", "block": "module.vpc.module.vpc.aws_nat_gateway.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.vpc.module.vpc.aws_nat_gateway.this", "artifact": "assessment.json", "pointer": "/units/22" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.vpc.module.vpc.aws_nat_gateway.this|fixed-egress-ip", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/274" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_nat_gateway.this|nat-placement", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/275" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_nat_gateway.this|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/276" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:3e80a05723d110a3e1c0d44751fa6e6caf815a7d234eb525820b1d1c73adc582", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.nat_gateway/fixed-egress-ip", "sha256": "sha256:90e5f713baeae0bd4145551d75a03c215f6aa7e8f76d65e6b1d9ae7d0a5bb995" }, { "kind": "contract_semantic", "id": "aws.nat_gateway/nat-placement", "sha256": "sha256:6ed50de92639d87181380d8bf2dd535b3b7bcd03b2f8468958bd91470e5b2dff" }, { "kind": "contract_semantic", "id": "aws.nat_gateway/network-topology-boundary", "sha256": "sha256:1d30af73fec20b2c6cce250c831b0c72e33eb650b4078c767dd17289547957a0" }, { "kind": "review_cause", "id": "aws.nat_gateway/fixed-egress-ip", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.nat_gateway/nat-placement", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.nat_gateway/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:29e4f09e1d1c036f8c792a72964586ae14d7aacaa4624f262ad51c5164d96d4f" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "TARGET_LIMIT", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 3 critical settings of module.vpc.module.vpc.aws_nat_gateway.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-NAT-GATEWAY-FIXED-EGRESS-IP", "kind": "fixed-egress-ip", "family": "aws.nat_gateway", "title": "Decide the fixed outbound IP address", "block": "allocation_id", "category": "network-exposure", "why": "The knowledge base cannot decide \"fixed-egress-ip\" of the aws.nat_gateway contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.vpc.module.vpc.aws_nat_gateway.this|fixed-egress-ip" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.vpc.module.vpc.aws_nat_gateway.this outside the draft; the plan states no title for it." }, { "id": "DEC-NET-AWS-NAT-GATEWAY-NAT-PLACEMENT", "kind": "nat-placement", "family": "aws.nat_gateway", "title": "Review the NAT placement setting", "block": "availability_mode", "category": "network-exposure", "why": "The knowledge base cannot decide \"nat-placement\" of the aws.nat_gateway contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.vpc.module.vpc.aws_nat_gateway.this|nat-placement" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.vpc.module.vpc.aws_nat_gateway.this outside the draft; the plan states no title for it." }, { "id": "DEC-NET-AWS-NAT-GATEWAY-NETWORK-TOPOLOGY-BOUNDARY", "kind": "network-topology-boundary", "family": "aws.nat_gateway", "title": "Confirm that the project is the boundary of one network", "block": "network-topology-boundary", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-topology-boundary\" of the aws.nat_gateway contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.vpc.module.vpc.aws_nat_gateway.this|network-topology-boundary" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.vpc.module.vpc.aws_nat_gateway.this: the check, proof or closing evidence is recorded with its result." } ], "resolution": { "decision_id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS", "source_family": "aws.nat_gateway", "source_semantic": "unit-review", "affected_units": [ "module.vpc.module.vpc.aws_nat_gateway.this" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "private-egress-dns", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Decide the fixed outbound IP address; the 3 settings of the record state their own.", "source_observation": "The source states 3 critical settings on module.vpc.module.vpc.aws_nat_gateway.this that the knowledge base cannot decide: Decide the fixed outbound IP address; Review the NAT placement setting; Confirm that the project is the boundary of one network.", "generated_target_behavior": "Decide the fixed outbound IP address: The draft does not carry the setting on module.vpc.module.vpc.aws_nat_gateway.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the NAT placement setting: The draft does not carry the setting on module.vpc.module.vpc.aws_nat_gateway.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_nat_gateway.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Decide the fixed outbound IP address: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the NAT placement setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings now.", "next_action": "Decide the fixed outbound IP address: Carry out the manual work the plan names for module.vpc.module.vpc.aws_nat_gateway.this outside the draft; the plan states no title for it.", "why_open": [ "Decide the fixed outbound IP address: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A stable egress IP on STACKIT is an open question (no source in this repository answers it; the per-network SNAT address is computed and cannot be chosen or kept).", "Review the NAT placement setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A zonal NAT gateway (subnet_id) is placed in one AZ; a regional one lists its per-AZ egress in availability_zone_address(es).availability_zone. STACKIT has no NAT gateway resource, and its documentation does not state whether the implicit outbound path is zone-scoped: REVIEW.", "Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this NAT gateway included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project." ], "closes_when": [ "Decide the fixed outbound IP address: A person decides how peers that allow-list the Elastic IP are served: a routed STACKIT network leaves by the project's shared egress address, which cannot be set and can change, so the allow-list follows it or each server gets a STACKIT public IP.", "Review the NAT placement setting: A person decides whether the egress path must stay in one zone or per zone, because the STACKIT documentation does not state whether the implicit outbound path is scoped to a zone.", "Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded." ], "required_inputs": [], "resolution_paths": [ { "id": "fixed-egress-ip/decide-and-carry-out", "title": "Decide the fixed outbound IP address: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.", "regeneration: not stated — treated as required" ], "risk": [ "The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes." ], "evidence": [ "contract note aws.nat_gateway/fixed-egress-ip: \"A person decides how peers that allow-list the Elastic IP are served: a routed STACKIT network leaves by the project's shared egress address, which cannot be set and can change, so the allow-list follows it or each server gets a STACKIT public IP.\"" ], "regeneration_required": true }, { "id": "nat-placement/decide-and-carry-out", "title": "Review the NAT placement setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.", "regeneration: not stated — treated as required" ], "risk": [ "The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes." ], "evidence": [ "contract note aws.nat_gateway/fixed-egress-ip: \"A person decides how peers that allow-list the Elastic IP are served: a routed STACKIT network leaves by the project's shared egress address, which cannot be set and can change, so the allow-list follows it or each server gets a STACKIT public IP.\"" ], "regeneration_required": true }, { "id": "network-topology-boundary/bring-the-closing-evidence", "title": "Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.nat_gateway/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "regeneration_required": true } ], "required_verification": [ "Decide the fixed outbound IP address: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Review the NAT placement setting: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Decide the fixed outbound IP address: Manual work remains: a person closes the semantic, the draft does not.", "Review the NAT placement setting: Manual work remains: a person closes the semantic, the draft does not.", "Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.nat_gateway/fixed-egress-ip: \"A person decides how peers that allow-list the Elastic IP are served: a routed STACKIT network leaves by the project's shared egress address, which cannot be set and can change, so the allow-list follows it or each server gets a STACKIT public IP.\"", "contract note aws.nat_gateway/nat-placement: \"A person decides whether the egress path must stay in one zone or per zone, because the STACKIT documentation does not state whether the implicit outbound path is scoped to a zone.\"", "contract note aws.nat_gateway/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings", "mode": "MANUAL", "phase": "FOUNDATION", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "kind": "unit-review", "family": "aws.opensearch", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.opensearch", "block": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "artifact": "assessment.json", "pointer": "/units/31" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|access-and-encryption-settings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/19" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|credentials-and-keys-settings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/21" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|domain-credentials-and-keys", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/22" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|domain-settings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/23" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|fine-grained-access", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/26" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|nbr-aws-opensearch-domain-policy", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/27" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|opensearch-domain-policy-resource", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/29" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "artifact": "workspace.json", "pointer": "/units/5/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:a9e0ee79957045c23a463b07a97b52afc357b86ed2311d9024f40b66f15e8e40", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.opensearch/access-and-encryption-settings", "sha256": "sha256:8c4b985a4f47091c858ef9a3e50da3f944d1392fdefd5499b2f60520a51bb2bf" }, { "kind": "contract_semantic", "id": "aws.opensearch/credentials-and-keys-settings", "sha256": "sha256:1abd18f648ba297736cd5008a2fe0d6969f210f72b20d40fed56f8757ccb7b15" }, { "kind": "contract_semantic", "id": "aws.opensearch/domain-credentials-and-keys", "sha256": "sha256:cdd927530b264c9ad3e4f3341c0ace1a668e55801efc356547c77cc545e95371" }, { "kind": "contract_semantic", "id": "aws.opensearch/domain-settings", "sha256": "sha256:fbc4cea405051fdb19cc428e113d391d1019da557e40e64627eb4bbfd529abf5" }, { "kind": "contract_semantic", "id": "aws.opensearch/fine-grained-access", "sha256": "sha256:3cd1e1e69771964fc5bd271f8664e4092792e752a829e8d0e5209a5cac001f96" }, { "kind": "contract_semantic", "id": "aws.opensearch/nbr-aws-opensearch-domain-policy", "sha256": "sha256:93e0bb7e372fad5c5754f068d68a2015e14fa68eddd1d3d70e330b9d640b82d8" }, { "kind": "contract_semantic", "id": "aws.opensearch/opensearch-domain-policy-resource", "sha256": "sha256:2425fb2887549544673049a3e019897ad3a80e262e5ba7184ee8f61229e4e772" }, { "kind": "review_cause", "id": "aws.opensearch/access-and-encryption-settings", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.opensearch/credentials-and-keys-settings", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.opensearch/domain-credentials-and-keys", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.opensearch/domain-settings", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.opensearch/fine-grained-access", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.opensearch/nbr-aws-opensearch-domain-policy", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.opensearch/opensearch-domain-policy-resource", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:015d35ebcb41585433b3b03ff85346e2bb1ce130ac85ae7e90a2f4f6eeeef8d2" }, "causes": [ { "cause": "TARGET_LIMIT", "members": 2 }, { "cause": "NOT_CLASSIFIED", "members": 5 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 7 critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect.", "required_evidence": [], "items": [ { "id": "DEC-IAM-AWS-OPENSEARCH-ACCESS-AND-ENCRYPTION-SETTINGS", "kind": "access-and-encryption-settings", "family": "aws.opensearch", "title": "Review the access and encryption settings setting", "block": "access_policies", "category": "identity-access", "why": "The knowledge base cannot decide \"access-and-encryption-settings\" of the aws.opensearch contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|access-and-encryption-settings" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the access and encryption settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-AWS-OPENSEARCH-CREDENTIALS-AND-KEYS-SETTINGS", "kind": "credentials-and-keys-settings", "family": "aws.opensearch", "title": "Review the credentials and keys settings setting", "block": "credentials-and-keys-settings", "category": "identity-access", "why": "The knowledge base cannot decide \"credentials-and-keys-settings\" of the aws.opensearch contract for 1 unit (UNSUPPORTED): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|credentials-and-keys-settings" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the credentials and keys settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-AWS-OPENSEARCH-DOMAIN-CREDENTIALS-AND-KEYS", "kind": "domain-credentials-and-keys", "family": "aws.opensearch", "title": "Review the domain credentials and keys setting", "block": "advanced_security_options", "category": "identity-access", "why": "The knowledge base cannot decide \"domain-credentials-and-keys\" of the aws.opensearch contract for 1 unit (UNSUPPORTED): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|domain-credentials-and-keys" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the domain credentials and keys setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-AWS-OPENSEARCH-DOMAIN-SETTINGS", "kind": "domain-settings", "family": "aws.opensearch", "title": "Review the domain settings setting", "block": "access_policies", "category": "identity-access", "why": "The knowledge base cannot decide \"domain-settings\" of the aws.opensearch contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|domain-settings" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the domain settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-AWS-OPENSEARCH-FINE-GRAINED-ACCESS", "kind": "fine-grained-access", "family": "aws.opensearch", "title": "Review the fine grained access setting", "block": "advanced_security_options", "category": "identity-access", "why": "The knowledge base cannot decide \"fine-grained-access\" of the aws.opensearch contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|fine-grained-access" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the fine grained access setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-AWS-OPENSEARCH-NBR-AWS-OPENSEARCH-DOMAIN-POLICY", "kind": "nbr-aws-opensearch-domain-policy", "family": "aws.opensearch", "title": "Confirm the effect of a neighbouring OpenSearch domain policy", "block": "nbr-aws-opensearch-domain-policy", "category": "identity-access", "why": "The knowledge base cannot decide \"nbr-aws-opensearch-domain-policy\" of the aws.opensearch contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|nbr-aws-opensearch-domain-policy" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the effect of a neighbouring OpenSearch domain policy for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-AWS-OPENSEARCH-OPENSEARCH-DOMAIN-POLICY-RESOURCE", "kind": "opensearch-domain-policy-resource", "family": "aws.opensearch", "title": "Review the OpenSearch domain policy resource setting", "block": "opensearch-domain-policy-resource", "category": "identity-access", "why": "The knowledge base cannot decide \"opensearch-domain-policy-resource\" of the aws.opensearch contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|opensearch-domain-policy-resource" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the OpenSearch domain policy resource setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "source_family": "aws.opensearch", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, UNSUPPORTED", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the access and encryption settings setting; the 7 settings of the record state their own.", "source_observation": "The source states 7 critical settings on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this that the knowledge base cannot decide: Review the access and encryption settings setting; Review the credentials and keys settings setting; Review the domain credentials and keys setting; Review the domain settings setting; Review the fine grained access setting; Confirm the effect of a neighbouring OpenSearch domain policy; Review the OpenSearch domain policy resource setting.", "generated_target_behavior": "Review the access and encryption settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect). Review the credentials and keys settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this. The plan refuses REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/credentials-and-keys-settings. Review the domain credentials and keys setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this. The plan refuses REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/domain-credentials-and-keys. Review the domain settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect). Review the fine grained access setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect). Confirm the effect of a neighbouring OpenSearch domain policy: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect). Review the OpenSearch domain policy resource setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect).", "residual_difference": "Review the access and encryption settings setting: the target behaviour of this setting is not established Review the credentials and keys settings setting: the target behaviour of this setting is not established Review the domain credentials and keys setting: the target behaviour of this setting is not established Review the domain settings setting: the target behaviour of this setting is not established Review the fine grained access setting: the target behaviour of this setting is not established Confirm the effect of a neighbouring OpenSearch domain policy: the target behaviour of this setting is not established Review the OpenSearch domain policy resource setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect now.", "next_action": "Review the access and encryption settings setting: Review the access and encryption settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the access and encryption settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The access policy, free-form engine options, fine-grained access switches, encryption at rest and between nodes, the HTTPS and TLS policy of the endpoint and the engine version of the domain, read wherever they are set.", "Review the credentials and keys settings setting: The mapping rule for this kind of unit found a setting the target has no counterpart for. The IAM master user, the master user name and password, the customer KMS key and the custom endpoint certificate, read where they are set whatever their value. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) - UNSUPPORTED; a password is never carried.", "Review the domain credentials and keys setting: The mapping rule for this kind of unit found a setting the target has no counterpart for. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) — UNSUPPORTED.", "Review the domain settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_opensearch_instance takes a plan (plan_name: nodes and storage), a version and parameters (sgw_acl, syslog, tls_protocols, tls_ciphers, etc.; pinned provider): the domain's node layout, zone awareness, storage, access policy, endpoint TLS and HTTPS settings, internal user database and log publishing are not generated — a person maps them to the plan and parameters — REVIEW.", "Review the fine grained access setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether fine-grained access control, with users, roles and permissions inside the domain, is switched on.", "Confirm the effect of a neighbouring OpenSearch domain policy: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_opensearch_domain_policy (search access policy) attaches an access policy to this domain, so who may reach and use it is decided by that policy and not by the domain's own settings.", "Review the OpenSearch domain policy resource setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The domain's resource-based access policy, written as aws_opensearch_domain_policy (a part of the domain), has no counterpart on STACKIT OpenSearch." ], "closes_when": [ "Review the access and encryption settings setting: A person maps each setting to the STACKIT OpenSearch instance, which has an access list, TLS protocols and ciphers and a version, but no policy document, no free-form option map and no encryption switch (pinned provider).", "Review the credentials and keys settings setting: A person accepts the difference or the design changes: nothing in the source can make the target carry it.", "Review the domain credentials and keys setting: A person accepts the difference or the design changes: nothing in the source can make the target carry it.", "Review the domain settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the fine grained access setting: A person re-creates the access rules another way, because fine-grained IAM access has no equivalent on STACKIT OpenSearch, which offers an access list and credentials per instance.", "Confirm the effect of a neighbouring OpenSearch domain policy: A person reads the policy the neighbour attaches and confirms that the replacing OpenSearch domain lets the same principals act on it, and no more, or that the access is dropped on purpose.", "Review the OpenSearch domain policy resource setting: A person lists the principals and conditions the policy names, decides how their separation is kept (one instance per trust level, or in the application) and puts the source ranges into sgw_acl." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false }, { "id": "REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/credentials-and-keys-settings", "mode": "REFUSE", "phase": "DATA", "executable": false, "waits_for_this": false }, { "id": "REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/domain-credentials-and-keys", "mode": "REFUSE", "phase": "DATA", "executable": false, "waits_for_this": false } ] } }, { "id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "kind": "unit-review", "family": "aws.opensearch", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.opensearch", "block": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "artifact": "assessment.json", "pointer": "/units/31" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|network-settings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/28" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|private-endpoint", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/30" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "artifact": "workspace.json", "pointer": "/units/5/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:efd09ed3163fcd2d1f8f02ae26a7794ec875cfcd3748cbee1def5e930d468b24", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.opensearch/network-settings", "sha256": "sha256:e8a8ba223b4100f3c8385f2beac2833b8d31cddb66576e19cc32eaf055b7ebaf" }, { "kind": "contract_semantic", "id": "aws.opensearch/private-endpoint", "sha256": "sha256:6126c6a758653a0ce83bc70e686176cacd176bc5febd03c3d7af1b461569b5ac" }, { "kind": "review_cause", "id": "aws.opensearch/network-settings", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.opensearch/private-endpoint", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:75be6c240904ea2183ff076fce9ad6f41158d5bfba70b5f029090b67a9cf1315" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 2 critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-OPENSEARCH-NETWORK-SETTINGS", "kind": "network-settings", "family": "aws.opensearch", "title": "Review the network settings setting", "block": "ip_address_type", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-settings\" of the aws.opensearch contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|network-settings" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the network settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-OPENSEARCH-PRIVATE-ENDPOINT", "kind": "private-endpoint", "family": "aws.opensearch", "title": "Review the private endpoint setting", "block": "vpc_options", "category": "network-exposure", "why": "The knowledge base cannot decide \"private-endpoint\" of the aws.opensearch contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|private-endpoint" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the private endpoint setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "source_family": "aws.opensearch", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the network settings setting; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this that the knowledge base cannot decide: Review the network settings setting; Review the private endpoint setting.", "generated_target_behavior": "Review the network settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect). Review the private endpoint setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect).", "residual_difference": "Review the network settings setting: the target behaviour of this setting is not established Review the private endpoint setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect now.", "next_action": "Review the network settings setting: Review the network settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the network settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The VPC placement of the domain (subnet and security group ids, IP address type), read where it is set whatever its value. stackit_opensearch_instance has no network or subnet input; its access control is parameters.sgw_acl, a CIDR list (pinned provider) - REVIEW: a person translates the reachable networks into sgw_acl.", "Review the private endpoint setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the domain lives inside a VPC, with subnets and security groups, instead of behind a public endpoint." ], "closes_when": [ "Review the network settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the private endpoint setting: A person translates the networks that may reach the domain into the access list (a list of CIDR ranges) of the STACKIT OpenSearch instance, which has no network or subnet input (pinned provider)." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "kind": "unit-review", "family": "aws.opensearch", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.opensearch", "block": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "artifact": "assessment.json", "pointer": "/units/31" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|cluster-layout-settings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/20" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|engine-version", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/25" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|storage-settings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/31" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|tc-opensearch-domain-domain-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/32" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "artifact": "workspace.json", "pointer": "/units/5/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:6624c3ac7454bc6f7584654b5457e914db689e9b03564a6ef798e8fd91f4c794", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.opensearch/cluster-layout-settings", "sha256": "sha256:97d354e3c072e59ebc27f553d760f571b353e7846a91e4e46316315a14d91c09" }, { "kind": "contract_semantic", "id": "aws.opensearch/engine-version", "sha256": "sha256:d0551763dbfa80de7f97b5a2dd95ef2c3beae46a83640c06e8f1c2ea8c6b2bb0" }, { "kind": "contract_semantic", "id": "aws.opensearch/storage-settings", "sha256": "sha256:4b957d81818a0d0541c3e36dc5dada5702381311ac349dbae1ff694d7fdd42ca" }, { "kind": "contract_semantic", "id": "aws.opensearch/tc-opensearch-domain-domain-name", "sha256": "sha256:f2d254d73539d0f1192b5aca4436e05e625833f22769b931a489f4938689789b" }, { "kind": "review_cause", "id": "aws.opensearch/cluster-layout-settings", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.opensearch/engine-version", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.opensearch/storage-settings", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.opensearch/tc-opensearch-domain-domain-name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:b373a18848a30ad0874a5fec861e8845077b85460e746a25d0b9d44985e18101" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 3 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect.", "required_evidence": [], "items": [ { "id": "DEC-OPS-AWS-OPENSEARCH-CLUSTER-LAYOUT-SETTINGS", "kind": "cluster-layout-settings", "family": "aws.opensearch", "title": "Review the cluster layout settings setting", "block": "cluster-layout-settings", "category": "availability-durability", "why": "The knowledge base cannot decide \"cluster-layout-settings\" of the aws.opensearch contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|cluster-layout-settings" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the cluster layout settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-AWS-OPENSEARCH-ENGINE-VERSION", "kind": "engine-version", "family": "aws.opensearch", "title": "Choose the database engine version", "block": "engine_version", "category": "availability-durability", "why": "The knowledge base cannot decide \"engine-version\" of the aws.opensearch contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|engine-version" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Choose the database engine version for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-AWS-OPENSEARCH-STORAGE-SETTINGS", "kind": "storage-settings", "family": "aws.opensearch", "title": "Review the storage settings setting", "block": "storage-settings", "category": "availability-durability", "why": "The knowledge base cannot decide \"storage-settings\" of the aws.opensearch contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|storage-settings" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the storage settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-AWS-OPENSEARCH-TC-OPENSEARCH-DOMAIN-DOMAIN-NAME", "kind": "tc-opensearch-domain-domain-name", "family": "aws.opensearch", "title": "Confirm the domain name of the OpenSearch domain", "block": "domain_name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-opensearch-domain-domain-name\" of the aws.opensearch contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|tc-opensearch-domain-domain-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the domain name of the OpenSearch domain for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "source_family": "aws.opensearch", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the cluster layout settings setting; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this that the knowledge base cannot decide: Review the cluster layout settings setting; Choose the database engine version; Review the storage settings setting; Confirm the domain name of the OpenSearch domain.", "generated_target_behavior": "Review the cluster layout settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect). Choose the database engine version: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect). Review the storage settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect). Confirm the domain name of the OpenSearch domain: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect).", "residual_difference": "Review the cluster layout settings setting: the target behaviour of this setting is not established Choose the database engine version: the target behaviour of this setting is not established Review the storage settings setting: the target behaviour of this setting is not established Confirm the domain name of the OpenSearch domain: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect now.", "next_action": "Review the cluster layout settings setting: Review the cluster layout settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the cluster layout settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Every node-layout setting of the domain, read where it is set whatever its value (on, off, empty, a variable, a reference, a block written as an attribute object): instance count, dedicated masters, warm and cold storage, zone awareness and its zone count, multi-AZ with standby and the deployment strategy. A stackit_opensearch_instance takes a plan (plan_name) that fixes nodes, topology and storage, no zone-awareness or tier setting (pinned provider, the provider documentation of opensearch_instance) - REVIEW: a person picks the plan that matches the layout.", "Choose the database engine version: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states which engine and version the OpenSearch domain runs: OpenSearch or legacy Elasticsearch, with its version number.", "Review the storage settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the data nodes use EBS volumes, read where it is set whatever its value. Storage of a stackit_opensearch_instance is defined by its plan (pinned provider, the provider documentation of opensearch_instance): no EBS switch - REVIEW: a person picks a plan whose disk fits the index size.", "Confirm the domain name of the OpenSearch domain: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_opensearch_domain.domain_name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). No semantic of this family has verified it as carried." ], "closes_when": [ "Review the cluster layout settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Choose the database engine version: A person chooses the version of the STACKIT OpenSearch instance, which has a version setting (pinned provider), and checks that the domain's clients work with it.", "Review the storage settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the domain name of the OpenSearch domain: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "kind": "unit-review", "family": "aws.opensearch", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.opensearch", "block": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "artifact": "assessment.json", "pointer": "/units/31" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|encryption-at-rest", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/24" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this", "artifact": "workspace.json", "pointer": "/units/5/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:caf9581bf513722f70799201583927c9f7d2aad376462690c78884ffb3e7913a", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.opensearch/encryption-at-rest", "sha256": "sha256:aa323356dd1c3778ce622d76d4557406904114c5d236e86a0705e59f172ddf09" }, { "kind": "review_cause", "id": "aws.opensearch/encryption-at-rest", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:b5e10b2382a319f48047d0166c4f698c92a41acf6803429131b6c8cb00c3f98e" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-SEC-AWS-OPENSEARCH-ENCRYPTION-AT-REST", "kind": "encryption-at-rest", "family": "aws.opensearch", "title": "Review the encryption at rest setting", "block": "encrypt_at_rest", "category": "encryption", "why": "The knowledge base cannot decide \"encryption-at-rest\" of the aws.opensearch contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|encryption-at-rest" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the encryption at rest setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "source_family": "aws.opensearch", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this that the knowledge base cannot decide: Review the encryption at rest setting.", "generated_target_behavior": "Review the encryption at rest setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/encryption-at-rest).", "residual_difference": "Review the encryption at rest setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/encryption-at-rest now.", "next_action": "Review the encryption at rest setting: Review the encryption at rest setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the encryption at rest setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the data the domain stores is encrypted at rest." ], "closes_when": [ "Review the encryption at rest setting: A person confirms the encryption of the STACKIT OpenSearch instance on the target; the instance has no encryption setting (pinned provider), and no STACKIT fact about it is documented here." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/encryption-at-rest", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-DATA-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "kind": "unit-review", "family": "aws.rds_cluster", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.rds_cluster", "block": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Data Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/32" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this|backup-retention", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/35" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this|final-snapshot", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/39" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/9/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:3ac0ea2fe4b2c89a0ba32b318fb09555b19d7908dee3884848002f6aaab52ca2", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.rds_cluster/backup-retention", "sha256": "sha256:3817544e22ae08342bfc12ec8589df27f338599fdbfff346d23f834d5154ff7d" }, { "kind": "contract_semantic", "id": "aws.rds_cluster/final-snapshot", "sha256": "sha256:08c4dc1b188422b37d5eb44d71da4bb3417d78f3f4b5de246405698bb96deff7" }, { "kind": "review_cause", "id": "aws.rds_cluster/backup-retention", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.rds_cluster/final-snapshot", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" } ], "kb_dependencies_sha256": "sha256:5b13e5758572f5515974e89f2d84b9f3c1d0129e0f2e933bddac05a9567d5be5" }, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 2 critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect.", "required_evidence": [], "items": [ { "id": "DEC-DATA-AWS-RDS-CLUSTER-BACKUP-RETENTION", "kind": "backup-retention", "family": "aws.rds_cluster", "title": "Review the backup retention setting", "block": "backup_retention_period", "category": "backup-retention", "why": "The knowledge base cannot decide \"backup-retention\" of the aws.rds_cluster contract for 1 unit (LEDGER): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|backup-retention" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the backup retention setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-DATA-AWS-RDS-CLUSTER-FINAL-SNAPSHOT", "kind": "final-snapshot", "family": "aws.rds_cluster", "title": "Review the final snapshot setting", "block": "delete_automated_backups", "category": "backup-retention", "why": "The knowledge base cannot decide \"final-snapshot\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|final-snapshot" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the final snapshot setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-DATA-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "source_family": "aws.rds_cluster", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Data Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "LEDGER, REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the backup retention setting; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on module.dependencies.module.catalog_rds.aws_rds_cluster.this that the knowledge base cannot decide: Review the backup retention setting; Review the final snapshot setting.", "generated_target_behavior": "Review the backup retention setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect). Review the final snapshot setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect).", "residual_difference": "Review the backup retention setting: the target behaviour of this setting is not established Review the final snapshot setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect now.", "next_action": "Review the backup retention setting: Review the backup retention setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the backup retention setting: Whether the draft carries this setting is decided by its semantic ledger entry \"backup retention\", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). A retention not visible statically (a variable) is read by no fact and the draft carries nothing for it: a person compares it with the target's backup retention (REVIEW).", "Review the final snapshot setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no final snapshot or delete-time backup setting (pinned provider): it is deleted when Terraform destroys it — a person decides how data survives a destroy (export first) — REVIEW." ], "closes_when": [ "Review the backup retention setting: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.", "Review the final snapshot setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "kind": "unit-review", "family": "aws.rds_cluster", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.rds_cluster", "block": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/32" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this|admin-username-not-carried", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/34" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/9/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:30cbded70d6861ce65a80938e1025f6e3f6b4b28ba08fb7268b5246df0f1c22b", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.rds_cluster/admin-username-not-carried", "sha256": "sha256:da4111763da26eab38b8fa619d2b9d35c53e6e00558abed8c17f5f116254727e" }, { "kind": "review_cause", "id": "aws.rds_cluster/admin-username-not-carried", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:c4835a8b93fcba2849eaacdf4e71de6d98768797036cbb48f0b6210387745322" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-39ce01e47cee", "subject": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "resolution": { "decision_id": "DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "source_family": "aws.rds_cluster", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "kind": "unit-review", "family": "aws.rds_cluster", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.rds_cluster", "block": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/32" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this|db-network-placement", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/36" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this|member-settings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/41" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this|security-groups", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/43" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/9/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:08ef1795fb2ca2f1693f6c9f9ca0f87f030551d26b59f47d9f5e242c34a5a85d", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.rds_cluster/db-network-placement", "sha256": "sha256:4218a400e0724f07a1ddcc80a2e559cdc690f22f91466c632046d20f1dbdae08" }, { "kind": "contract_semantic", "id": "aws.rds_cluster/member-settings", "sha256": "sha256:27a2dff15dd1d5aa5dad65e27fab26d8745913ce78a23c73e908ea1ea55714a8" }, { "kind": "contract_semantic", "id": "aws.rds_cluster/security-groups", "sha256": "sha256:8a8afdfda982810ba5857965945dd39484cbbc07cfa2fcdfbf1f37aaeaa8649f" }, { "kind": "review_cause", "id": "aws.rds_cluster/db-network-placement", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.rds_cluster/member-settings", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.rds_cluster/security-groups", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:f0163b390163c9abfb66c9c2e5830428595abbd5806227eb0ace7abc628c1c45" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 3 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-4b058b494a25", "subject": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "resolution": { "decision_id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "source_family": "aws.rds_cluster", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "kind": "unit-review", "family": "aws.rds_cluster", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.rds_cluster", "block": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/32" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this|engine", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/37" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this|engine-version", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/38" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this|member-engine", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/40" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this|tc-database-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/45" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this|tcf-rds-cluster-instance--identifier", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/46" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/9/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:04c13bb75bcc4b3f06e8a9be6649f1aa33f1783b80e228945967077a7b7f440d", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.rds_cluster/engine", "sha256": "sha256:f7b2bc765cb2ffe614a8967f815f5a7d449f385a032813ae6c7e3835aa221918" }, { "kind": "contract_semantic", "id": "aws.rds_cluster/engine-version", "sha256": "sha256:1a482be9ef5a2d863d06dadaf565fc7aca18f1dd2423a1d226012ceb8052ae74" }, { "kind": "contract_semantic", "id": "aws.rds_cluster/member-engine", "sha256": "sha256:f11b6d5f2c09ba0cd030b41219d3de749801005f257b0668a6c59c6515e0d5a4" }, { "kind": "contract_semantic", "id": "aws.rds_cluster/tc-database-name", "sha256": "sha256:fdc2ba1879990712131bd0d2c78a959f77a5095bd80b586ab409d74394710420" }, { "kind": "contract_semantic", "id": "aws.rds_cluster/tcf-rds-cluster-instance--identifier", "sha256": "sha256:20f0c74728f307be49f802b2c34ccf04c8e3cdad52c0ba3a344dd540cd4ad964" }, { "kind": "review_cause", "id": "aws.rds_cluster/engine", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.rds_cluster/engine-version", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.rds_cluster/member-engine", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.rds_cluster/tc-database-name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.rds_cluster/tcf-rds-cluster-instance--identifier", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:3141dd436e156b462d4a71ba5ebd86efdfe3091a9d43db74d443498d9b3853d5" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 2 }, { "cause": "NOT_CLASSIFIED", "members": 3 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 5 critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect.", "required_evidence": [], "items": [ { "id": "DEC-OPS-AWS-RDS-CLUSTER-ENGINE", "kind": "engine", "family": "aws.rds_cluster", "title": "Choose the database engine", "block": "engine", "category": "availability-durability", "why": "The knowledge base cannot decide \"engine\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|engine" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Choose the database engine for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-AWS-RDS-CLUSTER-ENGINE-VERSION", "kind": "engine-version", "family": "aws.rds_cluster", "title": "Choose the database engine version", "block": "engine_version", "category": "availability-durability", "why": "The knowledge base cannot decide \"engine-version\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|engine-version" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Choose the database engine version for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-AWS-RDS-CLUSTER-MEMBER-ENGINE", "kind": "member-engine", "family": "aws.rds_cluster", "title": "Review the member engine setting", "block": "member-engine", "category": "availability-durability", "why": "The knowledge base cannot decide \"member-engine\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|member-engine" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the member engine setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-AWS-RDS-CLUSTER-TC-DATABASE-NAME", "kind": "tc-database-name", "family": "aws.rds_cluster", "title": "Confirm the database name of the RDS cluster", "block": "database_name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-database-name\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|tc-database-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the database name of the RDS cluster for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-AWS-RDS-CLUSTER-TCF-RDS-CLUSTER-INSTANCE-IDENTIFIER", "kind": "tcf-rds-cluster-instance--identifier", "family": "aws.rds_cluster", "title": "Confirm the identifier of the RDS cluster instance", "block": "tcf-rds-cluster-instance--identifier", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tcf-rds-cluster-instance--identifier\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|tcf-rds-cluster-instance--identifier" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the identifier of the RDS cluster instance for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "source_family": "aws.rds_cluster", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Choose the database engine; the 5 settings of the record state their own.", "source_observation": "The source states 5 critical settings on module.dependencies.module.catalog_rds.aws_rds_cluster.this that the knowledge base cannot decide: Choose the database engine; Choose the database engine version; Review the member engine setting; Confirm the database name of the RDS cluster; Confirm the identifier of the RDS cluster instance.", "generated_target_behavior": "Choose the database engine: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect). Choose the database engine version: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect). Review the member engine setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect). Confirm the database name of the RDS cluster: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect). Confirm the identifier of the RDS cluster instance: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect).", "residual_difference": "Choose the database engine: the target behaviour of this setting is not established Choose the database engine version: the target behaviour of this setting is not established Review the member engine setting: the target behaviour of this setting is not established Confirm the database name of the RDS cluster: the target behaviour of this setting is not established Confirm the identifier of the RDS cluster instance: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect now.", "next_action": "Choose the database engine: Choose the database engine for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Choose the database engine: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The database engine of the cluster (Aurora PostgreSQL, Aurora MySQL, or a Multi-AZ cluster on PostgreSQL or MySQL), which decides the STACKIT database service it lands on.", "Choose the database engine version: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The version of the database engine that the cluster runs.", "Review the member engine setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Cluster members must run the cluster's engine and version (AWS), which the draft follows (TODO when a member states another): the members' engine and version are what the cluster's engine and the engine version setting decide — TRANSFORMED/PRESERVED for a supported PostgreSQL version, REVIEW otherwise.", "Confirm the database name of the RDS cluster: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster.database_name: Name of the initial database created in the cluster; application setup. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract).", "Confirm the identifier of the RDS cluster instance: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster_instance.identifier (a facet of the unit): Name of the instance; it identifies the resource and changes no access, encryption, backup or availability behaviour. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract)." ], "closes_when": [ "Choose the database engine: For a MySQL-compatible cluster a person tests the schemas and queries on STACKIT MariaDB, the closest managed engine, because STACKIT has no MySQL product; for a PostgreSQL cluster, which lands on PostgreSQL Flex, a person confirms that no Aurora-only feature (storage auto-scaling, fast clones, global databases, serverless v2 scaling) is relied on.", "Choose the database engine version: For a PostgreSQL cluster a person picks a major version that PostgreSQL Flex offers (14 to 18; 18 is beta in eu01, so production needs 17 or a generally available 18) and plans an upgrade for any other version. For a MySQL-compatible cluster a person tests the MySQL 8 features in use on STACKIT MariaDB.", "Review the member engine setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the database name of the RDS cluster: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the identifier of the RDS cluster instance: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "kind": "unit-review", "family": "aws.rds_cluster", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.rds_cluster", "block": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/32" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this|admin-password", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/33" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this|parameter-and-option-groups", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/42" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this|storage-encryption", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/44" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.catalog_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/9/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:83e2e9a6dde82e51cd66d9801c1c5f0f3264133cdd53c48904171583c84daf89", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.rds_cluster/admin-password", "sha256": "sha256:4b7ad42645fa2883118f652cdab3fa4199c1bee5bf66a36c2941d0ede7519ecb" }, { "kind": "contract_semantic", "id": "aws.rds_cluster/parameter-and-option-groups", "sha256": "sha256:f179c6e96d0d1c5f843b3679c087fc9baa9ab75e8cd2e41e45a2a2e95d89ae60" }, { "kind": "contract_semantic", "id": "aws.rds_cluster/storage-encryption", "sha256": "sha256:0a96e390f6c7a074deb4f0c8579b1fe49e544dd23a6614f410219836385c7aa0" }, { "kind": "decision_kind", "id": "aws.rds_cluster/admin-password", "sha256": "sha256:cc87cc6d00999d8c2ad664a166fa975f6721ab58eba932bba0264c52b7adb903" }, { "kind": "review_cause", "id": "aws.rds_cluster/admin-password", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.rds_cluster/parameter-and-option-groups", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.rds_cluster/storage-encryption", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:1551bdcb47c689bbe49c9efbfa4e802a66189277f47e4cacfda15e3dac5d2222" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 2 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 3 critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect.", "required_evidence": [ "for storing the password in STACKIT Secrets Manager: the Secrets Manager instance and the way the secret is written there", "who hands the new credentials to the clients (every connection setting that holds the source password), and where the clients read them from after the cutover" ], "items": [ { "id": "DEC-SEC-AWS-RDS-CLUSTER-ADMIN-PASSWORD", "kind": "admin-password", "family": "aws.rds_cluster", "title": "Decide how the administrator password is supplied", "block": "manage_master_user_password", "category": "secret-handling", "why": "The knowledge base cannot decide \"admin-password\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|admin-password" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "use-the-password-stackit-generates", "title": "Use the password STACKIT generates for the database user", "effect": "The draft writes the database user (stackit_postgresflex_user, stackit_sqlserverflex_user, stackit_mariadb_credential or stackit_mongodbflex_user) and STACKIT generates its password at the apply. The draft exposes it as the sensitive output \u003cunit\u003e_admin_password (a reference to the resource, never a value, and no password in any file of the package); the state holds it in plain text, so the state is a secret. The source password and its Secrets Manager management are not copied and the clients get new credentials: after the apply a person reads the output, puts it into the connection settings of every client (a cutover action) and keeps it in the secret store the customer uses. This is the default the draft writes. A review records the choice; the new credentials reaching the clients stays the manual work of the record.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "Required: instance_id, project_id, roles, username. Read-Only: host, id, password (String, Sensitive), port, uri (String, Sensitive, Deprecated), user_id. (There is no password argument: the password is not an input.)" }, { "url": "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L460-L482", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-10-29", "quote": "CreateUserPayload of PostgreSQL Flex API v3: properties name and roles, required name. The responses CreateUserResponse (id, name, password, state) and ResetUserPasswordResponse (name, password, state) return the password the platform generated; no request holds one." } ] }, { "id": "store-the-generated-password-in-secrets-manager", "title": "Store the generated password in STACKIT Secrets Manager", "effect": "The password is still generated by STACKIT and exposed by the draft as the sensitive output \u003cunit\u003e_admin_password; in addition a person writes it into a secret of a STACKIT Secrets Manager instance after the apply and lets the clients read it there. The draft creates no secret: the provider documentation lists stackit_secretsmanager_instance, stackit_secretsmanager_user and two role bindings and no secret resource (searched), so writing the secret is work outside the Terraform draft; the pages read do not describe the write steps (not stated). The source's rotation schedule is not carried either way.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/tree/v0.119.0/docs/resources", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "docs/resources of the provider matching secretsmanager: secretsmanager_instance.md, secretsmanager_instance_role_binding_v1.md, secretsmanager_secret_group_role_binding_v1.md, secretsmanager_user.md (searched for a resource that writes a secret: there is none)." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "Required: instance_id, project_id, roles, username. Read-Only: host, id, password (String, Sensitive), port, uri (String, Sensitive, Deprecated), user_id. (There is no password argument: the password is not an input.)" } ] } ], "recommended_option": "use-the-password-stackit-generates", "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide how the administrator password is supplied for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-RDS-CLUSTER-PARAMETER-AND-OPTION-GROUPS", "kind": "parameter-and-option-groups", "family": "aws.rds_cluster", "title": "Review the parameter and option groups setting", "block": "db_cluster_parameter_group_name", "category": "encryption", "why": "The knowledge base cannot decide \"parameter-and-option-groups\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|parameter-and-option-groups" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the parameter and option groups setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-RDS-CLUSTER-STORAGE-ENCRYPTION", "kind": "storage-encryption", "family": "aws.rds_cluster", "title": "Review the storage encryption setting", "block": "kms_key_id", "category": "encryption", "why": "The knowledge base cannot decide \"storage-encryption\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|storage-encryption" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the storage encryption setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "source_family": "aws.rds_cluster", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Decide how the administrator password is supplied; the 3 settings of the record state their own.", "source_observation": "The source states 3 critical settings on module.dependencies.module.catalog_rds.aws_rds_cluster.this that the knowledge base cannot decide: Decide how the administrator password is supplied; Review the parameter and option groups setting; Review the storage encryption setting.", "generated_target_behavior": "Decide how the administrator password is supplied: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect). Review the parameter and option groups setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect). Review the storage encryption setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect).", "residual_difference": "Decide how the administrator password is supplied: the target behaviour of this setting is not established Review the parameter and option groups setting: the target behaviour of this setting is not established Review the storage encryption setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect now.", "next_action": "Decide how the administrator password is supplied: Decide how the administrator password is supplied for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Decide how the administrator password is supplied: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source password (or its Secrets Manager management) is never copied, and no STACKIT database user takes a password: stackit_postgresflex_user and stackit_mariadb_credential compute it (password is computed and sensitive, pinned provider) and the create-user API of PostgreSQL Flex has no password field.", "Review the parameter and option groups setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no parameter-group or option-group attribute (pinned provider): the group's settings (even a default.* group of the source engine) must be mapped to the STACKIT instance's options by a person — REVIEW.", "Review the storage encryption setting: A check of the knowledge base (aurora storage encrypted mariadb) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states whether the storage of the database cluster is encrypted at rest, with the AWS-managed key because no customer key is named." ], "closes_when": [ "Decide how the administrator password is supplied: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the parameter and option groups setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the storage encryption setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the at-rest encryption of the target database on STACKIT: the PostgreSQL Flex encryption block covers customer keys only and the default without it is not stated, and a MariaDB sandbox instance had database-level encryption off, so whether its volumes are encrypted is not stated (pinned provider)." ], "required_inputs": [ "who hands the new credentials to the clients (every connection setting that holds the source password), and where the clients read them from after the cutover", "for storing the password in STACKIT Secrets Manager: the Secrets Manager instance and the way the secret is written there" ], "resolution_paths": [ { "id": "admin-password/use-the-password-stackit-generates", "title": "Decide how the administrator password is supplied: Use the password STACKIT generates for the database user", "prerequisites": [], "effects": [ "The draft writes the database user (stackit_postgresflex_user, stackit_sqlserverflex_user, stackit_mariadb_credential or stackit_mongodbflex_user) and STACKIT generates its password at the apply. The draft exposes it as the sensitive output \u003cunit\u003e_admin_password (a reference to the resource, never a value, and no password in any file of the package); the state holds it in plain text, so the state is a secret. The source password and its Secrets Manager management are not copied and the clients get new credentials: after the apply a person reads the output, puts it into the connection settings of every client (a cutover action) and keeps it in the secret store the customer uses. This is the default the draft writes. A review records the choice; the new credentials reaching the clients stays the manual work of the record." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61", "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L460-L482" ], "regeneration_required": false }, { "id": "admin-password/store-the-generated-password-in-secrets-manager", "title": "Decide how the administrator password is supplied: Store the generated password in STACKIT Secrets Manager", "prerequisites": [], "effects": [ "The password is still generated by STACKIT and exposed by the draft as the sensitive output \u003cunit\u003e_admin_password; in addition a person writes it into a secret of a STACKIT Secrets Manager instance after the apply and lets the clients read it there. The draft creates no secret: the provider documentation lists stackit_secretsmanager_instance, stackit_secretsmanager_user and two role bindings and no secret resource (searched), so writing the secret is work outside the Terraform draft; the pages read do not describe the write steps (not stated). The source's rotation schedule is not carried either way." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/tree/v0.119.0/docs/resources", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61" ], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61", "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L460-L482", "https://github.com/stackitcloud/terraform-provider-stackit/tree/v0.119.0/docs/resources" ], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-DATA-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "kind": "unit-review", "family": "aws.rds_cluster", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.rds_cluster", "block": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Data Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/34" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this|final-snapshot", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/78" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/22/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:c9776a97d7c44508822e47ba0976fac039372b9a459319ac8420e0010f5391f0", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.rds_cluster/final-snapshot", "sha256": "sha256:08c4dc1b188422b37d5eb44d71da4bb3417d78f3f4b5de246405698bb96deff7" }, { "kind": "review_cause", "id": "aws.rds_cluster/final-snapshot", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" } ], "kb_dependencies_sha256": "sha256:7582d365b5cf18a48a8578bf2e9673a1a1590455fd67d128c7917dd1e54f2cdb" }, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of module.dependencies.module.orders_rds.aws_rds_cluster.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-DATA-AWS-RDS-CLUSTER-FINAL-SNAPSHOT", "kind": "final-snapshot", "family": "aws.rds_cluster", "title": "Review the final snapshot setting", "block": "delete_automated_backups", "category": "backup-retention", "why": "The knowledge base cannot decide \"final-snapshot\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this|final-snapshot" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the final snapshot setting for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-DATA-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "source_family": "aws.rds_cluster", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Data Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on module.dependencies.module.orders_rds.aws_rds_cluster.this that the knowledge base cannot decide: Review the final snapshot setting.", "generated_target_behavior": "Review the final snapshot setting: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-snapshot).", "residual_difference": "Review the final snapshot setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-snapshot now.", "next_action": "Review the final snapshot setting: Review the final snapshot setting for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the final snapshot setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no final snapshot or delete-time backup setting (pinned provider): it is deleted when Terraform destroys it — a person decides how data survives a destroy (export first) — REVIEW." ], "closes_when": [ "Review the final snapshot setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-snapshot", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "kind": "unit-review", "family": "aws.rds_cluster", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.rds_cluster", "block": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/34" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this|admin-username-not-carried", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/76" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/22/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:56a8b21cfab709656b73f9d44bc0f7560aad7fc1566c66d5cd5addcb8bd1753c", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.rds_cluster/admin-username-not-carried", "sha256": "sha256:da4111763da26eab38b8fa619d2b9d35c53e6e00558abed8c17f5f116254727e" }, { "kind": "review_cause", "id": "aws.rds_cluster/admin-username-not-carried", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:c4835a8b93fcba2849eaacdf4e71de6d98768797036cbb48f0b6210387745322" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-39ce01e47cee", "subject": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "resolution": { "decision_id": "DEC-IAM-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "source_family": "aws.rds_cluster", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "kind": "unit-review", "family": "aws.rds_cluster", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.rds_cluster", "block": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/34" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this|db-network-placement", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/77" }, { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this|member-settings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/79" }, { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this|security-groups", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/81" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/22/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:b3c81382b03c6c736acc4d26ff3e92a4345e4df4789e0623bd0f59c9b345b926", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.rds_cluster/db-network-placement", "sha256": "sha256:4218a400e0724f07a1ddcc80a2e559cdc690f22f91466c632046d20f1dbdae08" }, { "kind": "contract_semantic", "id": "aws.rds_cluster/member-settings", "sha256": "sha256:27a2dff15dd1d5aa5dad65e27fab26d8745913ce78a23c73e908ea1ea55714a8" }, { "kind": "contract_semantic", "id": "aws.rds_cluster/security-groups", "sha256": "sha256:8a8afdfda982810ba5857965945dd39484cbbc07cfa2fcdfbf1f37aaeaa8649f" }, { "kind": "review_cause", "id": "aws.rds_cluster/db-network-placement", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.rds_cluster/member-settings", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.rds_cluster/security-groups", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:f0163b390163c9abfb66c9c2e5830428595abbd5806227eb0ace7abc628c1c45" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 3 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-4b058b494a25", "subject": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "resolution": { "decision_id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "source_family": "aws.rds_cluster", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "kind": "unit-review", "family": "aws.rds_cluster", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.rds_cluster", "block": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/34" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this|tc-database-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/83" }, { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this|tcf-rds-cluster-instance--identifier", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/84" } ], "confirm_only_members": 1, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/22/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:5fbeb2619f0e2cfb47bde72a31bb3e3a1f5543ba5914660763055c373724e0c8", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.rds_cluster/tc-database-name", "sha256": "sha256:fdc2ba1879990712131bd0d2c78a959f77a5095bd80b586ab409d74394710420" }, { "kind": "contract_semantic", "id": "aws.rds_cluster/tcf-rds-cluster-instance--identifier", "sha256": "sha256:20f0c74728f307be49f802b2c34ccf04c8e3cdad52c0ba3a344dd540cd4ad964" }, { "kind": "review_cause", "id": "aws.rds_cluster/tc-database-name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "aws.rds_cluster/tcf-rds-cluster-instance--identifier", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:282d05fd56a28cd5bff146421fbd0febc7842ab3637ae182b9f279576b47992f" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 2 critical settings of module.dependencies.module.orders_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is carried by the draft already: a person only confirms it.", "required_evidence": [], "items": [ { "id": "DEC-OPS-AWS-RDS-CLUSTER-TC-DATABASE-NAME", "kind": "tc-database-name", "family": "aws.rds_cluster", "title": "Confirm the database name of the RDS cluster", "block": "database_name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-database-name\" of the aws.rds_cluster contract for 1 unit (REVIEW): the draft already carries it, so a person only confirms it. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The row of each member in assurance/critical-semantics.json (carried_by) names the step and the file that carry it.", "members": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this|tc-database-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "confirm_only_members": 1, "customer_action_status": "CONFIRM_CARRIED", "next_action": "Confirm in terraform/data.tf that the draft carries the database name of the RDS cluster for module.dependencies.module.orders_rds.aws_rds_cluster.this as the source relies on it; nothing needs deciding." }, { "id": "DEC-OPS-AWS-RDS-CLUSTER-TCF-RDS-CLUSTER-INSTANCE-IDENTIFIER", "kind": "tcf-rds-cluster-instance--identifier", "family": "aws.rds_cluster", "title": "Confirm the identifier of the RDS cluster instance", "block": "tcf-rds-cluster-instance--identifier", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tcf-rds-cluster-instance--identifier\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this|tcf-rds-cluster-instance--identifier" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the identifier of the RDS cluster instance for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "source_family": "aws.rds_cluster", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [ { "unit": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "step": "TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders", "mode": "TERRAFORM", "evidence": "the source `database_name` = `orders` is written as `name` = `orders` by the draft (`terraform/data.tf`, block `stackit_postgresflex_database.dependencies_orders_rds_this_orders`): the value is the source's, the connection strings of the application that name the database are a person's to confirm" } ], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm the identifier of the RDS cluster instance; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on module.dependencies.module.orders_rds.aws_rds_cluster.this that the knowledge base cannot decide: Confirm the database name of the RDS cluster; Confirm the identifier of the RDS cluster instance.", "generated_target_behavior": "Confirm the database name of the RDS cluster: The draft carries it on module.dependencies.module.orders_rds.aws_rds_cluster.this: step TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders (the source `database_name` = `orders` is written as `name` = `orders` by the draft (`terraform/data.tf`, block `stackit_postgresflex_database.dependencies_orders_rds_this_orders`): the value is the source's, the connection strings of the application that name the database are a person's to confirm). Confirm the identifier of the RDS cluster instance: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/tcf-rds-cluster-instance--identifier).", "residual_difference": "Confirm the database name of the RDS cluster: a person confirms that the carried value is what the source relies on Confirm the identifier of the RDS cluster instance: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/tcf-rds-cluster-instance--identifier now.", "next_action": "Confirm the identifier of the RDS cluster instance: Confirm the identifier of the RDS cluster instance for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm the database name of the RDS cluster: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster.database_name: Name of the initial database created in the cluster; application setup. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract).", "Confirm the identifier of the RDS cluster instance: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster_instance.identifier (a facet of the unit): Name of the instance; it identifies the resource and changes no access, encryption, backup or availability behaviour. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract)." ], "closes_when": [ "Confirm the database name of the RDS cluster: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the identifier of the RDS cluster instance: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders", "mode": "TERRAFORM", "phase": "PLATFORM", "executable": true, "waits_for_this": false }, { "id": "MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/tcf-rds-cluster-instance--identifier", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "kind": "unit-review", "family": "aws.rds_cluster", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.rds_cluster", "block": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "assessment.json", "pointer": "/units/34" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this|admin-password", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/75" }, { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this|parameter-and-option-groups", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/80" }, { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this|storage-encryption", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/82" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.orders_rds.aws_rds_cluster.this", "artifact": "workspace.json", "pointer": "/units/22/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:ab8f2937699001b60dad6a667cbc1e25d1e136bd735d58b05008f2a9eb3b0d60", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.rds_cluster/admin-password", "sha256": "sha256:4b7ad42645fa2883118f652cdab3fa4199c1bee5bf66a36c2941d0ede7519ecb" }, { "kind": "contract_semantic", "id": "aws.rds_cluster/parameter-and-option-groups", "sha256": "sha256:f179c6e96d0d1c5f843b3679c087fc9baa9ab75e8cd2e41e45a2a2e95d89ae60" }, { "kind": "contract_semantic", "id": "aws.rds_cluster/storage-encryption", "sha256": "sha256:0a96e390f6c7a074deb4f0c8579b1fe49e544dd23a6614f410219836385c7aa0" }, { "kind": "decision_kind", "id": "aws.rds_cluster/admin-password", "sha256": "sha256:cc87cc6d00999d8c2ad664a166fa975f6721ab58eba932bba0264c52b7adb903" }, { "kind": "review_cause", "id": "aws.rds_cluster/admin-password", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.rds_cluster/parameter-and-option-groups", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.rds_cluster/storage-encryption", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:1551bdcb47c689bbe49c9efbfa4e802a66189277f47e4cacfda15e3dac5d2222" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 2 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 3 critical settings of module.dependencies.module.orders_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect.", "required_evidence": [ "for storing the password in STACKIT Secrets Manager: the Secrets Manager instance and the way the secret is written there", "who hands the new credentials to the clients (every connection setting that holds the source password), and where the clients read them from after the cutover" ], "items": [ { "id": "DEC-SEC-AWS-RDS-CLUSTER-ADMIN-PASSWORD", "kind": "admin-password", "family": "aws.rds_cluster", "title": "Decide how the administrator password is supplied", "block": "manage_master_user_password", "category": "secret-handling", "why": "The knowledge base cannot decide \"admin-password\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this|admin-password" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "use-the-password-stackit-generates", "title": "Use the password STACKIT generates for the database user", "effect": "The draft writes the database user (stackit_postgresflex_user, stackit_sqlserverflex_user, stackit_mariadb_credential or stackit_mongodbflex_user) and STACKIT generates its password at the apply. The draft exposes it as the sensitive output \u003cunit\u003e_admin_password (a reference to the resource, never a value, and no password in any file of the package); the state holds it in plain text, so the state is a secret. The source password and its Secrets Manager management are not copied and the clients get new credentials: after the apply a person reads the output, puts it into the connection settings of every client (a cutover action) and keeps it in the secret store the customer uses. This is the default the draft writes. A review records the choice; the new credentials reaching the clients stays the manual work of the record.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "Required: instance_id, project_id, roles, username. Read-Only: host, id, password (String, Sensitive), port, uri (String, Sensitive, Deprecated), user_id. (There is no password argument: the password is not an input.)" }, { "url": "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L460-L482", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-10-29", "quote": "CreateUserPayload of PostgreSQL Flex API v3: properties name and roles, required name. The responses CreateUserResponse (id, name, password, state) and ResetUserPasswordResponse (name, password, state) return the password the platform generated; no request holds one." } ] }, { "id": "store-the-generated-password-in-secrets-manager", "title": "Store the generated password in STACKIT Secrets Manager", "effect": "The password is still generated by STACKIT and exposed by the draft as the sensitive output \u003cunit\u003e_admin_password; in addition a person writes it into a secret of a STACKIT Secrets Manager instance after the apply and lets the clients read it there. The draft creates no secret: the provider documentation lists stackit_secretsmanager_instance, stackit_secretsmanager_user and two role bindings and no secret resource (searched), so writing the secret is work outside the Terraform draft; the pages read do not describe the write steps (not stated). The source's rotation schedule is not carried either way.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/tree/v0.119.0/docs/resources", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "docs/resources of the provider matching secretsmanager: secretsmanager_instance.md, secretsmanager_instance_role_binding_v1.md, secretsmanager_secret_group_role_binding_v1.md, secretsmanager_user.md (searched for a resource that writes a secret: there is none)." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "Required: instance_id, project_id, roles, username. Read-Only: host, id, password (String, Sensitive), port, uri (String, Sensitive, Deprecated), user_id. (There is no password argument: the password is not an input.)" } ] } ], "recommended_option": "use-the-password-stackit-generates", "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide how the administrator password is supplied for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-RDS-CLUSTER-PARAMETER-AND-OPTION-GROUPS", "kind": "parameter-and-option-groups", "family": "aws.rds_cluster", "title": "Review the parameter and option groups setting", "block": "db_cluster_parameter_group_name", "category": "encryption", "why": "The knowledge base cannot decide \"parameter-and-option-groups\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this|parameter-and-option-groups" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the parameter and option groups setting for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-RDS-CLUSTER-STORAGE-ENCRYPTION", "kind": "storage-encryption", "family": "aws.rds_cluster", "title": "Review the storage encryption setting", "block": "kms_key_id", "category": "encryption", "why": "The knowledge base cannot decide \"storage-encryption\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this|storage-encryption" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the storage encryption setting for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "source_family": "aws.rds_cluster", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Decide how the administrator password is supplied; the 3 settings of the record state their own.", "source_observation": "The source states 3 critical settings on module.dependencies.module.orders_rds.aws_rds_cluster.this that the knowledge base cannot decide: Decide how the administrator password is supplied; Review the parameter and option groups setting; Review the storage encryption setting.", "generated_target_behavior": "Decide how the administrator password is supplied: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect). Review the parameter and option groups setting: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect). Review the storage encryption setting: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect).", "residual_difference": "Decide how the administrator password is supplied: the target behaviour of this setting is not established Review the parameter and option groups setting: the target behaviour of this setting is not established Review the storage encryption setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect now.", "next_action": "Decide how the administrator password is supplied: Decide how the administrator password is supplied for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Decide how the administrator password is supplied: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source password (or its Secrets Manager management) is never copied, and no STACKIT database user takes a password: stackit_postgresflex_user and stackit_mariadb_credential compute it (password is computed and sensitive, pinned provider) and the create-user API of PostgreSQL Flex has no password field.", "Review the parameter and option groups setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no parameter-group or option-group attribute (pinned provider): the group's settings (even a default.* group of the source engine) must be mapped to the STACKIT instance's options by a person — REVIEW.", "Review the storage encryption setting: A check of the knowledge base (aurora storage encrypted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states whether the storage of the database cluster is encrypted at rest, with the AWS-managed key because no customer key is named." ], "closes_when": [ "Decide how the administrator password is supplied: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the parameter and option groups setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the storage encryption setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the at-rest encryption of the target database on STACKIT: the PostgreSQL Flex encryption block covers customer keys only and the default without it is not stated, and a MariaDB sandbox instance had database-level encryption off, so whether its volumes are encrypted is not stated (pinned provider)." ], "required_inputs": [ "who hands the new credentials to the clients (every connection setting that holds the source password), and where the clients read them from after the cutover", "for storing the password in STACKIT Secrets Manager: the Secrets Manager instance and the way the secret is written there" ], "resolution_paths": [ { "id": "admin-password/use-the-password-stackit-generates", "title": "Decide how the administrator password is supplied: Use the password STACKIT generates for the database user", "prerequisites": [], "effects": [ "The draft writes the database user (stackit_postgresflex_user, stackit_sqlserverflex_user, stackit_mariadb_credential or stackit_mongodbflex_user) and STACKIT generates its password at the apply. The draft exposes it as the sensitive output \u003cunit\u003e_admin_password (a reference to the resource, never a value, and no password in any file of the package); the state holds it in plain text, so the state is a secret. The source password and its Secrets Manager management are not copied and the clients get new credentials: after the apply a person reads the output, puts it into the connection settings of every client (a cutover action) and keeps it in the secret store the customer uses. This is the default the draft writes. A review records the choice; the new credentials reaching the clients stays the manual work of the record." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61", "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L460-L482" ], "regeneration_required": false }, { "id": "admin-password/store-the-generated-password-in-secrets-manager", "title": "Decide how the administrator password is supplied: Store the generated password in STACKIT Secrets Manager", "prerequisites": [], "effects": [ "The password is still generated by STACKIT and exposed by the draft as the sensitive output \u003cunit\u003e_admin_password; in addition a person writes it into a secret of a STACKIT Secrets Manager instance after the apply and lets the clients read it there. The draft creates no secret: the provider documentation lists stackit_secretsmanager_instance, stackit_secretsmanager_user and two role bindings and no secret resource (searched), so writing the secret is work outside the Terraform draft; the pages read do not describe the write steps (not stated). The source's rotation schedule is not carried either way." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/tree/v0.119.0/docs/resources", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61" ], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61", "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L460-L482", "https://github.com/stackitcloud/terraform-provider-stackit/tree/v0.119.0/docs/resources" ], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE", "kind": "unit-review", "family": "aws.route_table", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.route_table", "block": "module.vpc.module.vpc.aws_route_table.private", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.vpc.module.vpc.aws_route_table.private", "artifact": "assessment.json", "pointer": "/units/78" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.vpc.module.vpc.aws_route_table.private|egress-restriction", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/1" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_route_table.private|nat-fixed-egress-address", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/2" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_route_table.private|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/3" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_route_table.private|route-destinations", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/4" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_route_table.private|route-targets", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/5" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_route_table.private|routes", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/6" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_route_table.private|subnet-association-target", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/7" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_route_table.private|tcr-route-table-vpc-id", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/8" } ], "instances": [ { "unit": "module.vpc.module.vpc.aws_route_table.private", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "egress-restriction" }, { "unit": "module.vpc.module.vpc.aws_route_table.private", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "nat-fixed-egress-address" }, { "unit": "module.vpc.module.vpc.aws_route_table.private", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "network-topology-boundary" }, { "unit": "module.vpc.module.vpc.aws_route_table.private", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "route-destinations" }, { "unit": "module.vpc.module.vpc.aws_route_table.private", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "route-targets" }, { "unit": "module.vpc.module.vpc.aws_route_table.private", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "routes" }, { "unit": "module.vpc.module.vpc.aws_route_table.private", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "subnet-association-target" }, { "unit": "module.vpc.module.vpc.aws_route_table.private", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "tcr-route-table-vpc-id" } ], "conditional_members": 8, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.vpc.module.vpc.aws_route_table.private", "artifact": "workspace.json", "pointer": "/units/77/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:1561d4bf75d1713671e851b18f2c392b9346c65555cab9b2398ea2763bc5b3d6", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.route_table/egress-restriction", "sha256": "sha256:c60eb8bdbd7cfd3b6c49fd88a2a2d207f06e8df4582f1e3bc11163b0f2755244" }, { "kind": "contract_semantic", "id": "aws.route_table/nat-fixed-egress-address", "sha256": "sha256:c60eb8bdbd7cfd3b6c49fd88a2a2d207f06e8df4582f1e3bc11163b0f2755244" }, { "kind": "contract_semantic", "id": "aws.route_table/network-topology-boundary", "sha256": "sha256:754cd6faa5b9daec2ce0c0d9d1fef6c065a8357955e65e3b8fb4431284f0b9f3" }, { "kind": "contract_semantic", "id": "aws.route_table/route-destinations", "sha256": "sha256:f5c57404f831b7edf4d006ebfc213e497d8874f63df26ae7c146dc4f6f135959" }, { "kind": "contract_semantic", "id": "aws.route_table/route-targets", "sha256": "sha256:72794c0bd85f43e34dad51e801c7e0e1573df9ad32b95731efa15f42a0af2547" }, { "kind": "contract_semantic", "id": "aws.route_table/routes", "sha256": "sha256:518c44760f1f746f313dda3c7b9fa5a754d2010102c6bd6f1c085750222c8ca7" }, { "kind": "contract_semantic", "id": "aws.route_table/subnet-association-target", "sha256": "sha256:3c23eb33e3e68f2d1f20af358a264295f68e3fcef541249bbd7daa84e99139b0" }, { "kind": "contract_semantic", "id": "aws.route_table/tcr-route-table-vpc-id", "sha256": "sha256:d6edf3222e1ee852165c093734aaa8c55cfd2e8a30c2fbfbb54ab2cbbc4da2b1" }, { "kind": "review_cause", "id": "aws.route_table/egress-restriction", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.route_table/nat-fixed-egress-address", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.route_table/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.route_table/route-destinations", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.route_table/route-targets", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.route_table/routes", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.route_table/subnet-association-target", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.route_table/tcr-route-table-vpc-id", "sha256": "sha256:e359fecd82f73c031548f556eb6a37d3e2caf0eac456a39fd54436b92dcadb53" } ], "kb_dependencies_sha256": "sha256:d2e1fb89315cf21674a6dea0b0b74b073d58e672b7d0724a1a663b3d68f19d9f" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 5 }, { "cause": "TARGET_LIMIT", "members": 2 }, { "cause": "EVIDENCE_GAP", "members": 1 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "why": "The knowledge base cannot decide 8 critical settings of module.vpc.module.vpc.aws_route_table.private: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 8 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-ROUTE-TABLE-EGRESS-RESTRICTION", "kind": "egress-restriction", "family": "aws.route_table", "title": "Decide the outbound (egress) rules of the security group", "block": "route", "category": "network-exposure", "why": "The knowledge base cannot decide \"egress-restriction\" of the aws.route_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_route_table.private|egress-restriction" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.vpc.module.vpc.aws_route_table.private: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-ROUTE-TABLE-NAT-FIXED-EGRESS-ADDRESS", "kind": "nat-fixed-egress-address", "family": "aws.route_table", "title": "Review the NAT fixed egress address setting", "block": "route", "category": "network-exposure", "why": "The knowledge base cannot decide \"nat-fixed-egress-address\" of the aws.route_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_route_table.private|nat-fixed-egress-address" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Review the NAT fixed egress address setting for module.vpc.module.vpc.aws_route_table.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ROUTE-TABLE-NETWORK-TOPOLOGY-BOUNDARY", "kind": "network-topology-boundary", "family": "aws.route_table", "title": "Confirm that the project is the boundary of one network", "block": "network-topology-boundary", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-topology-boundary\" of the aws.route_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_route_table.private|network-topology-boundary" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.vpc.module.vpc.aws_route_table.private: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-ROUTE-TABLE-ROUTE-DESTINATIONS", "kind": "route-destinations", "family": "aws.route_table", "title": "Confirm the destinations of the routes", "block": "route", "category": "network-exposure", "why": "The knowledge base cannot decide \"route-destinations\" of the aws.route_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_route_table.private|route-destinations" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the destinations of the routes for module.vpc.module.vpc.aws_route_table.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ROUTE-TABLE-ROUTE-TARGETS", "kind": "route-targets", "family": "aws.route_table", "title": "Confirm the targets of the routes", "block": "route", "category": "network-exposure", "why": "The knowledge base cannot decide \"route-targets\" of the aws.route_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_route_table.private|route-targets" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the targets of the routes for module.vpc.module.vpc.aws_route_table.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ROUTE-TABLE-ROUTES", "kind": "routes", "family": "aws.route_table", "title": "Re-create the routes with STACKIT next hops", "block": "route", "category": "network-exposure", "why": "The knowledge base cannot decide \"routes\" of the aws.route_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_route_table.private|routes" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Re-create the routes with STACKIT next hops for module.vpc.module.vpc.aws_route_table.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ROUTE-TABLE-SUBNET-ASSOCIATION-TARGET", "kind": "subnet-association-target", "family": "aws.route_table", "title": "Confirm what each route table is associated with", "block": "subnet-association-target", "category": "network-exposure", "why": "The knowledge base cannot decide \"subnet-association-target\" of the aws.route_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_route_table.private|subnet-association-target" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.vpc.module.vpc.aws_route_table.private outside the draft; the plan states no title for it." }, { "id": "DEC-NET-AWS-ROUTE-TABLE-TCR-ROUTE-TABLE-VPC-ID", "kind": "tcr-route-table-vpc-id", "family": "aws.route_table", "title": "Confirm the network of the route table", "block": "vpc_id", "category": "network-exposure", "why": "The knowledge base cannot decide \"tcr-route-table-vpc-id\" of the aws.route_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_route_table.private|tcr-route-table-vpc-id" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "EVIDENCE_GAP", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the network of the route table for module.vpc.module.vpc.aws_route_table.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE", "source_family": "aws.route_table", "source_semantic": "unit-review", "affected_units": [ "module.vpc.module.vpc.aws_route_table.private" ], "affected_application": [], "action_type": "ACCEPT_DIFFERENCE", "work_package": "private-egress-dns", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the NAT fixed egress address setting; the 8 settings of the record state their own.", "source_observation": "The source states 8 critical settings on module.vpc.module.vpc.aws_route_table.private that the knowledge base cannot decide: Decide the outbound (egress) rules of the security group; Review the NAT fixed egress address setting; Confirm that the project is the boundary of one network; Confirm the destinations of the routes; Confirm the targets of the routes; Re-create the routes with STACKIT next hops; Confirm what each route table is associated with; Confirm the network of the route table.", "generated_target_behavior": "Decide the outbound (egress) rules of the security group: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the NAT fixed egress address setting: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the destinations of the routes: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). A table whose routes all go to an internet gateway is replaced by STACKIT's default routing and no table is drafted, with the precondition that the project is created outside a Network Area (the plan's statement that no routing table is drafted). A custom table is drafted as a stackit_routing_table of a Network Area with the routes it can carry; every other route is named \"not carried\" in the Terraform comments. Confirm the targets of the routes: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). A table whose routes all go to an internet gateway is replaced by STACKIT's default routing and no table is drafted, with the precondition that the project is created outside a Network Area (the plan's statement that no routing table is drafted). A custom table is drafted as a stackit_routing_table of a Network Area with the routes it can carry; every other route is named \"not carried\" in the Terraform comments. Re-create the routes with STACKIT next hops: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). A table whose routes all go to an internet gateway is replaced by STACKIT's default routing and no table is drafted, with the precondition that the project is created outside a Network Area (the plan's statement that no routing table is drafted). A custom table is drafted as a stackit_routing_table of a Network Area with the routes it can carry; every other route is named \"not carried\" in the Terraform comments. Confirm what each route table is associated with: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the network of the route table: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). With one VPC the project stands for it and the default routing applies (nothing drafted); a custom table is drafted at Network Area scope.", "residual_difference": "Decide the outbound (egress) rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the NAT fixed egress address setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the destinations of the routes: That the target networks reach what the source routes reached and nothing more: the default routing of a Network Area was never read, and the equivalence outside an area was observed in one STACKIT test project only. Confirm the targets of the routes: That the target networks reach what the source routes reached and nothing more: the default routing of a Network Area was never read, and the equivalence outside an area was observed in one STACKIT test project only. Re-create the routes with STACKIT next hops: That the target networks reach what the source routes reached and nothing more: the default routing of a Network Area was never read, and the equivalence outside an area was observed in one STACKIT test project only. Confirm what each route table is associated with: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the network of the route table: Which STACKIT networks the routing rules govern.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings now.", "next_action": "Review the NAT fixed egress address setting: Review the NAT fixed egress address setting for module.vpc.module.vpc.aws_route_table.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Decide the outbound (egress) rules of the security group: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The restriction of egress to the NAT gateway (the only way out of a private subnet) is carried on STACKIT by the egress rules of the security groups, not by a route (the test of 2026-10-10: with egress rules for one /32 only that destination was reachable, with none nothing left). Whether the source restricts egress that way, and whether the draft carries those rules for the servers of this table's subnets, is not something this contract can read, so it is REVIEW and never PRESERVED: a person confirms that the servers of the private subnets keep a restricting egress rule set.", "Review the NAT fixed egress address setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. NOT CARRIED, an observed loss (the test of 2026-10-10): the NAT gateway's fixed egress address.", "Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this route table included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.", "Confirm the destinations of the routes: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Destinations are read by value: every route of a default-only table sends 0.0.0.0/0 to an internet or NAT gateway — STACKIT's default network routing, observed equivalent for a draft outside a Network Area (the test of 2026-10-10) and REVIEW all the same.", "Confirm the targets of the routes: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The next hop of each route of the table: a route whose target is anything but an internet or NAT gateway, or that names none, makes the table a custom routing table.", "Re-create the routes with STACKIT next hops: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Custom routes map to stackit_routing_table_route, an experimental resource (experiment routing-tables); next hops that name AWS gateways are chosen anew.", "Confirm what each route table is associated with: A check of the knowledge base (rt private subnet association) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states which subnet uses this route table, for the associations the draft does not attach.", "Confirm the network of the route table: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). aws_route_table.vpc_id: The VPC whose subnets this route table's rules apply to; a route table's entries only make sense, and only affect reachability, within this one VPC, so losing or mismapping it silently changes which network the routing rules govern. A custom table is REVIEW whatever the estate: the draft's stackit_routing_table is organisation and Network Area scoped (organization_id, network_area_id, pinned provider), not a resource of the project that is the VPC's boundary (the experimental stackit_vpc_routing_table, pinned provider: project_id, vpc_id, is a VPC-scoped table that the draft does not write and that nothing establishes as the counterpart of an AWS route table), so which networks the table governs is decided by the Network Area the person puts the project in and the routing_table_id each network is given. A table the draft does not make (count or for_each) and one left to the architect are REVIEW. Several VPCs, a VPC count that is not visible, or a vpc_id (this table's or another unit's) that is a literal, a variable, a data source or an expression the scan cannot reduce to the estate's VPC: which routing domain the table belongs to is the architect's decision — REVIEW. Held CRITICAL: it decides which networks, clients or endpoints reach the resource or what it reaches." ], "closes_when": [ "Decide the outbound (egress) rules of the security group: A person confirms that the servers of the private subnets keep a restricting egress rule set in their security groups, because on STACKIT the restriction of egress is carried by egress rules, not by a route.", "Review the NAT fixed egress address setting: A person accepts the project's shared egress address, which can change and cannot be set, or gives each server a STACKIT public IP when a third party allow-lists the old address.", "Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Confirm the destinations of the routes: A person confirms every route destination that is not the default route to an internet or NAT gateway (a CIDR, a prefix list, any IPv6 route): the draft carries none, and a specific destination needs a stackit_routing_table_route, which takes IPv4 CIDR destinations only.", "Confirm the targets of the routes: A person decides the next hop of each route on STACKIT: an internet gateway becomes the next hop internet, an appliance (a network interface or an instance) a next hop of type ipv4. A NAT gateway, a transit gateway or a VPC peering has no STACKIT counterpart, so the connectivity design is the person's.", "Re-create the routes with STACKIT next hops: A person creates the routes on the STACKIT routing table (stackit_routing_table_route, experimental) and chooses the next hops anew, because they name AWS gateways.", "Confirm what each route table is associated with: A person decides which networks of the Network Area take the routing table and sets routing_table_id on them: STACKIT attaches a routing table to a whole network (stackit_network.routing_table_id), there is no per-subnet association, and routing tables apply only to routed Layer 3 networks in a Network Area.", "Confirm what each route table is associated with: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which networks of the Network Area take the routing table and sets routing_table_id on them: STACKIT attaches a routing table to a whole network (stackit_network.routing_table_id), there is no per-subnet association, and routing tables apply only to routed Layer 3 networks in a Network Area.", "Confirm the network of the route table: A person decides which STACKIT networks the routing table governs: the draft's custom table is organisation and Network Area scoped, so the Network Area the project joins and the routing table each network is given decide it.", "Confirm the network of the route table: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which STACKIT networks the routing table governs: the draft's custom table is organisation and Network Area scoped, so the Network Area the project joins and the routing table each network is given decide it." ], "required_inputs": [], "resolution_paths": [ { "id": "egress-restriction/verify-on-target", "title": "Decide the outbound (egress) rules of the security group: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.route_table/egress-restriction: \"A person confirms that the servers of the private subnets keep a restricting egress rule set in their security groups, because on STACKIT the restriction of egress is carried by egress rules, not by a route.\"" ], "regeneration_required": true }, { "id": "nat-fixed-egress-address/accept-the-difference", "title": "Review the NAT fixed egress address setting: Accept the documented difference", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "The owner records that the target does not reproduce the setting and that the workload accepts it; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "What the setting protected on the source (data, access, availability) is not protected on the target in the same way." ], "evidence": [ "contract note aws.route_table/nat-fixed-egress-address: \"A person accepts the project's shared egress address, which can change and cannot be set, or gives each server a STACKIT public IP when a third party allow-lists the old address.\"" ], "regeneration_required": true }, { "id": "network-topology-boundary/verify-on-target", "title": "Confirm that the project is the boundary of one network: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.route_table/edge-association: \"Ingress routing of the traffic entering through a gateway (aws_route_table_association gateway_id, AWS::EC2::GatewayRouteTableAssociation); no STACKIT counterpart is evidenced in the pinned provider.\"" ], "regeneration_required": true }, { "id": "route-destinations/keep-default-routing-outside-area", "title": "Confirm the destinations of the routes: Keep STACKIT's default routing in a project outside a Network Area", "prerequisites": [ "every route of the table sends traffic to an internet gateway (a default-only table)", "the target project is created outside a Network Area" ], "effects": [ "No routing table is written; every network reaches the internet through source NAT and the networks of the project reach each other." ], "risk": [ "A server without a public IP gains outbound internet through the network's shared address, which the source's internet gateway did not give it." ], "evidence": [ "decision kind stackitroute.NAT_FIXED_EGRESS_ADDRESS_LOST of the knowledge base: \"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading.\"", "a test on a STACKIT project on 2026-10-10: \"Observed: the address a server leaves by follows its NIC's public IP (own address) or, without one, the network's `publicIp`\"", "a test on a STACKIT project on 2026-10-10: \"Not inferred: a routing table. The API shows none and the probe makes no statement about the table of a Network Area; only that the connectivity exists without one in this project.\"" ], "regeneration_required": false }, { "id": "route-destinations/draft-a-routing-table-in-a-network-area", "title": "Confirm the destinations of the routes: Place the workload in a Network Area and carry the routes in a routing table", "prerequisites": [ "a Network Area for the target project (an organisation-level decision; whether a project can join an area after creation is not stated in the sources read)", "the complete route set, with a STACKIT next hop for each route" ], "effects": [ "A stackit_routing_table with stackit_routing_table_route resources (IPv4 CIDR destinations only) is assigned to the routed networks." ], "risk": [ "The resource is experimental and may change; IPv6 routes and routes to NAT, transit or peering targets have no counterpart." ], "evidence": [ "STACKIT provider schema 0.120.0: \"This resource is for SNA, not VPC, based networks.\"", "STACKIT provider schema 0.120.0: \"is part of the experimental feature routing-tables\"", "STACKIT provider schema 0.120.0: \"Only `cidrv4` is supported during experimental stage.\"", "STACKIT provider schema 0.120.0: \"Type of the next hop. Possible values are: `blackhole`, `internet`, `ipv4`, `ipv6`.\"", "decision kind stackitroute.route-set of the knowledge base: \"Each STACKIT Network Area includes one default routing table. STACKIT creates this table automatically when you create a new environment. All routed networks follow the default table unless you assign a different one.\"" ], "regeneration_required": true }, { "id": "route-targets/keep-default-routing-outside-area", "title": "Confirm the targets of the routes: Keep STACKIT's default routing in a project outside a Network Area", "prerequisites": [ "every route of the table sends traffic to an internet gateway (a default-only table)", "the target project is created outside a Network Area" ], "effects": [ "No routing table is written; every network reaches the internet through source NAT and the networks of the project reach each other." ], "risk": [ "A server without a public IP gains outbound internet through the network's shared address, which the source's internet gateway did not give it." ], "evidence": [ "decision kind stackitroute.NAT_FIXED_EGRESS_ADDRESS_LOST of the knowledge base: \"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading.\"", "a test on a STACKIT project on 2026-10-10: \"Observed: the address a server leaves by follows its NIC's public IP (own address) or, without one, the network's `publicIp`\"", "a test on a STACKIT project on 2026-10-10: \"Not inferred: a routing table. The API shows none and the probe makes no statement about the table of a Network Area; only that the connectivity exists without one in this project.\"" ], "regeneration_required": false }, { "id": "route-targets/draft-a-routing-table-in-a-network-area", "title": "Confirm the targets of the routes: Place the workload in a Network Area and carry the routes in a routing table", "prerequisites": [ "a Network Area for the target project (an organisation-level decision; whether a project can join an area after creation is not stated in the sources read)", "the complete route set, with a STACKIT next hop for each route" ], "effects": [ "A stackit_routing_table with stackit_routing_table_route resources (IPv4 CIDR destinations only) is assigned to the routed networks." ], "risk": [ "The resource is experimental and may change; IPv6 routes and routes to NAT, transit or peering targets have no counterpart." ], "evidence": [ "STACKIT provider schema 0.120.0: \"This resource is for SNA, not VPC, based networks.\"", "STACKIT provider schema 0.120.0: \"is part of the experimental feature routing-tables\"", "STACKIT provider schema 0.120.0: \"Only `cidrv4` is supported during experimental stage.\"", "STACKIT provider schema 0.120.0: \"Type of the next hop. Possible values are: `blackhole`, `internet`, `ipv4`, `ipv6`.\"", "decision kind stackitroute.route-set of the knowledge base: \"Each STACKIT Network Area includes one default routing table. STACKIT creates this table automatically when you create a new environment. All routed networks follow the default table unless you assign a different one.\"" ], "regeneration_required": true }, { "id": "routes/keep-default-routing-outside-area", "title": "Re-create the routes with STACKIT next hops: Keep STACKIT's default routing in a project outside a Network Area", "prerequisites": [ "every route of the table sends traffic to an internet gateway (a default-only table)", "the target project is created outside a Network Area" ], "effects": [ "No routing table is written; every network reaches the internet through source NAT and the networks of the project reach each other." ], "risk": [ "A server without a public IP gains outbound internet through the network's shared address, which the source's internet gateway did not give it." ], "evidence": [ "decision kind stackitroute.NAT_FIXED_EGRESS_ADDRESS_LOST of the knowledge base: \"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading.\"", "a test on a STACKIT project on 2026-10-10: \"Observed: the address a server leaves by follows its NIC's public IP (own address) or, without one, the network's `publicIp`\"", "a test on a STACKIT project on 2026-10-10: \"Not inferred: a routing table. The API shows none and the probe makes no statement about the table of a Network Area; only that the connectivity exists without one in this project.\"" ], "regeneration_required": false }, { "id": "routes/draft-a-routing-table-in-a-network-area", "title": "Re-create the routes with STACKIT next hops: Place the workload in a Network Area and carry the routes in a routing table", "prerequisites": [ "a Network Area for the target project (an organisation-level decision; whether a project can join an area after creation is not stated in the sources read)", "the complete route set, with a STACKIT next hop for each route" ], "effects": [ "A stackit_routing_table with stackit_routing_table_route resources (IPv4 CIDR destinations only) is assigned to the routed networks." ], "risk": [ "The resource is experimental and may change; IPv6 routes and routes to NAT, transit or peering targets have no counterpart." ], "evidence": [ "STACKIT provider schema 0.120.0: \"This resource is for SNA, not VPC, based networks.\"", "STACKIT provider schema 0.120.0: \"is part of the experimental feature routing-tables\"", "STACKIT provider schema 0.120.0: \"Only `cidrv4` is supported during experimental stage.\"", "STACKIT provider schema 0.120.0: \"Type of the next hop. Possible values are: `blackhole`, `internet`, `ipv4`, `ipv6`.\"", "decision kind stackitroute.route-set of the knowledge base: \"Each STACKIT Network Area includes one default routing table. STACKIT creates this table automatically when you create a new environment. All routed networks follow the default table unless you assign a different one.\"" ], "regeneration_required": true }, { "id": "subnet-association-target/decide-and-carry-out", "title": "Confirm what each route table is associated with: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.", "regeneration: not stated — treated as required" ], "risk": [ "The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes." ], "evidence": [ "contract note aws.route_table/subnet-association-target: \"A person decides which networks of the Network Area take the routing table and sets routing_table_id on them: STACKIT attaches a routing table to a whole network (stackit_network.routing_table_id), there is no per-subnet association, and routing tables apply only to routed Layer 3 networks in a Network Area.\"" ], "regeneration_required": true }, { "id": "tcr-route-table-vpc-id/one-project-per-vpc", "title": "Confirm the network of the route table: Keep one project per VPC with STACKIT's default routing", "prerequisites": [ "one VPC in the estate", "the project created outside a Network Area" ], "effects": [ "The project's networks are the VPC's subnets; no table is written." ], "risk": [ "As for the routes of the table: the default routing is observed equivalent only outside a Network Area." ], "evidence": [ "contract note aws.route_table/tcr-route-table-vpc-id: \"the project the draft creates is that VPC's boundary\"" ], "regeneration_required": false }, { "id": "tcr-route-table-vpc-id/assign-the-table-to-networks", "title": "Confirm the network of the route table: Assign the routing table to the networks of the Network Area it should govern", "prerequisites": [ "the Network Area the project joins", "the networks that take the table" ], "effects": [ "Each network that takes the table carries its id; a table is assigned per network, there is no per-subnet association." ], "risk": [ "A network left without the table follows the area's default table." ], "evidence": [ "STACKIT provider schema 0.120.0: \"The ID of the routing table associated with the network.\"" ], "regeneration_required": true } ], "required_verification": [ "Decide the outbound (egress) rules of the security group: the check, proof or closing evidence is recorded with its result", "Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result", "Confirm the destinations of the routes: reachability observed on the target: the internet, the other networks, and nothing the source did not reach", "Confirm the targets of the routes: reachability observed on the target: the internet, the other networks, and nothing the source did not reach", "Re-create the routes with STACKIT next hops: reachability observed on the target: the internet, the other networks, and nothing the source did not reach", "Confirm what each route table is associated with: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Confirm the network of the route table: the routing of each target network observed on the target" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes.", "Nothing from an answer: no input topic carries routes. A bound target environment that places the project in a Network Area, or states an egress other than STACKIT's default routing, reopens the default-routing equivalence (see the plan's statement that no routing table is drafted).", "Nothing from an answer: no input topic carries a Network Area; a bound target environment's placement changes what the draft writes for routing." ], "remains_manual": [ "Decide the outbound (egress) rules of the security group: Manual work remains: a person closes the semantic, the draft does not.", "Review the NAT fixed egress address setting: Manual work remains: a person closes the semantic, the draft does not.", "Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.", "Confirm the destinations of the routes: Manual work remains: a person closes the semantic, the draft does not.", "Confirm the targets of the routes: Manual work remains: a person closes the semantic, the draft does not.", "Re-create the routes with STACKIT next hops: Manual work remains: a person closes the semantic, the draft does not.", "Confirm what each route table is associated with: Manual work remains: a person closes the semantic, the draft does not.", "Confirm the network of the route table: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.route_table/egress-restriction: \"A person confirms that the servers of the private subnets keep a restricting egress rule set in their security groups, because on STACKIT the restriction of egress is carried by egress rules, not by a route.\"", "contract note aws.route_table/inbound-none: \"A person confirms the draft's project stays outside a Network Area and that no server of the private subnets is given a public IP; inside a Network Area the absence of an inbound path is not observed.\"", "contract note aws.route_table/nat-fixed-egress-address: \"A person accepts the project's shared egress address, which can change and cannot be set, or gives each server a STACKIT public IP when a third party allow-lists the old address.\"", "contract note aws.route_table/edge-association: \"Ingress routing of the traffic entering through a gateway (aws_route_table_association gateway_id, AWS::EC2::GatewayRouteTableAssociation); no STACKIT counterpart is evidenced in the pinned provider.\"", "contract note aws.route_table/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"", "contract note aws.route_table/route-set-completeness: \"A person confirms that nothing outside the scan adds routes to the table (a virtual private gateway propagation, a route server, a route a variable switches on, a route type the scan does not model), or lists those routes.\"", "contract note aws.route_table/vpn-propagation: \"Non-empty propagating_vgws (or a propagation resource) is REVIEW.\"", "contract note aws.route_table/routes: \"Custom routes map to stackit_routing_table_route, an experimental resource (experiment routing-tables); next hops that name AWS gateways are chosen anew.\"", "provider-docs mirror stackit/docs.stackit.cloud/products/network/core-networking/network-area/faq.html: \"Currently we do not support this, however there are plans to enable this in the future.\"", "contract note aws.route_table/subnet-association-target: \"A person decides which networks of the Network Area take the routing table and sets routing_table_id on them: STACKIT attaches a routing table to a whole network (stackit_network.routing_table_id), there is no per-subnet association, and routing tables apply only to routed Layer 3 networks in a Network Area.\"", "contract note aws.route_table/tcr-route-table-vpc-id: \"The VPC whose subnets this route table's rules apply to;\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings", "mode": "MANUAL", "phase": "FOUNDATION", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC", "kind": "unit-review", "family": "aws.route_table", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.route_table", "block": "module.vpc.module.vpc.aws_route_table.public", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.vpc.module.vpc.aws_route_table.public", "artifact": "assessment.json", "pointer": "/units/79" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.vpc.module.vpc.aws_route_table.public|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/9" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_route_table.public|route-destinations", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/10" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_route_table.public|route-targets", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/11" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_route_table.public|routes", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/12" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_route_table.public|tcr-route-table-vpc-id", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/13" } ], "instances": [ { "unit": "module.vpc.module.vpc.aws_route_table.public", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "network-topology-boundary" }, { "unit": "module.vpc.module.vpc.aws_route_table.public", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "route-destinations" }, { "unit": "module.vpc.module.vpc.aws_route_table.public", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "route-targets" }, { "unit": "module.vpc.module.vpc.aws_route_table.public", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "routes" }, { "unit": "module.vpc.module.vpc.aws_route_table.public", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "tcr-route-table-vpc-id" } ], "conditional_members": 5, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.vpc.module.vpc.aws_route_table.public", "artifact": "workspace.json", "pointer": "/units/78/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:4381bcffbb8aba26ae5ac648a21eb6de290d0ac6a31e8dcfe9735ff5bb04a8aa", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.route_table/network-topology-boundary", "sha256": "sha256:754cd6faa5b9daec2ce0c0d9d1fef6c065a8357955e65e3b8fb4431284f0b9f3" }, { "kind": "contract_semantic", "id": "aws.route_table/route-destinations", "sha256": "sha256:f5c57404f831b7edf4d006ebfc213e497d8874f63df26ae7c146dc4f6f135959" }, { "kind": "contract_semantic", "id": "aws.route_table/route-targets", "sha256": "sha256:72794c0bd85f43e34dad51e801c7e0e1573df9ad32b95731efa15f42a0af2547" }, { "kind": "contract_semantic", "id": "aws.route_table/routes", "sha256": "sha256:518c44760f1f746f313dda3c7b9fa5a754d2010102c6bd6f1c085750222c8ca7" }, { "kind": "contract_semantic", "id": "aws.route_table/tcr-route-table-vpc-id", "sha256": "sha256:d6edf3222e1ee852165c093734aaa8c55cfd2e8a30c2fbfbb54ab2cbbc4da2b1" }, { "kind": "review_cause", "id": "aws.route_table/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.route_table/route-destinations", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.route_table/route-targets", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.route_table/routes", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.route_table/tcr-route-table-vpc-id", "sha256": "sha256:e359fecd82f73c031548f556eb6a37d3e2caf0eac456a39fd54436b92dcadb53" } ], "kb_dependencies_sha256": "sha256:864ef886796905191fc25d42b580a577dc5a359a9dce4fe72db62b2c42c2763d" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 3 }, { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "EVIDENCE_GAP", "members": 1 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "why": "The knowledge base cannot decide 5 critical settings of module.vpc.module.vpc.aws_route_table.public: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 5 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-ROUTE-TABLE-NETWORK-TOPOLOGY-BOUNDARY", "kind": "network-topology-boundary", "family": "aws.route_table", "title": "Confirm that the project is the boundary of one network", "block": "network-topology-boundary", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-topology-boundary\" of the aws.route_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_route_table.public|network-topology-boundary" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.vpc.module.vpc.aws_route_table.public: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-ROUTE-TABLE-ROUTE-DESTINATIONS", "kind": "route-destinations", "family": "aws.route_table", "title": "Confirm the destinations of the routes", "block": "route", "category": "network-exposure", "why": "The knowledge base cannot decide \"route-destinations\" of the aws.route_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_route_table.public|route-destinations" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the destinations of the routes for module.vpc.module.vpc.aws_route_table.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ROUTE-TABLE-ROUTE-TARGETS", "kind": "route-targets", "family": "aws.route_table", "title": "Confirm the targets of the routes", "block": "route", "category": "network-exposure", "why": "The knowledge base cannot decide \"route-targets\" of the aws.route_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_route_table.public|route-targets" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the targets of the routes for module.vpc.module.vpc.aws_route_table.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ROUTE-TABLE-ROUTES", "kind": "routes", "family": "aws.route_table", "title": "Re-create the routes with STACKIT next hops", "block": "route", "category": "network-exposure", "why": "The knowledge base cannot decide \"routes\" of the aws.route_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_route_table.public|routes" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Re-create the routes with STACKIT next hops for module.vpc.module.vpc.aws_route_table.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ROUTE-TABLE-TCR-ROUTE-TABLE-VPC-ID", "kind": "tcr-route-table-vpc-id", "family": "aws.route_table", "title": "Confirm the network of the route table", "block": "vpc_id", "category": "network-exposure", "why": "The knowledge base cannot decide \"tcr-route-table-vpc-id\" of the aws.route_table contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_route_table.public|tcr-route-table-vpc-id" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "EVIDENCE_GAP", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the network of the route table for module.vpc.module.vpc.aws_route_table.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC", "source_family": "aws.route_table", "source_semantic": "unit-review", "affected_units": [ "module.vpc.module.vpc.aws_route_table.public" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "routing-architecture", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm the destinations of the routes; the 5 settings of the record state their own.", "source_observation": "The source states 5 critical settings on module.vpc.module.vpc.aws_route_table.public that the knowledge base cannot decide: Confirm that the project is the boundary of one network; Confirm the destinations of the routes; Confirm the targets of the routes; Re-create the routes with STACKIT next hops; Confirm the network of the route table.", "generated_target_behavior": "Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the destinations of the routes: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings). A table whose routes all go to an internet gateway is replaced by STACKIT's default routing and no table is drafted, with the precondition that the project is created outside a Network Area (the plan's statement that no routing table is drafted). A custom table is drafted as a stackit_routing_table of a Network Area with the routes it can carry; every other route is named \"not carried\" in the Terraform comments. Confirm the targets of the routes: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings). A table whose routes all go to an internet gateway is replaced by STACKIT's default routing and no table is drafted, with the precondition that the project is created outside a Network Area (the plan's statement that no routing table is drafted). A custom table is drafted as a stackit_routing_table of a Network Area with the routes it can carry; every other route is named \"not carried\" in the Terraform comments. Re-create the routes with STACKIT next hops: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings). A table whose routes all go to an internet gateway is replaced by STACKIT's default routing and no table is drafted, with the precondition that the project is created outside a Network Area (the plan's statement that no routing table is drafted). A custom table is drafted as a stackit_routing_table of a Network Area with the routes it can carry; every other route is named \"not carried\" in the Terraform comments. Confirm the network of the route table: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings). With one VPC the project stands for it and the default routing applies (nothing drafted); a custom table is drafted at Network Area scope.", "residual_difference": "Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the destinations of the routes: That the target networks reach what the source routes reached and nothing more: the default routing of a Network Area was never read, and the equivalence outside an area was observed in one STACKIT test project only. Confirm the targets of the routes: That the target networks reach what the source routes reached and nothing more: the default routing of a Network Area was never read, and the equivalence outside an area was observed in one STACKIT test project only. Re-create the routes with STACKIT next hops: That the target networks reach what the source routes reached and nothing more: the default routing of a Network Area was never read, and the equivalence outside an area was observed in one STACKIT test project only. Confirm the network of the route table: Which STACKIT networks the routing rules govern.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings now.", "next_action": "Confirm the destinations of the routes: Confirm the destinations of the routes for module.vpc.module.vpc.aws_route_table.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this route table included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.", "Confirm the destinations of the routes: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Destinations are read by value: every route of a default-only table sends 0.0.0.0/0 to an internet or NAT gateway — STACKIT's default network routing, observed equivalent for a draft outside a Network Area (the test of 2026-10-10) and REVIEW all the same.", "Confirm the targets of the routes: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The next hop of each route of the table: a route whose target is anything but an internet or NAT gateway, or that names none, makes the table a custom routing table.", "Re-create the routes with STACKIT next hops: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Custom routes map to stackit_routing_table_route, an experimental resource (experiment routing-tables); next hops that name AWS gateways are chosen anew.", "Confirm the network of the route table: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). aws_route_table.vpc_id: The VPC whose subnets this route table's rules apply to; a route table's entries only make sense, and only affect reachability, within this one VPC, so losing or mismapping it silently changes which network the routing rules govern. A custom table is REVIEW whatever the estate: the draft's stackit_routing_table is organisation and Network Area scoped (organization_id, network_area_id, pinned provider), not a resource of the project that is the VPC's boundary (the experimental stackit_vpc_routing_table, pinned provider: project_id, vpc_id, is a VPC-scoped table that the draft does not write and that nothing establishes as the counterpart of an AWS route table), so which networks the table governs is decided by the Network Area the person puts the project in and the routing_table_id each network is given. A table the draft does not make (count or for_each) and one left to the architect are REVIEW. Several VPCs, a VPC count that is not visible, or a vpc_id (this table's or another unit's) that is a literal, a variable, a data source or an expression the scan cannot reduce to the estate's VPC: which routing domain the table belongs to is the architect's decision — REVIEW. Held CRITICAL: it decides which networks, clients or endpoints reach the resource or what it reaches." ], "closes_when": [ "Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Confirm the destinations of the routes: A person confirms every route destination that is not the default route to an internet or NAT gateway (a CIDR, a prefix list, any IPv6 route): the draft carries none, and a specific destination needs a stackit_routing_table_route, which takes IPv4 CIDR destinations only.", "Confirm the targets of the routes: A person decides the next hop of each route on STACKIT: an internet gateway becomes the next hop internet, an appliance (a network interface or an instance) a next hop of type ipv4. A NAT gateway, a transit gateway or a VPC peering has no STACKIT counterpart, so the connectivity design is the person's.", "Re-create the routes with STACKIT next hops: A person creates the routes on the STACKIT routing table (stackit_routing_table_route, experimental) and chooses the next hops anew, because they name AWS gateways.", "Confirm the network of the route table: A person decides which STACKIT networks the routing table governs: the draft's custom table is organisation and Network Area scoped, so the Network Area the project joins and the routing table each network is given decide it.", "Confirm the network of the route table: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which STACKIT networks the routing table governs: the draft's custom table is organisation and Network Area scoped, so the Network Area the project joins and the routing table each network is given decide it." ], "required_inputs": [], "resolution_paths": [ { "id": "network-topology-boundary/verify-on-target", "title": "Confirm that the project is the boundary of one network: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.route_table/edge-association: \"Ingress routing of the traffic entering through a gateway (aws_route_table_association gateway_id, AWS::EC2::GatewayRouteTableAssociation); no STACKIT counterpart is evidenced in the pinned provider.\"" ], "regeneration_required": true }, { "id": "route-destinations/keep-default-routing-outside-area", "title": "Confirm the destinations of the routes: Keep STACKIT's default routing in a project outside a Network Area", "prerequisites": [ "every route of the table sends traffic to an internet gateway (a default-only table)", "the target project is created outside a Network Area" ], "effects": [ "No routing table is written; every network reaches the internet through source NAT and the networks of the project reach each other." ], "risk": [ "A server without a public IP gains outbound internet through the network's shared address, which the source's internet gateway did not give it." ], "evidence": [ "decision kind stackitroute.NAT_FIXED_EGRESS_ADDRESS_LOST of the knowledge base: \"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading.\"", "a test on a STACKIT project on 2026-10-10: \"Observed: the address a server leaves by follows its NIC's public IP (own address) or, without one, the network's `publicIp`\"", "a test on a STACKIT project on 2026-10-10: \"Not inferred: a routing table. The API shows none and the probe makes no statement about the table of a Network Area; only that the connectivity exists without one in this project.\"" ], "regeneration_required": false }, { "id": "route-destinations/draft-a-routing-table-in-a-network-area", "title": "Confirm the destinations of the routes: Place the workload in a Network Area and carry the routes in a routing table", "prerequisites": [ "a Network Area for the target project (an organisation-level decision; whether a project can join an area after creation is not stated in the sources read)", "the complete route set, with a STACKIT next hop for each route" ], "effects": [ "A stackit_routing_table with stackit_routing_table_route resources (IPv4 CIDR destinations only) is assigned to the routed networks." ], "risk": [ "The resource is experimental and may change; IPv6 routes and routes to NAT, transit or peering targets have no counterpart." ], "evidence": [ "STACKIT provider schema 0.120.0: \"This resource is for SNA, not VPC, based networks.\"", "STACKIT provider schema 0.120.0: \"is part of the experimental feature routing-tables\"", "STACKIT provider schema 0.120.0: \"Only `cidrv4` is supported during experimental stage.\"", "STACKIT provider schema 0.120.0: \"Type of the next hop. Possible values are: `blackhole`, `internet`, `ipv4`, `ipv6`.\"", "decision kind stackitroute.route-set of the knowledge base: \"Each STACKIT Network Area includes one default routing table. STACKIT creates this table automatically when you create a new environment. All routed networks follow the default table unless you assign a different one.\"" ], "regeneration_required": true }, { "id": "route-targets/keep-default-routing-outside-area", "title": "Confirm the targets of the routes: Keep STACKIT's default routing in a project outside a Network Area", "prerequisites": [ "every route of the table sends traffic to an internet gateway (a default-only table)", "the target project is created outside a Network Area" ], "effects": [ "No routing table is written; every network reaches the internet through source NAT and the networks of the project reach each other." ], "risk": [ "A server without a public IP gains outbound internet through the network's shared address, which the source's internet gateway did not give it." ], "evidence": [ "decision kind stackitroute.NAT_FIXED_EGRESS_ADDRESS_LOST of the knowledge base: \"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading.\"", "a test on a STACKIT project on 2026-10-10: \"Observed: the address a server leaves by follows its NIC's public IP (own address) or, without one, the network's `publicIp`\"", "a test on a STACKIT project on 2026-10-10: \"Not inferred: a routing table. The API shows none and the probe makes no statement about the table of a Network Area; only that the connectivity exists without one in this project.\"" ], "regeneration_required": false }, { "id": "route-targets/draft-a-routing-table-in-a-network-area", "title": "Confirm the targets of the routes: Place the workload in a Network Area and carry the routes in a routing table", "prerequisites": [ "a Network Area for the target project (an organisation-level decision; whether a project can join an area after creation is not stated in the sources read)", "the complete route set, with a STACKIT next hop for each route" ], "effects": [ "A stackit_routing_table with stackit_routing_table_route resources (IPv4 CIDR destinations only) is assigned to the routed networks." ], "risk": [ "The resource is experimental and may change; IPv6 routes and routes to NAT, transit or peering targets have no counterpart." ], "evidence": [ "STACKIT provider schema 0.120.0: \"This resource is for SNA, not VPC, based networks.\"", "STACKIT provider schema 0.120.0: \"is part of the experimental feature routing-tables\"", "STACKIT provider schema 0.120.0: \"Only `cidrv4` is supported during experimental stage.\"", "STACKIT provider schema 0.120.0: \"Type of the next hop. Possible values are: `blackhole`, `internet`, `ipv4`, `ipv6`.\"", "decision kind stackitroute.route-set of the knowledge base: \"Each STACKIT Network Area includes one default routing table. STACKIT creates this table automatically when you create a new environment. All routed networks follow the default table unless you assign a different one.\"" ], "regeneration_required": true }, { "id": "routes/keep-default-routing-outside-area", "title": "Re-create the routes with STACKIT next hops: Keep STACKIT's default routing in a project outside a Network Area", "prerequisites": [ "every route of the table sends traffic to an internet gateway (a default-only table)", "the target project is created outside a Network Area" ], "effects": [ "No routing table is written; every network reaches the internet through source NAT and the networks of the project reach each other." ], "risk": [ "A server without a public IP gains outbound internet through the network's shared address, which the source's internet gateway did not give it." ], "evidence": [ "decision kind stackitroute.NAT_FIXED_EGRESS_ADDRESS_LOST of the knowledge base: \"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading.\"", "a test on a STACKIT project on 2026-10-10: \"Observed: the address a server leaves by follows its NIC's public IP (own address) or, without one, the network's `publicIp`\"", "a test on a STACKIT project on 2026-10-10: \"Not inferred: a routing table. The API shows none and the probe makes no statement about the table of a Network Area; only that the connectivity exists without one in this project.\"" ], "regeneration_required": false }, { "id": "routes/draft-a-routing-table-in-a-network-area", "title": "Re-create the routes with STACKIT next hops: Place the workload in a Network Area and carry the routes in a routing table", "prerequisites": [ "a Network Area for the target project (an organisation-level decision; whether a project can join an area after creation is not stated in the sources read)", "the complete route set, with a STACKIT next hop for each route" ], "effects": [ "A stackit_routing_table with stackit_routing_table_route resources (IPv4 CIDR destinations only) is assigned to the routed networks." ], "risk": [ "The resource is experimental and may change; IPv6 routes and routes to NAT, transit or peering targets have no counterpart." ], "evidence": [ "STACKIT provider schema 0.120.0: \"This resource is for SNA, not VPC, based networks.\"", "STACKIT provider schema 0.120.0: \"is part of the experimental feature routing-tables\"", "STACKIT provider schema 0.120.0: \"Only `cidrv4` is supported during experimental stage.\"", "STACKIT provider schema 0.120.0: \"Type of the next hop. Possible values are: `blackhole`, `internet`, `ipv4`, `ipv6`.\"", "decision kind stackitroute.route-set of the knowledge base: \"Each STACKIT Network Area includes one default routing table. STACKIT creates this table automatically when you create a new environment. All routed networks follow the default table unless you assign a different one.\"" ], "regeneration_required": true }, { "id": "tcr-route-table-vpc-id/one-project-per-vpc", "title": "Confirm the network of the route table: Keep one project per VPC with STACKIT's default routing", "prerequisites": [ "one VPC in the estate", "the project created outside a Network Area" ], "effects": [ "The project's networks are the VPC's subnets; no table is written." ], "risk": [ "As for the routes of the table: the default routing is observed equivalent only outside a Network Area." ], "evidence": [ "contract note aws.route_table/tcr-route-table-vpc-id: \"the project the draft creates is that VPC's boundary\"" ], "regeneration_required": false }, { "id": "tcr-route-table-vpc-id/assign-the-table-to-networks", "title": "Confirm the network of the route table: Assign the routing table to the networks of the Network Area it should govern", "prerequisites": [ "the Network Area the project joins", "the networks that take the table" ], "effects": [ "Each network that takes the table carries its id; a table is assigned per network, there is no per-subnet association." ], "risk": [ "A network left without the table follows the area's default table." ], "evidence": [ "STACKIT provider schema 0.120.0: \"The ID of the routing table associated with the network.\"" ], "regeneration_required": true } ], "required_verification": [ "Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result", "Confirm the destinations of the routes: reachability observed on the target: the internet, the other networks, and nothing the source did not reach", "Confirm the targets of the routes: reachability observed on the target: the internet, the other networks, and nothing the source did not reach", "Re-create the routes with STACKIT next hops: reachability observed on the target: the internet, the other networks, and nothing the source did not reach", "Confirm the network of the route table: the routing of each target network observed on the target" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes.", "Nothing from an answer: no input topic carries routes. A bound target environment that places the project in a Network Area, or states an egress other than STACKIT's default routing, reopens the default-routing equivalence (see the plan's statement that no routing table is drafted).", "Nothing from an answer: no input topic carries a Network Area; a bound target environment's placement changes what the draft writes for routing." ], "remains_manual": [ "Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.", "Confirm the destinations of the routes: Manual work remains: a person closes the semantic, the draft does not.", "Confirm the targets of the routes: Manual work remains: a person closes the semantic, the draft does not.", "Re-create the routes with STACKIT next hops: Manual work remains: a person closes the semantic, the draft does not.", "Confirm the network of the route table: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.route_table/edge-association: \"Ingress routing of the traffic entering through a gateway (aws_route_table_association gateway_id, AWS::EC2::GatewayRouteTableAssociation); no STACKIT counterpart is evidenced in the pinned provider.\"", "contract note aws.route_table/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"", "contract note aws.route_table/route-set-completeness: \"A person confirms that nothing outside the scan adds routes to the table (a virtual private gateway propagation, a route server, a route a variable switches on, a route type the scan does not model), or lists those routes.\"", "contract note aws.route_table/vpn-propagation: \"Non-empty propagating_vgws (or a propagation resource) is REVIEW.\"", "contract note aws.route_table/routes: \"Custom routes map to stackit_routing_table_route, an experimental resource (experiment routing-tables); next hops that name AWS gateways are chosen anew.\"", "provider-docs mirror stackit/docs.stackit.cloud/products/network/core-networking/network-area/faq.html: \"Currently we do not support this, however there are plans to enable this in the future.\"", "contract note aws.route_table/tcr-route-table-vpc-id: \"The VPC whose subnets this route table's rules apply to;\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings", "mode": "MANUAL", "phase": "FOUNDATION", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB", "kind": "unit-review", "family": "aws.secretsmanager_secret", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret", "block": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db", "artifact": "assessment.json", "pointer": "/units/35" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db|tc-secretsmanager-secret-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/95" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db", "artifact": "workspace.json", "pointer": "/units/30/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:195cb41bddbb96ebcec7e0f37d5f2f429896503f4ae7885eefe450c77faddf70", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.secretsmanager_secret/tc-secretsmanager-secret-name", "sha256": "sha256:6185b621cdae56c783b268125596b6326e0c0a76e292e8ff41a13b3a056dbb11" }, { "kind": "review_cause", "id": "aws.secretsmanager_secret/tc-secretsmanager-secret-name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:d5232f8c08470d7e2cf4d3f67d0a00b792688bf01cef4afeff71224246f0836f" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-8a0bbd0646ff", "subject": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db", "resolution": { "decision_id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB", "source_family": "aws.secretsmanager_secret", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db" ], "affected_application": [], "action_type": "VERIFY_BEHAVIOR", "work_package": "identity-access-secrets", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "REQUIRES_VERIFICATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB", "kind": "unit-review", "family": "aws.secretsmanager_secret", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret", "block": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db", "artifact": "assessment.json", "pointer": "/units/35" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db|customer-managed-key", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/93" }, { "kind": "semantic", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db|secret-value", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/94" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db", "artifact": "workspace.json", "pointer": "/units/30/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:3648ebb527da2bc96efc5425a387853eeeef8b1af4da2208b4326214e2fe9417", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.secretsmanager_secret/customer-managed-key", "sha256": "sha256:e266df2256bf4f5dd062e2c4ee71cad0a19c0d2539d263e199d7dba78d59490a" }, { "kind": "contract_semantic", "id": "aws.secretsmanager_secret/secret-value", "sha256": "sha256:4786569b41989b14c7810e6dfcff6b03a5deecdefc8a587eb8a4b4182a854061" }, { "kind": "decision_kind", "id": "aws.secretsmanager_secret/customer-managed-key", "sha256": "sha256:dcbbb474ee184b8eeaccd6b987aaf60321354c5006e833292cfa4fa7d4f7e5e3" }, { "kind": "review_cause", "id": "aws.secretsmanager_secret/customer-managed-key", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.secretsmanager_secret/secret-value", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:78742954fe6dab86c51d83509ed0f5019df417f550f7490b99d91c52b676823d" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-7025c7c4ba2c", "subject": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db", "resolution": { "decision_id": "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB", "source_family": "aws.secretsmanager_secret", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "identity-access-secrets", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E", "kind": "unit-review", "family": "aws.secretsmanager_secret", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret", "block": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch", "artifact": "assessment.json", "pointer": "/units/9" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch|tc-secretsmanager-secret-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/98" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch", "artifact": "workspace.json", "pointer": "/units/31/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:2073dd961a032b84b2d9831d3f75f110a2575f042a5ea8c79798030c3da3245d", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.secretsmanager_secret/tc-secretsmanager-secret-name", "sha256": "sha256:6185b621cdae56c783b268125596b6326e0c0a76e292e8ff41a13b3a056dbb11" }, { "kind": "review_cause", "id": "aws.secretsmanager_secret/tc-secretsmanager-secret-name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:d5232f8c08470d7e2cf4d3f67d0a00b792688bf01cef4afeff71224246f0836f" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-8a0bbd0646ff", "subject": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch", "resolution": { "decision_id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E", "source_family": "aws.secretsmanager_secret", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch" ], "affected_application": [], "action_type": "VERIFY_BEHAVIOR", "work_package": "identity-access-secrets", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "REQUIRES_VERIFICATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E", "kind": "unit-review", "family": "aws.secretsmanager_secret", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret", "block": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch", "artifact": "assessment.json", "pointer": "/units/9" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch|customer-managed-key", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/96" }, { "kind": "semantic", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch|secret-value", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/97" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch", "artifact": "workspace.json", "pointer": "/units/31/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:ae17628c8cbe0ab8697ae4bb2880130aeee40989541c8f0376736190f705f513", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.secretsmanager_secret/customer-managed-key", "sha256": "sha256:e266df2256bf4f5dd062e2c4ee71cad0a19c0d2539d263e199d7dba78d59490a" }, { "kind": "contract_semantic", "id": "aws.secretsmanager_secret/secret-value", "sha256": "sha256:4786569b41989b14c7810e6dfcff6b03a5deecdefc8a587eb8a4b4182a854061" }, { "kind": "decision_kind", "id": "aws.secretsmanager_secret/customer-managed-key", "sha256": "sha256:dcbbb474ee184b8eeaccd6b987aaf60321354c5006e833292cfa4fa7d4f7e5e3" }, { "kind": "review_cause", "id": "aws.secretsmanager_secret/customer-managed-key", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.secretsmanager_secret/secret-value", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:78742954fe6dab86c51d83509ed0f5019df417f550f7490b99d91c52b676823d" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-7025c7c4ba2c", "subject": "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch", "resolution": { "decision_id": "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E", "source_family": "aws.secretsmanager_secret", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "identity-access-secrets", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ", "kind": "unit-review", "family": "aws.secretsmanager_secret", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret", "block": "module.retail_app_ecs.aws_secretsmanager_secret.mq", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_secretsmanager_secret.mq", "artifact": "assessment.json", "pointer": "/units/36" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.aws_secretsmanager_secret.mq|tc-secretsmanager-secret-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/100" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_secretsmanager_secret.mq", "artifact": "workspace.json", "pointer": "/units/32/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:5fe5a2647141b1c84f8d6ebec8419e93f5cdd3bf7608a08434c32b8983acd76f", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.secretsmanager_secret/tc-secretsmanager-secret-name", "sha256": "sha256:6185b621cdae56c783b268125596b6326e0c0a76e292e8ff41a13b3a056dbb11" }, { "kind": "review_cause", "id": "aws.secretsmanager_secret/tc-secretsmanager-secret-name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:d5232f8c08470d7e2cf4d3f67d0a00b792688bf01cef4afeff71224246f0836f" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-8a0bbd0646ff", "subject": "module.retail_app_ecs.aws_secretsmanager_secret.mq", "resolution": { "decision_id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ", "source_family": "aws.secretsmanager_secret", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.aws_secretsmanager_secret.mq" ], "affected_application": [], "action_type": "VERIFY_BEHAVIOR", "work_package": "identity-access-secrets", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "REQUIRES_VERIFICATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ", "kind": "unit-review", "family": "aws.secretsmanager_secret", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret", "block": "module.retail_app_ecs.aws_secretsmanager_secret.mq", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_secretsmanager_secret.mq", "artifact": "assessment.json", "pointer": "/units/36" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.aws_secretsmanager_secret.mq|secret-value", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/99" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_secretsmanager_secret.mq", "artifact": "workspace.json", "pointer": "/units/32/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:3ae1d83437aa0047401e57a727c9c83c53c975e37cb2489aa208cb01e090a9e2", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.secretsmanager_secret/secret-value", "sha256": "sha256:4786569b41989b14c7810e6dfcff6b03a5deecdefc8a587eb8a4b4182a854061" }, { "kind": "review_cause", "id": "aws.secretsmanager_secret/secret-value", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:2cb4b0d96b051195c608023373e582242e4e572c53cb74b1e20d6dda98e3ac19" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-3ef4cfa13ede", "subject": "module.retail_app_ecs.aws_secretsmanager_secret.mq", "resolution": { "decision_id": "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ", "source_family": "aws.secretsmanager_secret", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.aws_secretsmanager_secret.mq" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "identity-access-secrets", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB", "kind": "unit-review", "family": "aws.secretsmanager_secret", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret", "block": "module.retail_app_ecs.aws_secretsmanager_secret.orders_db", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_secretsmanager_secret.orders_db", "artifact": "assessment.json", "pointer": "/units/37" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.aws_secretsmanager_secret.orders_db|tc-secretsmanager-secret-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/102" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_secretsmanager_secret.orders_db", "artifact": "workspace.json", "pointer": "/units/33/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:0e7d0853832152461beef7d325cf888b63bc96f93367ca9eaa967f2a0d8d046d", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.secretsmanager_secret/tc-secretsmanager-secret-name", "sha256": "sha256:6185b621cdae56c783b268125596b6326e0c0a76e292e8ff41a13b3a056dbb11" }, { "kind": "review_cause", "id": "aws.secretsmanager_secret/tc-secretsmanager-secret-name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:d5232f8c08470d7e2cf4d3f67d0a00b792688bf01cef4afeff71224246f0836f" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-8a0bbd0646ff", "subject": "module.retail_app_ecs.aws_secretsmanager_secret.orders_db", "resolution": { "decision_id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB", "source_family": "aws.secretsmanager_secret", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.aws_secretsmanager_secret.orders_db" ], "affected_application": [], "action_type": "VERIFY_BEHAVIOR", "work_package": "identity-access-secrets", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "REQUIRES_VERIFICATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB", "kind": "unit-review", "family": "aws.secretsmanager_secret", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret", "block": "module.retail_app_ecs.aws_secretsmanager_secret.orders_db", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_secretsmanager_secret.orders_db", "artifact": "assessment.json", "pointer": "/units/37" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.aws_secretsmanager_secret.orders_db|secret-value", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/101" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_secretsmanager_secret.orders_db", "artifact": "workspace.json", "pointer": "/units/33/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:d75d1a13db1394da7b51b43ba4b0a2e89b879d6a844416890877de4f2206469c", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.secretsmanager_secret/secret-value", "sha256": "sha256:4786569b41989b14c7810e6dfcff6b03a5deecdefc8a587eb8a4b4182a854061" }, { "kind": "review_cause", "id": "aws.secretsmanager_secret/secret-value", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:2cb4b0d96b051195c608023373e582242e4e572c53cb74b1e20d6dda98e3ac19" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-3ef4cfa13ede", "subject": "module.retail_app_ecs.aws_secretsmanager_secret.orders_db", "resolution": { "decision_id": "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB", "source_family": "aws.secretsmanager_secret", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.aws_secretsmanager_secret.orders_db" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "identity-access-secrets", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG", "kind": "unit-review", "family": "aws.security_group", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.security_group", "block": "module.dependencies.aws_security_group.catalog_opensearch_sg", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.aws_security_group.catalog_opensearch_sg", "artifact": "assessment.json", "pointer": "/units/23" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.aws_security_group.catalog_opensearch_sg|egress-restriction", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/8" }, { "kind": "semantic", "id": "module.dependencies.aws_security_group.catalog_opensearch_sg|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/9" }, { "kind": "semantic", "id": "module.dependencies.aws_security_group.catalog_opensearch_sg|security-group-vpc-membership", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/10" }, { "kind": "semantic", "id": "module.dependencies.aws_security_group.catalog_opensearch_sg|standalone-rule-not-generated", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/11" }, { "kind": "semantic", "id": "module.dependencies.aws_security_group.catalog_opensearch_sg|standalone-rule-remote-not-resolved", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/12" }, { "kind": "semantic", "id": "module.dependencies.aws_security_group.catalog_opensearch_sg|stateful", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/13" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.aws_security_group.catalog_opensearch_sg", "artifact": "workspace.json", "pointer": "/units/1/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:20e99159b8d629dc059056933c714a05c8d0553031578feda2e55da35374d1f9", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.security_group/egress-restriction", "sha256": "sha256:ee33bb5b56478f8119db73947a66f795c4e24097c007aff14fa77451bba5cc7b" }, { "kind": "contract_semantic", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:c8824eb65543cfc382c99c099d77d5d7291c5fc07590661da816e8dba0ce8471" }, { "kind": "contract_semantic", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:f495d36ce1e83560500515e818008c473b8ce061be346c1cb6c738f0ff309fa5" }, { "kind": "contract_semantic", "id": "aws.security_group/standalone-rule-not-generated", "sha256": "sha256:04f5946c48640c669f5eeb03c7fc54f86c19377f7bad27c54692e9a1c280d4df" }, { "kind": "contract_semantic", "id": "aws.security_group/standalone-rule-remote-not-resolved", "sha256": "sha256:8cef2f5e2a7c265bc2122e94cee09d6938cc70af3283406d466ff7c168ba32be" }, { "kind": "contract_semantic", "id": "aws.security_group/stateful", "sha256": "sha256:ab8c9d2756e808e25dc5cc3edc00f6660e627e57b5d111df80cc426b4a2ad49a" }, { "kind": "review_cause", "id": "aws.security_group/egress-restriction", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/standalone-rule-not-generated", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/standalone-rule-remote-not-resolved", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/stateful", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:d123567a803a2c8c7613313b73d5e4c1f379e350b836349b8483d3601048ce69" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "TARGET_LIMIT", "members": 2 }, { "cause": "DEPENDS_ON_UNIT", "members": 2 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 6 critical settings of module.dependencies.aws_security_group.catalog_opensearch_sg: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-SECURITY-GROUP-EGRESS-RESTRICTION", "kind": "egress-restriction", "family": "aws.security_group", "title": "Decide the outbound (egress) rules of the security group", "block": "egress", "category": "network-exposure", "why": "The knowledge base cannot decide \"egress-restriction\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_security_group.catalog_opensearch_sg|egress-restriction" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.dependencies.aws_security_group.catalog_opensearch_sg: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-NETWORK-TOPOLOGY-BOUNDARY", "kind": "network-topology-boundary", "family": "aws.security_group", "title": "Confirm that the project is the boundary of one network", "block": "network-topology-boundary", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-topology-boundary\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_security_group.catalog_opensearch_sg|network-topology-boundary" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.dependencies.aws_security_group.catalog_opensearch_sg: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-SECURITY-GROUP-VPC-MEMBERSHIP", "kind": "security-group-vpc-membership", "family": "aws.security_group", "title": "Decide which networks the security group may be attached to (a STACKIT group has no network scope)", "block": "vpc_id", "category": "network-exposure", "why": "The knowledge base cannot decide \"security-group-vpc-membership\" of the aws.security_group contract for 1 unit (UNSUPPORTED): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_security_group.catalog_opensearch_sg|security-group-vpc-membership" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-NOT-GENERATED", "kind": "standalone-rule-not-generated", "family": "aws.security_group", "title": "Review the standalone rule not generated setting", "block": "standalone-rule-not-generated", "category": "network-exposure", "why": "The knowledge base cannot decide \"standalone-rule-not-generated\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_security_group.catalog_opensearch_sg|standalone-rule-not-generated" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the standalone rule not generated setting for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-REMOTE-NOT-RESOLVED", "kind": "standalone-rule-remote-not-resolved", "family": "aws.security_group", "title": "Review the standalone rule remote not resolved setting", "block": "standalone-rule-remote-not-resolved", "category": "network-exposure", "why": "The knowledge base cannot decide \"standalone-rule-remote-not-resolved\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_security_group.catalog_opensearch_sg|standalone-rule-remote-not-resolved" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the standalone rule remote not resolved setting for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STATEFUL", "kind": "stateful", "family": "aws.security_group", "title": "Review the stateful setting", "block": "stateful", "category": "network-exposure", "why": "The knowledge base cannot decide \"stateful\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_security_group.catalog_opensearch_sg|stateful" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the stateful setting for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG", "source_family": "aws.security_group", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.aws_security_group.catalog_opensearch_sg" ], "affected_application": [], "action_type": "VERIFY_BEHAVIOR", "work_package": "network-security", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, UNSUPPORTED", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the execution plan refuses REF/root/security-group-membership-parity because the target has no counterpart for the setting: a person accepts the difference or redesigns, and the step stays refused This is the state of the setting of this unit that asks the most, Decide which networks the security group may be attached to (a STACKIT group has no network scope); the 6 settings of the record state their own.", "source_observation": "The source states 6 critical settings on module.dependencies.aws_security_group.catalog_opensearch_sg that the knowledge base cannot decide: Decide the outbound (egress) rules of the security group; Confirm that the project is the boundary of one network; Decide which networks the security group may be attached to (a STACKIT group has no network scope); Review the standalone rule not generated setting; Review the standalone rule remote not resolved setting; Review the stateful setting.", "generated_target_behavior": "Decide the outbound (egress) rules of the security group: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg. The plan refuses REF/root/security-group-membership-parity. In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the standalone rule not generated setting: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings). Review the standalone rule remote not resolved setting: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings). Review the stateful setting: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings).", "residual_difference": "Decide the outbound (egress) rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the standalone rule not generated setting: the target behaviour of this setting is not established Review the standalone rule remote not resolved setting: the target behaviour of this setting is not established Review the stateful setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. Held by something else first: REF/root/security-group-membership-parity.", "next_action": "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Decide the outbound (egress) rules of the security group: A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.", "Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.", "Review the standalone rule not generated setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An aws_security_group_rule the draft does not generate (the draft names its settings NOT CARRIED, or the KB cannot decide that it generates it): a prefix list, an ICMP type with every code, ICMPv6 limited by type or code, a protocol with no STACKIT counterpart, a source or protocol or port not visible statically, a source group that is not one whole reference to a security group of the draft, or a repeated or conditionally created group. A person re-creates the rule with the STACKIT range or group it needs (a rule is never widened: a stackit_security_group_rule without source allows every address, pinned provider) - REVIEW, per rule.", "Review the standalone rule remote not resolved setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source of a standalone security group rule: the other security group (source_security_group_id) whose members the rule lets in.", "Review the stateful setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true)." ], "closes_when": [ "Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.", "Review the standalone rule not generated setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the standalone rule remote not resolved setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A person re-creates the rule with the STACKIT security group or address range it needs; the draft does not widen it (a stackit_security_group_rule without a source allows everything, pinned provider).", "Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference." ], "required_inputs": [], "resolution_paths": [ { "id": "egress-restriction/verify-on-target", "title": "Decide the outbound (egress) rules of the security group: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true }, { "id": "network-topology-boundary/bring-the-closing-evidence", "title": "Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "regeneration_required": true }, { "id": "security-group-vpc-membership/verify-on-target", "title": "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true } ], "required_verification": [ "Decide the outbound (egress) rules of the security group: the check, proof or closing evidence is recorded with its result", "Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Decide the outbound (egress) rules of the security group: Manual work remains: a person closes the semantic, the draft does not.", "Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"", "contract note aws.security_group/ingress-sources: \"cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).\"", "contract note aws.security_group/rule-ports: \"Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).\"", "contract note aws.security_group/security-group-vpc-membership: \"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.\"", "contract note aws.security_group/vpc-egress-rules: \"As vpc ingress rules (direction egress).\"", "contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false }, { "id": "REF/root/security-group-membership-parity", "mode": "REFUSE", "phase": "SECURITY", "executable": false, "waits_for_this": false } ] } }, { "id": "DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ", "kind": "unit-review", "family": "aws.security_group", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.security_group", "block": "module.dependencies.aws_security_group.mq", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.aws_security_group.mq", "artifact": "assessment.json", "pointer": "/units/24" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.aws_security_group.mq|egress-restriction", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/14" }, { "kind": "semantic", "id": "module.dependencies.aws_security_group.mq|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/15" }, { "kind": "semantic", "id": "module.dependencies.aws_security_group.mq|security-group-vpc-membership", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/16" }, { "kind": "semantic", "id": "module.dependencies.aws_security_group.mq|standalone-rule-not-generated", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/17" }, { "kind": "semantic", "id": "module.dependencies.aws_security_group.mq|stateful", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/18" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.aws_security_group.mq", "artifact": "workspace.json", "pointer": "/units/2/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:8c5aaa45532d67ee2d6bcb3a9534148642f01d37c523570686e3fd349d2dee8b", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.security_group/egress-restriction", "sha256": "sha256:ee33bb5b56478f8119db73947a66f795c4e24097c007aff14fa77451bba5cc7b" }, { "kind": "contract_semantic", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:c8824eb65543cfc382c99c099d77d5d7291c5fc07590661da816e8dba0ce8471" }, { "kind": "contract_semantic", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:f495d36ce1e83560500515e818008c473b8ce061be346c1cb6c738f0ff309fa5" }, { "kind": "contract_semantic", "id": "aws.security_group/standalone-rule-not-generated", "sha256": "sha256:04f5946c48640c669f5eeb03c7fc54f86c19377f7bad27c54692e9a1c280d4df" }, { "kind": "contract_semantic", "id": "aws.security_group/stateful", "sha256": "sha256:ab8c9d2756e808e25dc5cc3edc00f6660e627e57b5d111df80cc426b4a2ad49a" }, { "kind": "review_cause", "id": "aws.security_group/egress-restriction", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/standalone-rule-not-generated", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/stateful", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:df7f82fa706407d358518a0ec2c5fb9e357107a7fe196fbbab5b9ee7685bcb0d" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "TARGET_LIMIT", "members": 2 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 5 critical settings of module.dependencies.aws_security_group.mq: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_security_group.mq/open-settings.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-SECURITY-GROUP-EGRESS-RESTRICTION", "kind": "egress-restriction", "family": "aws.security_group", "title": "Decide the outbound (egress) rules of the security group", "block": "egress", "category": "network-exposure", "why": "The knowledge base cannot decide \"egress-restriction\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_security_group.mq|egress-restriction" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.dependencies.aws_security_group.mq: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-NETWORK-TOPOLOGY-BOUNDARY", "kind": "network-topology-boundary", "family": "aws.security_group", "title": "Confirm that the project is the boundary of one network", "block": "network-topology-boundary", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-topology-boundary\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_security_group.mq|network-topology-boundary" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.dependencies.aws_security_group.mq: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-SECURITY-GROUP-VPC-MEMBERSHIP", "kind": "security-group-vpc-membership", "family": "aws.security_group", "title": "Decide which networks the security group may be attached to (a STACKIT group has no network scope)", "block": "vpc_id", "category": "network-exposure", "why": "The knowledge base cannot decide \"security-group-vpc-membership\" of the aws.security_group contract for 1 unit (UNSUPPORTED): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_security_group.mq|security-group-vpc-membership" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.aws_security_group.mq, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-NOT-GENERATED", "kind": "standalone-rule-not-generated", "family": "aws.security_group", "title": "Review the standalone rule not generated setting", "block": "standalone-rule-not-generated", "category": "network-exposure", "why": "The knowledge base cannot decide \"standalone-rule-not-generated\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_security_group.mq|standalone-rule-not-generated" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the standalone rule not generated setting for module.dependencies.aws_security_group.mq, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STATEFUL", "kind": "stateful", "family": "aws.security_group", "title": "Review the stateful setting", "block": "stateful", "category": "network-exposure", "why": "The knowledge base cannot decide \"stateful\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.aws_security_group.mq|stateful" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the stateful setting for module.dependencies.aws_security_group.mq, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ", "source_family": "aws.security_group", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.aws_security_group.mq" ], "affected_application": [], "action_type": "VERIFY_BEHAVIOR", "work_package": "network-security", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, UNSUPPORTED", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the execution plan refuses REF/root/security-group-membership-parity because the target has no counterpart for the setting: a person accepts the difference or redesigns, and the step stays refused This is the state of the setting of this unit that asks the most, Decide which networks the security group may be attached to (a STACKIT group has no network scope); the 5 settings of the record state their own.", "source_observation": "The source states 5 critical settings on module.dependencies.aws_security_group.mq that the knowledge base cannot decide: Decide the outbound (egress) rules of the security group; Confirm that the project is the boundary of one network; Decide which networks the security group may be attached to (a STACKIT group has no network scope); Review the standalone rule not generated setting; Review the stateful setting.", "generated_target_behavior": "Decide the outbound (egress) rules of the security group: The draft does not carry the setting on module.dependencies.aws_security_group.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.mq/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.dependencies.aws_security_group.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.mq/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.dependencies.aws_security_group.mq. The plan refuses REF/root/security-group-membership-parity. In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the standalone rule not generated setting: The draft does not carry the setting on module.dependencies.aws_security_group.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.mq/open-settings). Review the stateful setting: The draft does not carry the setting on module.dependencies.aws_security_group.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.mq/open-settings).", "residual_difference": "Decide the outbound (egress) rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the standalone rule not generated setting: the target behaviour of this setting is not established Review the stateful setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. Held by something else first: REF/root/security-group-membership-parity.", "next_action": "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.aws_security_group.mq, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Decide the outbound (egress) rules of the security group: A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.", "Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.", "Review the standalone rule not generated setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An aws_security_group_rule the draft does not generate (the draft names its settings NOT CARRIED, or the KB cannot decide that it generates it): a prefix list, an ICMP type with every code, ICMPv6 limited by type or code, a protocol with no STACKIT counterpart, a source or protocol or port not visible statically, a source group that is not one whole reference to a security group of the draft, or a repeated or conditionally created group. A person re-creates the rule with the STACKIT range or group it needs (a rule is never widened: a stackit_security_group_rule without source allows every address, pinned provider) - REVIEW, per rule.", "Review the stateful setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true)." ], "closes_when": [ "Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.", "Review the standalone rule not generated setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference." ], "required_inputs": [], "resolution_paths": [ { "id": "egress-restriction/verify-on-target", "title": "Decide the outbound (egress) rules of the security group: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true }, { "id": "network-topology-boundary/bring-the-closing-evidence", "title": "Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "regeneration_required": true }, { "id": "security-group-vpc-membership/verify-on-target", "title": "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true } ], "required_verification": [ "Decide the outbound (egress) rules of the security group: the check, proof or closing evidence is recorded with its result", "Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Decide the outbound (egress) rules of the security group: Manual work remains: a person closes the semantic, the draft does not.", "Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"", "contract note aws.security_group/ingress-sources: \"cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).\"", "contract note aws.security_group/rule-ports: \"Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).\"", "contract note aws.security_group/security-group-vpc-membership: \"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.\"", "contract note aws.security_group/vpc-egress-rules: \"As vpc ingress rules (direction egress).\"", "contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.aws_security_group.mq/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false }, { "id": "REF/root/security-group-membership-parity", "mode": "REFUSE", "phase": "SECURITY", "executable": false, "waits_for_this": false } ] } }, { "id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS", "kind": "unit-review", "family": "aws.security_group", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.security_group", "block": "module.dependencies.module.catalog_rds.aws_security_group.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.catalog_rds.aws_security_group.this", "artifact": "assessment.json", "pointer": "/units/25" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_security_group.this|egress-restriction", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/47" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_security_group.this|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/48" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_security_group.this|rule-ports", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/49" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_security_group.this|security-group-vpc-membership", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/50" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_security_group.this|standalone-rule-values", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/51" }, { "kind": "semantic", "id": "module.dependencies.module.catalog_rds.aws_security_group.this|stateful", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/52" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.catalog_rds.aws_security_group.this", "artifact": "workspace.json", "pointer": "/units/10/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:ecc068fbe9a8c1df8ea476fa3e0bcf0744ec368b08040242f186cb86c54b706c", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.security_group/egress-restriction", "sha256": "sha256:ee33bb5b56478f8119db73947a66f795c4e24097c007aff14fa77451bba5cc7b" }, { "kind": "contract_semantic", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:c8824eb65543cfc382c99c099d77d5d7291c5fc07590661da816e8dba0ce8471" }, { "kind": "contract_semantic", "id": "aws.security_group/rule-ports", "sha256": "sha256:bdc8cca0e8a80c3cb45417e7d8c9b784572da2265f40bd6ac47d974d8b303020" }, { "kind": "contract_semantic", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:f495d36ce1e83560500515e818008c473b8ce061be346c1cb6c738f0ff309fa5" }, { "kind": "contract_semantic", "id": "aws.security_group/standalone-rule-values", "sha256": "sha256:285a916e0c8e187b2ea8ac59156b486699e352e2fd4b286b6e270d62a89d68ae" }, { "kind": "contract_semantic", "id": "aws.security_group/stateful", "sha256": "sha256:ab8c9d2756e808e25dc5cc3edc00f6660e627e57b5d111df80cc426b4a2ad49a" }, { "kind": "review_cause", "id": "aws.security_group/egress-restriction", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.security_group/rule-ports", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/standalone-rule-values", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/stateful", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:5118b33aa50437bb44220519f1d54b70c83925a6a3a5950128f72ff4d74601a8" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "TARGET_LIMIT", "members": 2 }, { "cause": "DEPENDS_ON_UNIT", "members": 2 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-d431130ed2e0", "subject": "module.dependencies.module.catalog_rds.aws_security_group.this", "resolution": { "decision_id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS", "source_family": "aws.security_group", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.catalog_rds.aws_security_group.this" ], "affected_application": [], "action_type": "VERIFY_BEHAVIOR", "work_package": "network-security", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, UNSUPPORTED", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0", "kind": "unit-review", "family": "aws.security_group", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.security_group", "block": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd", "artifact": "assessment.json", "pointer": "/units/26" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/62" }, { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|rule-ports", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/63" }, { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|security-group-vpc-membership", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/64" }, { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-empty-sources", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/65" }, { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-other-sources", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/66" }, { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-values", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/67" }, { "kind": "semantic", "id": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|stateful", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/68" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd", "artifact": "workspace.json", "pointer": "/units/14/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:e2caf76ce6b00a72a5bb989dce3f951588e583a80dba6f2f2d83fa3a24d39303", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:c8824eb65543cfc382c99c099d77d5d7291c5fc07590661da816e8dba0ce8471" }, { "kind": "contract_semantic", "id": "aws.security_group/rule-ports", "sha256": "sha256:bdc8cca0e8a80c3cb45417e7d8c9b784572da2265f40bd6ac47d974d8b303020" }, { "kind": "contract_semantic", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:f495d36ce1e83560500515e818008c473b8ce061be346c1cb6c738f0ff309fa5" }, { "kind": "contract_semantic", "id": "aws.security_group/standalone-rule-empty-sources", "sha256": "sha256:7d52507b8aba7699b5e2fb7f9ac145ad4ed63e5d9abd03397490b39e75592b16" }, { "kind": "contract_semantic", "id": "aws.security_group/standalone-rule-other-sources", "sha256": "sha256:3ede30a615d32533e0a91dd3afd88ec8dcf5d9728e1e62b2aed80e01170df227" }, { "kind": "contract_semantic", "id": "aws.security_group/standalone-rule-values", "sha256": "sha256:285a916e0c8e187b2ea8ac59156b486699e352e2fd4b286b6e270d62a89d68ae" }, { "kind": "contract_semantic", "id": "aws.security_group/stateful", "sha256": "sha256:ab8c9d2756e808e25dc5cc3edc00f6660e627e57b5d111df80cc426b4a2ad49a" }, { "kind": "review_cause", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.security_group/rule-ports", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/standalone-rule-empty-sources", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/standalone-rule-other-sources", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/standalone-rule-values", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/stateful", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:732bd1fbc54fc9a90a3d44575b2d5e05c3097f0c28b0a7064e46d510941bb10a" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 4 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 7 critical settings of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-SECURITY-GROUP-NETWORK-TOPOLOGY-BOUNDARY", "kind": "network-topology-boundary", "family": "aws.security_group", "title": "Confirm that the project is the boundary of one network", "block": "network-topology-boundary", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-topology-boundary\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|network-topology-boundary" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-RULE-PORTS", "kind": "rule-ports", "family": "aws.security_group", "title": "Confirm the ports of the rules of the security group", "block": "egress", "category": "network-exposure", "why": "The knowledge base cannot decide \"rule-ports\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|rule-ports" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-SECURITY-GROUP-VPC-MEMBERSHIP", "kind": "security-group-vpc-membership", "family": "aws.security_group", "title": "Decide which networks the security group may be attached to (a STACKIT group has no network scope)", "block": "vpc_id", "category": "network-exposure", "why": "The knowledge base cannot decide \"security-group-vpc-membership\" of the aws.security_group contract for 1 unit (UNSUPPORTED): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|security-group-vpc-membership" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-EMPTY-SOURCES", "kind": "standalone-rule-empty-sources", "family": "aws.security_group", "title": "Review the standalone rule empty sources setting", "block": "standalone-rule-empty-sources", "category": "network-exposure", "why": "The knowledge base cannot decide \"standalone-rule-empty-sources\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-empty-sources" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the standalone rule empty sources setting for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-OTHER-SOURCES", "kind": "standalone-rule-other-sources", "family": "aws.security_group", "title": "Review the standalone rule other sources setting", "block": "standalone-rule-other-sources", "category": "network-exposure", "why": "The knowledge base cannot decide \"standalone-rule-other-sources\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-other-sources" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the standalone rule other sources setting for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-VALUES", "kind": "standalone-rule-values", "family": "aws.security_group", "title": "Review the standalone rule values setting", "block": "standalone-rule-values", "category": "network-exposure", "why": "The knowledge base cannot decide \"standalone-rule-values\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-values" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the standalone rule values setting for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STATEFUL", "kind": "stateful", "family": "aws.security_group", "title": "Review the stateful setting", "block": "stateful", "category": "network-exposure", "why": "The knowledge base cannot decide \"stateful\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|stateful" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the stateful setting for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0", "source_family": "aws.security_group", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd" ], "affected_application": [], "action_type": "VERIFY_BEHAVIOR", "work_package": "network-security", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, UNSUPPORTED", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the execution plan refuses REF/root/security-group-membership-parity because the target has no counterpart for the setting: a person accepts the difference or redesigns, and the step stays refused This is the state of the setting of this unit that asks the most, Decide which networks the security group may be attached to (a STACKIT group has no network scope); the 7 settings of the record state their own.", "source_observation": "The source states 7 critical settings on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd that the knowledge base cannot decide: Confirm that the project is the boundary of one network; Confirm the ports of the rules of the security group; Decide which networks the security group may be attached to (a STACKIT group has no network scope); Review the standalone rule empty sources setting; Review the standalone rule other sources setting; Review the standalone rule values setting; Review the stateful setting.", "generated_target_behavior": "Confirm that the project is the boundary of one network: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the ports of the rules of the security group: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd. The plan refuses REF/root/security-group-membership-parity. In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the standalone rule empty sources setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). Review the standalone rule other sources setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). Review the standalone rule values setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). Review the stateful setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings).", "residual_difference": "Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the ports of the rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the standalone rule empty sources setting: the target behaviour of this setting is not established Review the standalone rule other sources setting: the target behaviour of this setting is not established Review the standalone rule values setting: the target behaviour of this setting is not established Review the stateful setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. Held by something else first: REF/root/security-group-membership-parity.", "next_action": "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.", "Confirm the ports of the rules of the security group: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.", "Review the standalone rule empty sources setting: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). self = false and empty IPv6/prefix-list lists (module defaults) add no source, as the drafted rule adds none — PRESERVED, per rule that states no source, next to rules that do (those are standalone rule other sources, REVIEW); REVIEW when a rule of the group is not generated (its settings are named NOT CARRIED, the rule not generated check) or a value is not visible statically: the draft names such a value NOT CARRIED and nothing here claims it carried.", "Review the standalone rule other sources setting: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). A standalone rule's own group (self) and IPv6 ranges are written where the draft places the rule (self as remote_security_group_id of the group, an IPv6 range as ip_range with ether_type IPv6), and the draft names the rule NOT CARRIED when the plan withholds it; prefix lists are not generated (as rule other sources for inline rules; prefix lists: the prefix list check), and a person adds the rule if the traffic must pass — REVIEW in every order position.", "Review the standalone rule values setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW.", "Review the stateful setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true)." ], "closes_when": [ "Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Confirm the ports of the rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm the ports of the rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.", "Review the standalone rule empty sources setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the standalone rule other sources setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the standalone rule values setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference." ], "required_inputs": [], "resolution_paths": [ { "id": "network-topology-boundary/bring-the-closing-evidence", "title": "Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "regeneration_required": true }, { "id": "rule-ports/verify-on-target", "title": "Confirm the ports of the rules of the security group: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true }, { "id": "security-group-vpc-membership/verify-on-target", "title": "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true } ], "required_verification": [ "Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result", "Confirm the ports of the rules of the security group: the check, proof or closing evidence is recorded with its result", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.", "Confirm the ports of the rules of the security group: Manual work remains: a person closes the semantic, the draft does not.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"", "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"", "contract note aws.security_group/ingress-sources: \"cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).\"", "contract note aws.security_group/rule-ports: \"Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).\"", "contract note aws.security_group/security-group-vpc-membership: \"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.\"", "contract note aws.security_group/vpc-egress-rules: \"As vpc ingress rules (direction egress).\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false }, { "id": "REF/root/security-group-membership-parity", "mode": "REFUSE", "phase": "SECURITY", "executable": false, "waits_for_this": false } ] } }, { "id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS", "kind": "unit-review", "family": "aws.security_group", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.security_group", "block": "module.dependencies.module.orders_rds.aws_security_group.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.dependencies.module.orders_rds.aws_security_group.this", "artifact": "assessment.json", "pointer": "/units/27" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_security_group.this|egress-restriction", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/85" }, { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_security_group.this|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/86" }, { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_security_group.this|rule-ports", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/87" }, { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_security_group.this|security-group-vpc-membership", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/88" }, { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_security_group.this|standalone-rule-values", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/89" }, { "kind": "semantic", "id": "module.dependencies.module.orders_rds.aws_security_group.this|stateful", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/90" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.dependencies.module.orders_rds.aws_security_group.this", "artifact": "workspace.json", "pointer": "/units/23/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:c70ab8626c768f56f794aa0d2ead7d41c74347f2a6dcf8782ed4bd599a108b12", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.security_group/egress-restriction", "sha256": "sha256:ee33bb5b56478f8119db73947a66f795c4e24097c007aff14fa77451bba5cc7b" }, { "kind": "contract_semantic", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:c8824eb65543cfc382c99c099d77d5d7291c5fc07590661da816e8dba0ce8471" }, { "kind": "contract_semantic", "id": "aws.security_group/rule-ports", "sha256": "sha256:bdc8cca0e8a80c3cb45417e7d8c9b784572da2265f40bd6ac47d974d8b303020" }, { "kind": "contract_semantic", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:f495d36ce1e83560500515e818008c473b8ce061be346c1cb6c738f0ff309fa5" }, { "kind": "contract_semantic", "id": "aws.security_group/standalone-rule-values", "sha256": "sha256:285a916e0c8e187b2ea8ac59156b486699e352e2fd4b286b6e270d62a89d68ae" }, { "kind": "contract_semantic", "id": "aws.security_group/stateful", "sha256": "sha256:ab8c9d2756e808e25dc5cc3edc00f6660e627e57b5d111df80cc426b4a2ad49a" }, { "kind": "review_cause", "id": "aws.security_group/egress-restriction", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.security_group/rule-ports", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/standalone-rule-values", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/stateful", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:5118b33aa50437bb44220519f1d54b70c83925a6a3a5950128f72ff4d74601a8" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "TARGET_LIMIT", "members": 2 }, { "cause": "DEPENDS_ON_UNIT", "members": 2 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-d431130ed2e0", "subject": "module.dependencies.module.orders_rds.aws_security_group.this", "resolution": { "decision_id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS", "source_family": "aws.security_group", "source_semantic": "unit-review", "affected_units": [ "module.dependencies.module.orders_rds.aws_security_group.this" ], "affected_application": [], "action_type": "VERIFY_BEHAVIOR", "work_package": "network-security", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, UNSUPPORTED", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS", "kind": "unit-review", "family": "aws.security_group", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.security_group", "block": "module.retail_app_ecs.module.alb.aws_security_group.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.alb.aws_security_group.this", "artifact": "assessment.json", "pointer": "/units/10" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.alb.aws_security_group.this|egress-restriction", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/111" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb.aws_security_group.this|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/112" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb.aws_security_group.this|security-group-vpc-membership", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/113" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb.aws_security_group.this|stateful", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/114" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.alb.aws_security_group.this", "artifact": "workspace.json", "pointer": "/units/36/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:8e08c65f886c3621d3760f297a9f0f9270020b298c499881ee4e87eabdfb2c10", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.security_group/egress-restriction", "sha256": "sha256:ee33bb5b56478f8119db73947a66f795c4e24097c007aff14fa77451bba5cc7b" }, { "kind": "contract_semantic", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:c8824eb65543cfc382c99c099d77d5d7291c5fc07590661da816e8dba0ce8471" }, { "kind": "contract_semantic", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:f495d36ce1e83560500515e818008c473b8ce061be346c1cb6c738f0ff309fa5" }, { "kind": "contract_semantic", "id": "aws.security_group/stateful", "sha256": "sha256:ab8c9d2756e808e25dc5cc3edc00f6660e627e57b5d111df80cc426b4a2ad49a" }, { "kind": "review_cause", "id": "aws.security_group/egress-restriction", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/stateful", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:a4363e133238bc96983902cad7b0fbafc8f1363c3d4e0ebd54c8325670ad3a45" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "TARGET_LIMIT", "members": 2 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.alb.aws_security_group.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-SECURITY-GROUP-EGRESS-RESTRICTION", "kind": "egress-restriction", "family": "aws.security_group", "title": "Decide the outbound (egress) rules of the security group", "block": "egress", "category": "network-exposure", "why": "The knowledge base cannot decide \"egress-restriction\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb.aws_security_group.this|egress-restriction" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.alb.aws_security_group.this: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-NETWORK-TOPOLOGY-BOUNDARY", "kind": "network-topology-boundary", "family": "aws.security_group", "title": "Confirm that the project is the boundary of one network", "block": "network-topology-boundary", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-topology-boundary\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb.aws_security_group.this|network-topology-boundary" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.alb.aws_security_group.this: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-SECURITY-GROUP-VPC-MEMBERSHIP", "kind": "security-group-vpc-membership", "family": "aws.security_group", "title": "Decide which networks the security group may be attached to (a STACKIT group has no network scope)", "block": "vpc_id", "category": "network-exposure", "why": "The knowledge base cannot decide \"security-group-vpc-membership\" of the aws.security_group contract for 1 unit (UNSUPPORTED): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb.aws_security_group.this|security-group-vpc-membership" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.alb.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STATEFUL", "kind": "stateful", "family": "aws.security_group", "title": "Review the stateful setting", "block": "stateful", "category": "network-exposure", "why": "The knowledge base cannot decide \"stateful\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb.aws_security_group.this|stateful" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the stateful setting for module.retail_app_ecs.module.alb.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS", "source_family": "aws.security_group", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.alb.aws_security_group.this" ], "affected_application": [], "action_type": "VERIFY_BEHAVIOR", "work_package": "network-security", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, UNSUPPORTED", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the execution plan refuses REF/root/security-group-membership-parity because the target has no counterpart for the setting: a person accepts the difference or redesigns, and the step stays refused This is the state of the setting of this unit that asks the most, Decide which networks the security group may be attached to (a STACKIT group has no network scope); the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.retail_app_ecs.module.alb.aws_security_group.this that the knowledge base cannot decide: Decide the outbound (egress) rules of the security group; Confirm that the project is the boundary of one network; Decide which networks the security group may be attached to (a STACKIT group has no network scope); Review the stateful setting.", "generated_target_behavior": "Decide the outbound (egress) rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_security_group.this. The plan refuses REF/root/security-group-membership-parity. In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the stateful setting: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings).", "residual_difference": "Decide the outbound (egress) rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the stateful setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. Held by something else first: REF/root/security-group-membership-parity.", "next_action": "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.alb.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Decide the outbound (egress) rules of the security group: A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.", "Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.", "Review the stateful setting: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true)." ], "closes_when": [ "Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.", "Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference." ], "required_inputs": [], "resolution_paths": [ { "id": "egress-restriction/verify-on-target", "title": "Decide the outbound (egress) rules of the security group: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true }, { "id": "network-topology-boundary/bring-the-closing-evidence", "title": "Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "regeneration_required": true }, { "id": "security-group-vpc-membership/verify-on-target", "title": "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true } ], "required_verification": [ "Decide the outbound (egress) rules of the security group: the check, proof or closing evidence is recorded with its result", "Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Decide the outbound (egress) rules of the security group: Manual work remains: a person closes the semantic, the draft does not.", "Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"", "contract note aws.security_group/ingress-sources: \"cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).\"", "contract note aws.security_group/rule-ports: \"Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).\"", "contract note aws.security_group/security-group-vpc-membership: \"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.\"", "contract note aws.security_group/vpc-egress-rules: \"As vpc ingress rules (direction egress).\"", "contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false }, { "id": "REF/root/security-group-membership-parity", "mode": "REFUSE", "phase": "SECURITY", "executable": false, "waits_for_this": false } ] } }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862", "kind": "unit-review", "family": "aws.security_group", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.security_group", "block": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "artifact": "assessment.json", "pointer": "/units/11" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/115" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|rule-ports", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/116" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|security-group-vpc-membership", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/117" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-empty-sources", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/118" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-other-sources", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/119" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-values", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/120" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|stateful", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/121" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "artifact": "workspace.json", "pointer": "/units/39/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:5eb9ea3019259ced92a0d178966ff7f78a63ab44e0f204fdcc70e4e9dbbbdef2", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:c8824eb65543cfc382c99c099d77d5d7291c5fc07590661da816e8dba0ce8471" }, { "kind": "contract_semantic", "id": "aws.security_group/rule-ports", "sha256": "sha256:bdc8cca0e8a80c3cb45417e7d8c9b784572da2265f40bd6ac47d974d8b303020" }, { "kind": "contract_semantic", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:f495d36ce1e83560500515e818008c473b8ce061be346c1cb6c738f0ff309fa5" }, { "kind": "contract_semantic", "id": "aws.security_group/standalone-rule-empty-sources", "sha256": "sha256:7d52507b8aba7699b5e2fb7f9ac145ad4ed63e5d9abd03397490b39e75592b16" }, { "kind": "contract_semantic", "id": "aws.security_group/standalone-rule-other-sources", "sha256": "sha256:3ede30a615d32533e0a91dd3afd88ec8dcf5d9728e1e62b2aed80e01170df227" }, { "kind": "contract_semantic", "id": "aws.security_group/standalone-rule-values", "sha256": "sha256:285a916e0c8e187b2ea8ac59156b486699e352e2fd4b286b6e270d62a89d68ae" }, { "kind": "contract_semantic", "id": "aws.security_group/stateful", "sha256": "sha256:ab8c9d2756e808e25dc5cc3edc00f6660e627e57b5d111df80cc426b4a2ad49a" }, { "kind": "review_cause", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.security_group/rule-ports", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/standalone-rule-empty-sources", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/standalone-rule-other-sources", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/standalone-rule-values", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.security_group/stateful", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:732bd1fbc54fc9a90a3d44575b2d5e05c3097f0c28b0a7064e46d510941bb10a" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 4 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 7 critical settings of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-SECURITY-GROUP-NETWORK-TOPOLOGY-BOUNDARY", "kind": "network-topology-boundary", "family": "aws.security_group", "title": "Confirm that the project is the boundary of one network", "block": "network-topology-boundary", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-topology-boundary\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|network-topology-boundary" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-RULE-PORTS", "kind": "rule-ports", "family": "aws.security_group", "title": "Confirm the ports of the rules of the security group", "block": "egress", "category": "network-exposure", "why": "The knowledge base cannot decide \"rule-ports\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|rule-ports" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-SECURITY-GROUP-VPC-MEMBERSHIP", "kind": "security-group-vpc-membership", "family": "aws.security_group", "title": "Decide which networks the security group may be attached to (a STACKIT group has no network scope)", "block": "vpc_id", "category": "network-exposure", "why": "The knowledge base cannot decide \"security-group-vpc-membership\" of the aws.security_group contract for 1 unit (UNSUPPORTED): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|security-group-vpc-membership" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-EMPTY-SOURCES", "kind": "standalone-rule-empty-sources", "family": "aws.security_group", "title": "Review the standalone rule empty sources setting", "block": "standalone-rule-empty-sources", "category": "network-exposure", "why": "The knowledge base cannot decide \"standalone-rule-empty-sources\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-empty-sources" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the standalone rule empty sources setting for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-OTHER-SOURCES", "kind": "standalone-rule-other-sources", "family": "aws.security_group", "title": "Review the standalone rule other sources setting", "block": "standalone-rule-other-sources", "category": "network-exposure", "why": "The knowledge base cannot decide \"standalone-rule-other-sources\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-other-sources" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the standalone rule other sources setting for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-VALUES", "kind": "standalone-rule-values", "family": "aws.security_group", "title": "Review the standalone rule values setting", "block": "standalone-rule-values", "category": "network-exposure", "why": "The knowledge base cannot decide \"standalone-rule-values\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-values" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the standalone rule values setting for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STATEFUL", "kind": "stateful", "family": "aws.security_group", "title": "Review the stateful setting", "block": "stateful", "category": "network-exposure", "why": "The knowledge base cannot decide \"stateful\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|stateful" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the stateful setting for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862", "source_family": "aws.security_group", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix" ], "affected_application": [], "action_type": "VERIFY_BEHAVIOR", "work_package": "network-security", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, UNSUPPORTED", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the execution plan refuses REF/root/security-group-membership-parity because the target has no counterpart for the setting: a person accepts the difference or redesigns, and the step stays refused This is the state of the setting of this unit that asks the most, Decide which networks the security group may be attached to (a STACKIT group has no network scope); the 7 settings of the record state their own.", "source_observation": "The source states 7 critical settings on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix that the knowledge base cannot decide: Confirm that the project is the boundary of one network; Confirm the ports of the rules of the security group; Decide which networks the security group may be attached to (a STACKIT group has no network scope); Review the standalone rule empty sources setting; Review the standalone rule other sources setting; Review the standalone rule values setting; Review the stateful setting.", "generated_target_behavior": "Confirm that the project is the boundary of one network: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the ports of the rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix. The plan refuses REF/root/security-group-membership-parity. In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the standalone rule empty sources setting: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). Review the standalone rule other sources setting: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). Review the standalone rule values setting: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). Review the stateful setting: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings).", "residual_difference": "Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the ports of the rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the standalone rule empty sources setting: the target behaviour of this setting is not established Review the standalone rule other sources setting: the target behaviour of this setting is not established Review the standalone rule values setting: the target behaviour of this setting is not established Review the stateful setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. Held by something else first: REF/root/security-group-membership-parity.", "next_action": "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.", "Confirm the ports of the rules of the security group: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.", "Review the standalone rule empty sources setting: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). self = false and empty IPv6/prefix-list lists (module defaults) add no source, as the drafted rule adds none — PRESERVED, per rule that states no source, next to rules that do (those are standalone rule other sources, REVIEW); REVIEW when a rule of the group is not generated (its settings are named NOT CARRIED, the rule not generated check) or a value is not visible statically: the draft names such a value NOT CARRIED and nothing here claims it carried.", "Review the standalone rule other sources setting: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). A standalone rule's own group (self) and IPv6 ranges are written where the draft places the rule (self as remote_security_group_id of the group, an IPv6 range as ip_range with ether_type IPv6), and the draft names the rule NOT CARRIED when the plan withholds it; prefix lists are not generated (as rule other sources for inline rules; prefix lists: the prefix list check), and a person adds the rule if the traffic must pass — REVIEW in every order position.", "Review the standalone rule values setting: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW.", "Review the stateful setting: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true)." ], "closes_when": [ "Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Confirm the ports of the rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm the ports of the rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.", "Review the standalone rule empty sources setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the standalone rule other sources setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the standalone rule values setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference." ], "required_inputs": [], "resolution_paths": [ { "id": "network-topology-boundary/bring-the-closing-evidence", "title": "Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "regeneration_required": true }, { "id": "rule-ports/verify-on-target", "title": "Confirm the ports of the rules of the security group: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true }, { "id": "security-group-vpc-membership/verify-on-target", "title": "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true } ], "required_verification": [ "Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result", "Confirm the ports of the rules of the security group: the check, proof or closing evidence is recorded with its result", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.", "Confirm the ports of the rules of the security group: Manual work remains: a person closes the semantic, the draft does not.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"", "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"", "contract note aws.security_group/ingress-sources: \"cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).\"", "contract note aws.security_group/rule-ports: \"Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).\"", "contract note aws.security_group/security-group-vpc-membership: \"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.\"", "contract note aws.security_group/vpc-egress-rules: \"As vpc ingress rules (direction egress).\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false }, { "id": "REF/root/security-group-membership-parity", "mode": "REFUSE", "phase": "SECURITY", "executable": false, "waits_for_this": false } ] } }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF", "kind": "unit-review", "family": "aws.security_group", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.security_group", "block": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "artifact": "assessment.json", "pointer": "/units/13" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_security_group.this|egress-rule-protocol", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/145" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_security_group.this|egress-sources", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/146" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_security_group.this|ingress-sources", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/147" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_security_group.this|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/148" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_security_group.this|rule-ports", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/149" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_security_group.this|security-group-vpc-membership", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/150" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.carts_service.aws_security_group.this|stateful", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/151" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "artifact": "workspace.json", "pointer": "/units/43/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:d2ce6c8560f61656e20bb6b51a011c7b79ca81012b6e7dda9e01fb0de53751f3", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.security_group/egress-rule-protocol", "sha256": "sha256:4ede7181d60ce7b614d5bd3257abbec0a764e48891f80286a18bf174fcc0f141" }, { "kind": "contract_semantic", "id": "aws.security_group/egress-sources", "sha256": "sha256:e5f673fcf9c0b155c732180f406e9ddb76a1d22c5ff971c6c6a6e354fcae73b0" }, { "kind": "contract_semantic", "id": "aws.security_group/ingress-sources", "sha256": "sha256:bc9358c7bf9142ae4dac2c07891e384cfcbde7f35f5ad9d2b3cc27640a45a937" }, { "kind": "contract_semantic", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:c8824eb65543cfc382c99c099d77d5d7291c5fc07590661da816e8dba0ce8471" }, { "kind": "contract_semantic", "id": "aws.security_group/rule-ports", "sha256": "sha256:bdc8cca0e8a80c3cb45417e7d8c9b784572da2265f40bd6ac47d974d8b303020" }, { "kind": "contract_semantic", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:f495d36ce1e83560500515e818008c473b8ce061be346c1cb6c738f0ff309fa5" }, { "kind": "contract_semantic", "id": "aws.security_group/stateful", "sha256": "sha256:ab8c9d2756e808e25dc5cc3edc00f6660e627e57b5d111df80cc426b4a2ad49a" }, { "kind": "review_cause", "id": "aws.security_group/egress-rule-protocol", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/egress-sources", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/ingress-sources", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.security_group/rule-ports", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/stateful", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 5 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-b2d8975431a4", "subject": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "resolution": { "decision_id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF", "source_family": "aws.security_group", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.carts_service.aws_security_group.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, LEDGER, UNSUPPORTED", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F", "kind": "unit-review", "family": "aws.security_group", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.security_group", "block": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "artifact": "assessment.json", "pointer": "/units/15" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_security_group.this|egress-rule-protocol", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/175" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_security_group.this|egress-sources", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/176" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_security_group.this|ingress-sources", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/177" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_security_group.this|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/178" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_security_group.this|rule-ports", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/179" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_security_group.this|security-group-vpc-membership", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/180" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.catalog_service.aws_security_group.this|stateful", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/181" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "artifact": "workspace.json", "pointer": "/units/47/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:533d0003c31ab197546f7c4f8d22e3c3bf725e8b7395b5d3ea21b3278fdb62b3", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.security_group/egress-rule-protocol", "sha256": "sha256:4ede7181d60ce7b614d5bd3257abbec0a764e48891f80286a18bf174fcc0f141" }, { "kind": "contract_semantic", "id": "aws.security_group/egress-sources", "sha256": "sha256:e5f673fcf9c0b155c732180f406e9ddb76a1d22c5ff971c6c6a6e354fcae73b0" }, { "kind": "contract_semantic", "id": "aws.security_group/ingress-sources", "sha256": "sha256:bc9358c7bf9142ae4dac2c07891e384cfcbde7f35f5ad9d2b3cc27640a45a937" }, { "kind": "contract_semantic", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:c8824eb65543cfc382c99c099d77d5d7291c5fc07590661da816e8dba0ce8471" }, { "kind": "contract_semantic", "id": "aws.security_group/rule-ports", "sha256": "sha256:bdc8cca0e8a80c3cb45417e7d8c9b784572da2265f40bd6ac47d974d8b303020" }, { "kind": "contract_semantic", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:f495d36ce1e83560500515e818008c473b8ce061be346c1cb6c738f0ff309fa5" }, { "kind": "contract_semantic", "id": "aws.security_group/stateful", "sha256": "sha256:ab8c9d2756e808e25dc5cc3edc00f6660e627e57b5d111df80cc426b4a2ad49a" }, { "kind": "review_cause", "id": "aws.security_group/egress-rule-protocol", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/egress-sources", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/ingress-sources", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.security_group/rule-ports", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/stateful", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 5 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-b2d8975431a4", "subject": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "resolution": { "decision_id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F", "source_family": "aws.security_group", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.catalog_service.aws_security_group.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, LEDGER, UNSUPPORTED", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F", "kind": "unit-review", "family": "aws.security_group", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.security_group", "block": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "artifact": "assessment.json", "pointer": "/units/17" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_security_group.this|egress-rule-protocol", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/205" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_security_group.this|egress-sources", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/206" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_security_group.this|ingress-sources", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/207" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_security_group.this|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/208" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_security_group.this|rule-ports", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/209" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_security_group.this|security-group-vpc-membership", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/210" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.checkout_service.aws_security_group.this|stateful", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/211" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "artifact": "workspace.json", "pointer": "/units/51/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:9d37a2eef4e29a3cb7c4a4bac8afc4bf54d07043772e5a624d09c77aa3ddb8ae", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.security_group/egress-rule-protocol", "sha256": "sha256:4ede7181d60ce7b614d5bd3257abbec0a764e48891f80286a18bf174fcc0f141" }, { "kind": "contract_semantic", "id": "aws.security_group/egress-sources", "sha256": "sha256:e5f673fcf9c0b155c732180f406e9ddb76a1d22c5ff971c6c6a6e354fcae73b0" }, { "kind": "contract_semantic", "id": "aws.security_group/ingress-sources", "sha256": "sha256:bc9358c7bf9142ae4dac2c07891e384cfcbde7f35f5ad9d2b3cc27640a45a937" }, { "kind": "contract_semantic", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:c8824eb65543cfc382c99c099d77d5d7291c5fc07590661da816e8dba0ce8471" }, { "kind": "contract_semantic", "id": "aws.security_group/rule-ports", "sha256": "sha256:bdc8cca0e8a80c3cb45417e7d8c9b784572da2265f40bd6ac47d974d8b303020" }, { "kind": "contract_semantic", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:f495d36ce1e83560500515e818008c473b8ce061be346c1cb6c738f0ff309fa5" }, { "kind": "contract_semantic", "id": "aws.security_group/stateful", "sha256": "sha256:ab8c9d2756e808e25dc5cc3edc00f6660e627e57b5d111df80cc426b4a2ad49a" }, { "kind": "review_cause", "id": "aws.security_group/egress-rule-protocol", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/egress-sources", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/ingress-sources", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.security_group/rule-ports", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/stateful", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 5 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-b2d8975431a4", "subject": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "resolution": { "decision_id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F", "source_family": "aws.security_group", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.checkout_service.aws_security_group.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, LEDGER, UNSUPPORTED", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3", "kind": "unit-review", "family": "aws.security_group", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.security_group", "block": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "artifact": "assessment.json", "pointer": "/units/19" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_security_group.this|egress-rule-protocol", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/235" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_security_group.this|egress-sources", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/236" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_security_group.this|ingress-sources", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/237" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_security_group.this|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/238" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_security_group.this|rule-ports", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/239" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_security_group.this|security-group-vpc-membership", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/240" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.orders_service.aws_security_group.this|stateful", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/241" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "artifact": "workspace.json", "pointer": "/units/55/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:6761ee5382c2046f852e12938f4868f00aa72c16f7060930ffb775b9e048cb7e", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.security_group/egress-rule-protocol", "sha256": "sha256:4ede7181d60ce7b614d5bd3257abbec0a764e48891f80286a18bf174fcc0f141" }, { "kind": "contract_semantic", "id": "aws.security_group/egress-sources", "sha256": "sha256:e5f673fcf9c0b155c732180f406e9ddb76a1d22c5ff971c6c6a6e354fcae73b0" }, { "kind": "contract_semantic", "id": "aws.security_group/ingress-sources", "sha256": "sha256:bc9358c7bf9142ae4dac2c07891e384cfcbde7f35f5ad9d2b3cc27640a45a937" }, { "kind": "contract_semantic", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:c8824eb65543cfc382c99c099d77d5d7291c5fc07590661da816e8dba0ce8471" }, { "kind": "contract_semantic", "id": "aws.security_group/rule-ports", "sha256": "sha256:bdc8cca0e8a80c3cb45417e7d8c9b784572da2265f40bd6ac47d974d8b303020" }, { "kind": "contract_semantic", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:f495d36ce1e83560500515e818008c473b8ce061be346c1cb6c738f0ff309fa5" }, { "kind": "contract_semantic", "id": "aws.security_group/stateful", "sha256": "sha256:ab8c9d2756e808e25dc5cc3edc00f6660e627e57b5d111df80cc426b4a2ad49a" }, { "kind": "review_cause", "id": "aws.security_group/egress-rule-protocol", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/egress-sources", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/ingress-sources", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.security_group/rule-ports", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/stateful", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 5 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-b2d8975431a4", "subject": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "resolution": { "decision_id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3", "source_family": "aws.security_group", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.orders_service.aws_security_group.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, LEDGER, UNSUPPORTED", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS", "kind": "unit-review", "family": "aws.security_group", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.security_group", "block": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "artifact": "assessment.json", "pointer": "/units/21" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_security_group.this|egress-rule-protocol", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/266" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_security_group.this|egress-sources", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/267" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_security_group.this|ingress-sources", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/268" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_security_group.this|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/269" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_security_group.this|rule-ports", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/270" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_security_group.this|security-group-vpc-membership", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/271" }, { "kind": "semantic", "id": "module.retail_app_ecs.module.ui_service.aws_security_group.this|stateful", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/272" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "artifact": "workspace.json", "pointer": "/units/59/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:d3db27e38c1fef4dfc310642c956f0cd27d824826e599bedf54475accbc6fe8c", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.security_group/egress-rule-protocol", "sha256": "sha256:4ede7181d60ce7b614d5bd3257abbec0a764e48891f80286a18bf174fcc0f141" }, { "kind": "contract_semantic", "id": "aws.security_group/egress-sources", "sha256": "sha256:e5f673fcf9c0b155c732180f406e9ddb76a1d22c5ff971c6c6a6e354fcae73b0" }, { "kind": "contract_semantic", "id": "aws.security_group/ingress-sources", "sha256": "sha256:bc9358c7bf9142ae4dac2c07891e384cfcbde7f35f5ad9d2b3cc27640a45a937" }, { "kind": "contract_semantic", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:c8824eb65543cfc382c99c099d77d5d7291c5fc07590661da816e8dba0ce8471" }, { "kind": "contract_semantic", "id": "aws.security_group/rule-ports", "sha256": "sha256:bdc8cca0e8a80c3cb45417e7d8c9b784572da2265f40bd6ac47d974d8b303020" }, { "kind": "contract_semantic", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:f495d36ce1e83560500515e818008c473b8ce061be346c1cb6c738f0ff309fa5" }, { "kind": "contract_semantic", "id": "aws.security_group/stateful", "sha256": "sha256:ab8c9d2756e808e25dc5cc3edc00f6660e627e57b5d111df80cc426b4a2ad49a" }, { "kind": "review_cause", "id": "aws.security_group/egress-rule-protocol", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/egress-sources", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/ingress-sources", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.security_group/rule-ports", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "aws.security_group/security-group-vpc-membership", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.security_group/stateful", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "TARGET_LIMIT", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 5 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-b2d8975431a4", "subject": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "resolution": { "decision_id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS", "source_family": "aws.security_group", "source_semantic": "unit-review", "affected_units": [ "module.retail_app_ecs.module.ui_service.aws_security_group.this" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, LEDGER, UNSUPPORTED", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE", "kind": "unit-review", "family": "aws.subnet", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.subnet", "block": "module.vpc.module.vpc.aws_subnet.private", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.vpc.module.vpc.aws_subnet.private", "artifact": "assessment.json", "pointer": "/units/85" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.vpc.module.vpc.aws_subnet.private|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/15" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_subnet.private|prefix", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/16" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_subnet.private|private-egress-ipv4", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/17" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_subnet.private|subnet-vpc-membership", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/18" } ], "instances": [ { "unit": "module.vpc.module.vpc.aws_subnet.private", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "network-topology-boundary" }, { "unit": "module.vpc.module.vpc.aws_subnet.private", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "prefix" }, { "unit": "module.vpc.module.vpc.aws_subnet.private", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "private-egress-ipv4" }, { "unit": "module.vpc.module.vpc.aws_subnet.private", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "subnet-vpc-membership" } ], "conditional_members": 4, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.vpc.module.vpc.aws_subnet.private", "artifact": "workspace.json", "pointer": "/units/84/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:b1a497b9caa9da516a8ceb6a9547cf01be0e17d4e1b868091441dfc57a5ebc5c", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.subnet/network-topology-boundary", "sha256": "sha256:fecb7804f476dc44b5b76d9e697f7a639871f1f44dd08cefc240cade0095d079" }, { "kind": "contract_semantic", "id": "aws.subnet/prefix", "sha256": "sha256:600a289d2004afd4a966272b1bcbe82ceccdfc27653218d9bd406521fbb79b2f" }, { "kind": "contract_semantic", "id": "aws.subnet/private-egress-ipv4", "sha256": "sha256:5d36e6cbe21cf022f4759a0486f9be2fbe13da87f8c97a19a398419240614b4e" }, { "kind": "contract_semantic", "id": "aws.subnet/subnet-vpc-membership", "sha256": "sha256:794176cb76303140f971dbac79cd7fbf626ae1bd87a0dacdb65a8d370395ccc7" }, { "kind": "review_cause", "id": "aws.subnet/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.subnet/prefix", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.subnet/private-egress-ipv4", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.subnet/subnet-vpc-membership", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:97a0cc39677d5688e69a422dadb5017babb8a52cbe2ba1d6f5678a3e8c1c106e" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 3 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "why": "The knowledge base cannot decide 4 critical settings of module.vpc.module.vpc.aws_subnet.private: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 4 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-SUBNET-NETWORK-TOPOLOGY-BOUNDARY", "kind": "network-topology-boundary", "family": "aws.subnet", "title": "Confirm that the project is the boundary of one network", "block": "network-topology-boundary", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-topology-boundary\" of the aws.subnet contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_subnet.private|network-topology-boundary" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.vpc.module.vpc.aws_subnet.private: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SUBNET-PREFIX", "kind": "prefix", "family": "aws.subnet", "title": "Review the prefix setting", "block": "cidr_block", "category": "network-exposure", "why": "The knowledge base cannot decide \"prefix\" of the aws.subnet contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_subnet.private|prefix" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Review the prefix setting for module.vpc.module.vpc.aws_subnet.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SUBNET-PRIVATE-EGRESS-IPV4", "kind": "private-egress-ipv4", "family": "aws.subnet", "title": "Decide how private servers reach the internet (outbound IPv4)", "block": "private-egress-ipv4", "category": "network-exposure", "why": "The knowledge base cannot decide \"private-egress-ipv4\" of the aws.subnet contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_subnet.private|private-egress-ipv4" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Decide how private servers reach the internet (outbound IPv4) for module.vpc.module.vpc.aws_subnet.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SUBNET-SUBNET-VPC-MEMBERSHIP", "kind": "subnet-vpc-membership", "family": "aws.subnet", "title": "Confirm which network each subnet belongs to", "block": "vpc_id", "category": "network-exposure", "why": "The knowledge base cannot decide \"subnet-vpc-membership\" of the aws.subnet contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_subnet.private|subnet-vpc-membership" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.vpc.module.vpc.aws_subnet.private: the check, proof or closing evidence is recorded with its result." } ], "resolution": { "decision_id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE", "source_family": "aws.subnet", "source_semantic": "unit-review", "affected_units": [ "module.vpc.module.vpc.aws_subnet.private" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the prefix setting; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on module.vpc.module.vpc.aws_subnet.private that the knowledge base cannot decide: Confirm that the project is the boundary of one network; Review the prefix setting; Decide how private servers reach the internet (outbound IPv4); Confirm which network each subnet belongs to.", "generated_target_behavior": "Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the prefix setting: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect). Decide how private servers reach the internet (outbound IPv4): The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect). Without a bound target environment the network keeps STACKIT's default gateway (routed and no_ipv4_gateway unset), so its servers can start outbound connections. With a target environment whose egress is none, every network the draft creates is written routed = false (an open egress decision, and a network narrower than the source: it reaches no other network either); with STACKIT's default routing it is written routed = true (wider than a source subnet without an internet route). The setting stays open for review in every case: no equivalence of the private egress is proven. Confirm which network each subnet belongs to: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the prefix setting: the target behaviour of this setting is not established Decide how private servers reach the internet (outbound IPv4): What the source subnet reaches (where unproven); that the servers of the subnet cannot reach the internet on the target, as on the source; and, where the source resolved private names, that the target resolves them. Confirm which network each subnet belongs to: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect now.", "next_action": "Review the prefix setting: Review the prefix setting for module.vpc.module.vpc.aws_subnet.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this subnet included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.", "Review the prefix setting: The value is not visible statically (a case of the mapping rule for this kind of unit), so nothing is credited for it. stackit_network.ipv4_prefix. TRANSFORMED for a CIDR the scan has seen. The draft carries the prefix as stackit_network.ipv4_prefix taken from a variable without a default (pinned provider: \"The IPv4 prefix of the network (CIDR)\") and says in the variable's description that the source CIDR is not visible; decide the CIDR each STACKIT network gets (the source CIDRs are reused unless the address plan changes) and enter it before plan.", "Decide how private servers reach the internet (outbound IPv4): A check of the knowledge base (subnet egress ipv4 unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The source and the target are not equivalent for outbound access, and the draft closes nothing: REVIEW.", "Confirm which network each subnet belongs to: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The VPC the subnet belongs to: the draft creates every network in one project, so the source VPC's boundary is kept only when the estate has one VPC and every resource that names a VPC provably names it; the draft states the estate's topology and what the architect decides about it once, at the top of its network file." ], "closes_when": [ "Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the prefix setting: A literal value or a resolved reference in the source closes it, or a person confirms the value.", "Decide how private servers reach the internet (outbound IPv4): The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the check that fired asks, and that check's closing evidence or decision is recorded. Where the scan cannot prove what the source subnet reaches, the closing evidence is the route table the subnet follows and its default route by exact references, and for a route to an internet gateway the public IPv4 address of every server in the subnet, or an architect's statement of what the source subnet reaches. Where the source subnet has no internet route, it is an architect's decision that the network may reach the internet through the STACKIT gateway with the outbound limits written as security-group egress rules, a decision that the network is isolated (routed = false), or a documented or observed setting that removes the outbound path of a routed network.", "Decide how private servers reach the internet (outbound IPv4): A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Confirm which network each subnet belongs to: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm which network each subnet belongs to: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded." ], "required_inputs": [ "target.egress" ], "resolution_paths": [ { "id": "network-topology-boundary/bring-the-closing-evidence", "title": "Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.subnet/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "regeneration_required": true }, { "id": "private-egress-ipv4/prove-what-the-source-subnet-reaches", "title": "Decide how private servers reach the internet (outbound IPv4): Prove what the source subnet reaches (what the check that cannot prove it asks for)", "prerequisites": [ "the route table the subnet follows and its default route, named by exact references in the source, and for a route to an internet gateway the public IPv4 address of every server in the subnet", "or an architect's statement of what the source subnet reaches" ], "effects": [ "A rerun on the source with the exact references reads the subnet as reaching the internet or not; the not-equivalent case then needs one of the other paths." ], "risk": [ "A statement that is wrong about the source makes the target wider or narrower than the source without a finding." ], "evidence": [ "rule aws.subnet/subnet-egress-ipv4-unproven of the knowledge base: \"or an architect's statement of what the source subnet reaches.\"" ], "regeneration_required": true }, { "id": "private-egress-ipv4/limit-egress-with-security-groups", "title": "Decide how private servers reach the internet (outbound IPv4): Accept the routed network and limit outbound traffic with security-group egress rules", "prerequisites": [ "the outbound traffic the workload really needs (protocol, port, destination)", "the allow-all default egress rule of each group removed after apply" ], "effects": [ "The network still has an internet path; what the servers may reach is limited by their groups' egress rules (an allow-list was observed enforced per destination, protocol and port).", "regeneration: not stated — treated as required" ], "risk": [ "A server whose group keeps an allow-all egress rule reaches the internet; the exposure is wider than the source's until the rules exist." ], "evidence": [ "decision kind stackitsg.default_egress.ipv4 of the knowledge base: \"Egress (Outbound) : All outgoing traffic is allowed by default.\"", "decision kind stackitsg.default_egress.ipv4 of the knowledge base: \"The group then allows only the egress rules the draft writes from the source, so its outbound IPv4 traffic is no wider than the source's.\"", "a test on a STACKIT project on 2026-10-10: \"Observed: on a stateful group an egress allow-list is enforced per destination, protocol and port\"" ], "regeneration_required": true }, { "id": "private-egress-ipv4/isolate-through-the-target-environment", "title": "Decide how private servers reach the internet (outbound IPv4): Isolate the networks: a bound target environment with egress none (routed = false)", "prerequisites": [ "the architect's decision that no network of the project must reach another or the internet (the setting applies to every network the draft creates)", "a target environment file stating egress mode NONE, bound to the run (target.egress then shows the bound statement)" ], "effects": [ "Every network is written routed = false: observed in a STACKIT test project to have no internet egress and no connection to the project's other networks. STACKIT documents no egress switch; this rests on the observation, not on documentation. routed cannot be changed by an update: a later change replaces the network." ], "risk": [ "The networks are cut off from each other as well (narrower than the source); the behaviour rests on observations in one STACKIT test project." ], "evidence": [ "the description of the target-environment profile in the product documentation: \"`NONE` writes `routed = false`: a non-routed network has no gateway, no public IP and no internet egress, and the project's other networks do not reach it either (observed in one project, probes 2 and 11)\"", "the generator of the draft: \"routed = false; a non-routed network has no gateway, no public IP and no internet egress\"", "rule aws.subnet/subnet-egress-ipv4-not-equivalent of the knowledge base: \"The sandbox observed a non-routed network to have no internet egress and no connection to the project's other networks\"", "provider-docs mirror stackit/docs.stackit.cloud/products/network/core-networking/network-area/faq.html: \"Currently we do not support this, however there are plans to enable this in the future.\"" ], "regeneration_required": true }, { "id": "subnet-vpc-membership/bring-the-closing-evidence", "title": "Confirm which network each subnet belongs to: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.subnet/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "regeneration_required": true } ], "required_verification": [ "Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result", "Decide how private servers reach the internet (outbound IPv4): an outbound connection from a server of the network to an internet address fails (or succeeds only where the decision allows it) on the target", "Decide how private servers reach the internet (outbound IPv4): where the source used private DNS: names resolve on the target through the resolvers the networks are given", "Confirm which network each subnet belongs to: the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes.", "An answer of target.egress applies nothing by itself (the answer is read, not applied); a bound target environment's egress changes routed on every network. Neither closes the setting." ], "remains_manual": [ "Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.", "Decide how private servers reach the internet (outbound IPv4): Manual work remains: a person closes the semantic, the draft does not.", "Confirm which network each subnet belongs to: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.subnet/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"", "contract note aws.subnet/subnet-vpc-membership: \"The VPC the subnet belongs to: the draft creates every network in one project\"", "contract note aws.subnet/private-egress-ipv4: \"so the source and the target are not equivalent and the draft closes nothing\"", "the description of the target-environment profile in the product documentation: \"In this build four of them have no handler (`target.project`, `target.egress`, `target.ingress.public`, `target.observability`): an answer is `READ_NOT_APPLIED`, and `inputs-template.yaml` therefore lists them last, in the group NOT APPLICABLE IN THIS BUILD\"", "STACKIT provider schema 0.120.0: \"the network doesn't have a gateway.\"", "STACKIT provider schema 0.120.0: \"If set to `true`, the network is routed and therefore accessible from other networks.\"", "STACKIT provider schema 0.120.0: \"The IPv4 nameservers of the network.\"", "STACKIT provider schema 0.120.0: \"Note: This field currently has no effect and does not enforce any access restrictions on the DNS zone.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect", "mode": "MANUAL", "phase": "FOUNDATION", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE", "kind": "unit-review", "family": "aws.subnet", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.subnet", "block": "module.vpc.module.vpc.aws_subnet.private", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.vpc.module.vpc.aws_subnet.private", "artifact": "assessment.json", "pointer": "/units/85" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.vpc.module.vpc.aws_subnet.private|availability-zone", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/14" } ], "instances": [ { "unit": "module.vpc.module.vpc.aws_subnet.private", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "availability-zone" } ], "conditional_members": 1, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.vpc.module.vpc.aws_subnet.private", "artifact": "workspace.json", "pointer": "/units/84/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:5f69f9a245d1ee7220cd5f7ae8dd7d6c63754281e22d38e57ece0dd324c9f7ca", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.subnet/availability-zone", "sha256": "sha256:6fc844366b14cec6fef47b58ec6f51315a21f578c82f8b6ce6dfaef43afa1a6c" }, { "kind": "decision_kind", "id": "aws.subnet/availability-zone", "sha256": "sha256:0e687b53d36142d32908140a37a97f62928114877a0989cd496b1a31c0c03b48" }, { "kind": "review_cause", "id": "aws.subnet/availability-zone", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:b7c227d12f16960b694c76edaebeaa4eb6e1c2ce904c0f48e83f794a07fe3138" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "shape": "RSH-0002171813ad", "subject": "module.vpc.module.vpc.aws_subnet.private", "resolution": { "decision_id": "DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE", "source_family": "aws.subnet", "source_semantic": "unit-review", "affected_units": [ "module.vpc.module.vpc.aws_subnet.private" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "availability-resilience", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC", "kind": "unit-review", "family": "aws.subnet", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.subnet", "block": "module.vpc.module.vpc.aws_subnet.public", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.vpc.module.vpc.aws_subnet.public", "artifact": "assessment.json", "pointer": "/units/86" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.vpc.module.vpc.aws_subnet.public|effective-route-table", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/20" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_subnet.public|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/21" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_subnet.public|prefix", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/22" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_subnet.public|private-egress-ipv4", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/23" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_subnet.public|subnet-vpc-membership", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/24" } ], "instances": [ { "unit": "module.vpc.module.vpc.aws_subnet.public", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "effective-route-table" }, { "unit": "module.vpc.module.vpc.aws_subnet.public", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "network-topology-boundary" }, { "unit": "module.vpc.module.vpc.aws_subnet.public", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "prefix" }, { "unit": "module.vpc.module.vpc.aws_subnet.public", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "private-egress-ipv4" }, { "unit": "module.vpc.module.vpc.aws_subnet.public", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "subnet-vpc-membership" } ], "conditional_members": 5, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.vpc.module.vpc.aws_subnet.public", "artifact": "workspace.json", "pointer": "/units/85/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:755f2761ac8b2e8f203b7be58efc5948a0633f72c4f5eadcad7fafd1ed820427", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.subnet/effective-route-table", "sha256": "sha256:9cc49f1e8f7dafc354e18d32c5d490f8a510a914321dbfcf65ba64ceff182c98" }, { "kind": "contract_semantic", "id": "aws.subnet/network-topology-boundary", "sha256": "sha256:fecb7804f476dc44b5b76d9e697f7a639871f1f44dd08cefc240cade0095d079" }, { "kind": "contract_semantic", "id": "aws.subnet/prefix", "sha256": "sha256:600a289d2004afd4a966272b1bcbe82ceccdfc27653218d9bd406521fbb79b2f" }, { "kind": "contract_semantic", "id": "aws.subnet/private-egress-ipv4", "sha256": "sha256:5d36e6cbe21cf022f4759a0486f9be2fbe13da87f8c97a19a398419240614b4e" }, { "kind": "contract_semantic", "id": "aws.subnet/subnet-vpc-membership", "sha256": "sha256:794176cb76303140f971dbac79cd7fbf626ae1bd87a0dacdb65a8d370395ccc7" }, { "kind": "review_cause", "id": "aws.subnet/effective-route-table", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.subnet/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.subnet/prefix", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "aws.subnet/private-egress-ipv4", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.subnet/subnet-vpc-membership", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:0c657c51ac1ed6771de561cec8183d19d149beb1179624fa61bcba2e95fb1db2" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 4 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "why": "The knowledge base cannot decide 5 critical settings of module.vpc.module.vpc.aws_subnet.public: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 5 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-SUBNET-EFFECTIVE-ROUTE-TABLE", "kind": "effective-route-table", "family": "aws.subnet", "title": "Confirm which route table each subnet really uses", "block": "effective-route-table", "category": "network-exposure", "why": "The knowledge base cannot decide \"effective-route-table\" of the aws.subnet contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_subnet.public|effective-route-table" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.vpc.module.vpc.aws_subnet.public outside the draft; the plan states no title for it." }, { "id": "DEC-NET-AWS-SUBNET-NETWORK-TOPOLOGY-BOUNDARY", "kind": "network-topology-boundary", "family": "aws.subnet", "title": "Confirm that the project is the boundary of one network", "block": "network-topology-boundary", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-topology-boundary\" of the aws.subnet contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_subnet.public|network-topology-boundary" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.vpc.module.vpc.aws_subnet.public: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SUBNET-PREFIX", "kind": "prefix", "family": "aws.subnet", "title": "Review the prefix setting", "block": "cidr_block", "category": "network-exposure", "why": "The knowledge base cannot decide \"prefix\" of the aws.subnet contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_subnet.public|prefix" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Review the prefix setting for module.vpc.module.vpc.aws_subnet.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SUBNET-PRIVATE-EGRESS-IPV4", "kind": "private-egress-ipv4", "family": "aws.subnet", "title": "Decide how private servers reach the internet (outbound IPv4)", "block": "private-egress-ipv4", "category": "network-exposure", "why": "The knowledge base cannot decide \"private-egress-ipv4\" of the aws.subnet contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_subnet.public|private-egress-ipv4" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Decide how private servers reach the internet (outbound IPv4) for module.vpc.module.vpc.aws_subnet.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SUBNET-SUBNET-VPC-MEMBERSHIP", "kind": "subnet-vpc-membership", "family": "aws.subnet", "title": "Confirm which network each subnet belongs to", "block": "vpc_id", "category": "network-exposure", "why": "The knowledge base cannot decide \"subnet-vpc-membership\" of the aws.subnet contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "module.vpc.module.vpc.aws_subnet.public|subnet-vpc-membership" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.vpc.module.vpc.aws_subnet.public: the check, proof or closing evidence is recorded with its result." } ], "resolution": { "decision_id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC", "source_family": "aws.subnet", "source_semantic": "unit-review", "affected_units": [ "module.vpc.module.vpc.aws_subnet.public" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the prefix setting; the 5 settings of the record state their own.", "source_observation": "The source states 5 critical settings on module.vpc.module.vpc.aws_subnet.public that the knowledge base cannot decide: Confirm which route table each subnet really uses; Confirm that the project is the boundary of one network; Review the prefix setting; Decide how private servers reach the internet (outbound IPv4); Confirm which network each subnet belongs to.", "generated_target_behavior": "Confirm which route table each subnet really uses: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the prefix setting: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect). Decide how private servers reach the internet (outbound IPv4): The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect). Without a bound target environment the network keeps STACKIT's default gateway (routed and no_ipv4_gateway unset), so its servers can start outbound connections. With a target environment whose egress is none, every network the draft creates is written routed = false (an open egress decision, and a network narrower than the source: it reaches no other network either); with STACKIT's default routing it is written routed = true (wider than a source subnet without an internet route). The setting stays open for review in every case: no equivalence of the private egress is proven. Confirm which network each subnet belongs to: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Confirm which route table each subnet really uses: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the prefix setting: the target behaviour of this setting is not established Decide how private servers reach the internet (outbound IPv4): What the source subnet reaches (where unproven); that the servers of the subnet cannot reach the internet on the target, as on the source; and, where the source resolved private names, that the target resolves them. Confirm which network each subnet belongs to: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect now.", "next_action": "Review the prefix setting: Review the prefix setting for module.vpc.module.vpc.aws_subnet.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm which route table each subnet really uses: A check of the knowledge base (subnet route table undecided) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The subnet follows the VPC's main route table when no association names a route table.", "Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this subnet included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.", "Review the prefix setting: The value is not visible statically (a case of the mapping rule for this kind of unit), so nothing is credited for it. stackit_network.ipv4_prefix. TRANSFORMED for a CIDR the scan has seen. The draft carries the prefix as stackit_network.ipv4_prefix taken from a variable without a default (pinned provider: \"The IPv4 prefix of the network (CIDR)\") and says in the variable's description that the source CIDR is not visible; decide the CIDR each STACKIT network gets (the source CIDRs are reused unless the address plan changes) and enter it before plan.", "Decide how private servers reach the internet (outbound IPv4): A check of the knowledge base (subnet egress ipv4 unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The source and the target are not equivalent for outbound access, and the draft closes nothing: REVIEW.", "Confirm which network each subnet belongs to: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The VPC the subnet belongs to: the draft creates every network in one project, so the source VPC's boundary is kept only when the estate has one VPC and every resource that names a VPC provably names it; the draft states the estate's topology and what the architect decides about it once, at the top of its network file." ], "closes_when": [ "Confirm which route table each subnet really uses: A person decides which routes the subnet's network gets: the draft attaches no routing table to the network, and a STACKIT network gets a default gateway unless it is told not to, so what the subnet reaches can differ from AWS.", "Confirm which route table each subnet really uses: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which routes the subnet's network gets: the draft attaches no routing table to the network, and a STACKIT network gets a default gateway unless it is told not to, so what the subnet reaches can differ from AWS.", "Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the prefix setting: A literal value or a resolved reference in the source closes it, or a person confirms the value.", "Decide how private servers reach the internet (outbound IPv4): The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the check that fired asks, and that check's closing evidence or decision is recorded. Where the scan cannot prove what the source subnet reaches, the closing evidence is the route table the subnet follows and its default route by exact references, and for a route to an internet gateway the public IPv4 address of every server in the subnet, or an architect's statement of what the source subnet reaches. Where the source subnet has no internet route, it is an architect's decision that the network may reach the internet through the STACKIT gateway with the outbound limits written as security-group egress rules, a decision that the network is isolated (routed = false), or a documented or observed setting that removes the outbound path of a routed network.", "Decide how private servers reach the internet (outbound IPv4): A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Confirm which network each subnet belongs to: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm which network each subnet belongs to: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded." ], "required_inputs": [ "target.egress" ], "resolution_paths": [ { "id": "effective-route-table/decide-and-carry-out", "title": "Confirm which route table each subnet really uses: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.", "regeneration: not stated — treated as required" ], "risk": [ "The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes." ], "evidence": [ "contract note aws.subnet/effective-route-table: \"A person decides which routes the subnet's network gets: the draft attaches no routing table to the network, and a STACKIT network gets a default gateway unless it is told not to, so what the subnet reaches can differ from AWS.\"" ], "regeneration_required": true }, { "id": "network-topology-boundary/bring-the-closing-evidence", "title": "Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.subnet/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "regeneration_required": true }, { "id": "private-egress-ipv4/prove-what-the-source-subnet-reaches", "title": "Decide how private servers reach the internet (outbound IPv4): Prove what the source subnet reaches (what the check that cannot prove it asks for)", "prerequisites": [ "the route table the subnet follows and its default route, named by exact references in the source, and for a route to an internet gateway the public IPv4 address of every server in the subnet", "or an architect's statement of what the source subnet reaches" ], "effects": [ "A rerun on the source with the exact references reads the subnet as reaching the internet or not; the not-equivalent case then needs one of the other paths." ], "risk": [ "A statement that is wrong about the source makes the target wider or narrower than the source without a finding." ], "evidence": [ "rule aws.subnet/subnet-egress-ipv4-unproven of the knowledge base: \"or an architect's statement of what the source subnet reaches.\"" ], "regeneration_required": true }, { "id": "private-egress-ipv4/limit-egress-with-security-groups", "title": "Decide how private servers reach the internet (outbound IPv4): Accept the routed network and limit outbound traffic with security-group egress rules", "prerequisites": [ "the outbound traffic the workload really needs (protocol, port, destination)", "the allow-all default egress rule of each group removed after apply" ], "effects": [ "The network still has an internet path; what the servers may reach is limited by their groups' egress rules (an allow-list was observed enforced per destination, protocol and port).", "regeneration: not stated — treated as required" ], "risk": [ "A server whose group keeps an allow-all egress rule reaches the internet; the exposure is wider than the source's until the rules exist." ], "evidence": [ "decision kind stackitsg.default_egress.ipv4 of the knowledge base: \"Egress (Outbound) : All outgoing traffic is allowed by default.\"", "decision kind stackitsg.default_egress.ipv4 of the knowledge base: \"The group then allows only the egress rules the draft writes from the source, so its outbound IPv4 traffic is no wider than the source's.\"", "a test on a STACKIT project on 2026-10-10: \"Observed: on a stateful group an egress allow-list is enforced per destination, protocol and port\"" ], "regeneration_required": true }, { "id": "private-egress-ipv4/isolate-through-the-target-environment", "title": "Decide how private servers reach the internet (outbound IPv4): Isolate the networks: a bound target environment with egress none (routed = false)", "prerequisites": [ "the architect's decision that no network of the project must reach another or the internet (the setting applies to every network the draft creates)", "a target environment file stating egress mode NONE, bound to the run (target.egress then shows the bound statement)" ], "effects": [ "Every network is written routed = false: observed in a STACKIT test project to have no internet egress and no connection to the project's other networks. STACKIT documents no egress switch; this rests on the observation, not on documentation. routed cannot be changed by an update: a later change replaces the network." ], "risk": [ "The networks are cut off from each other as well (narrower than the source); the behaviour rests on observations in one STACKIT test project." ], "evidence": [ "the description of the target-environment profile in the product documentation: \"`NONE` writes `routed = false`: a non-routed network has no gateway, no public IP and no internet egress, and the project's other networks do not reach it either (observed in one project, probes 2 and 11)\"", "the generator of the draft: \"routed = false; a non-routed network has no gateway, no public IP and no internet egress\"", "rule aws.subnet/subnet-egress-ipv4-not-equivalent of the knowledge base: \"The sandbox observed a non-routed network to have no internet egress and no connection to the project's other networks\"", "provider-docs mirror stackit/docs.stackit.cloud/products/network/core-networking/network-area/faq.html: \"Currently we do not support this, however there are plans to enable this in the future.\"" ], "regeneration_required": true }, { "id": "subnet-vpc-membership/bring-the-closing-evidence", "title": "Confirm which network each subnet belongs to: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.subnet/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "regeneration_required": true } ], "required_verification": [ "Confirm which route table each subnet really uses: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result", "Decide how private servers reach the internet (outbound IPv4): an outbound connection from a server of the network to an internet address fails (or succeeds only where the decision allows it) on the target", "Decide how private servers reach the internet (outbound IPv4): where the source used private DNS: names resolve on the target through the resolvers the networks are given", "Confirm which network each subnet belongs to: the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes.", "An answer of target.egress applies nothing by itself (the answer is read, not applied); a bound target environment's egress changes routed on every network. Neither closes the setting." ], "remains_manual": [ "Confirm which route table each subnet really uses: Manual work remains: a person closes the semantic, the draft does not.", "Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.", "Decide how private servers reach the internet (outbound IPv4): Manual work remains: a person closes the semantic, the draft does not.", "Confirm which network each subnet belongs to: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.subnet/effective-route-table: \"A person decides which routes the subnet's network gets: the draft attaches no routing table to the network, and a STACKIT network gets a default gateway unless it is told not to, so what the subnet reaches can differ from AWS.\"", "contract note aws.subnet/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"", "contract note aws.subnet/subnet-vpc-membership: \"The VPC the subnet belongs to: the draft creates every network in one project\"", "contract note aws.subnet/private-egress-ipv4: \"so the source and the target are not equivalent and the draft closes nothing\"", "the description of the target-environment profile in the product documentation: \"In this build four of them have no handler (`target.project`, `target.egress`, `target.ingress.public`, `target.observability`): an answer is `READ_NOT_APPLIED`, and `inputs-template.yaml` therefore lists them last, in the group NOT APPLICABLE IN THIS BUILD\"", "STACKIT provider schema 0.120.0: \"the network doesn't have a gateway.\"", "STACKIT provider schema 0.120.0: \"If set to `true`, the network is routed and therefore accessible from other networks.\"", "STACKIT provider schema 0.120.0: \"The IPv4 nameservers of the network.\"", "STACKIT provider schema 0.120.0: \"Note: This field currently has no effect and does not enforce any access restrictions on the DNS zone.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect", "mode": "MANUAL", "phase": "FOUNDATION", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC", "kind": "unit-review", "family": "aws.subnet", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.subnet", "block": "module.vpc.module.vpc.aws_subnet.public", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.vpc.module.vpc.aws_subnet.public", "artifact": "assessment.json", "pointer": "/units/86" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.vpc.module.vpc.aws_subnet.public|availability-zone", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/19" } ], "instances": [ { "unit": "module.vpc.module.vpc.aws_subnet.public", "open": [], "closed": 0, "not_broken_down": "unknown_count", "semantic": "availability-zone" } ], "conditional_members": 1, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.vpc.module.vpc.aws_subnet.public", "artifact": "workspace.json", "pointer": "/units/85/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:011643d2054f5f8478b444cf7895470f87a6d43d3f75c6ef3ff169fcdffdbdc3", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.subnet/availability-zone", "sha256": "sha256:6fc844366b14cec6fef47b58ec6f51315a21f578c82f8b6ce6dfaef43afa1a6c" }, { "kind": "decision_kind", "id": "aws.subnet/availability-zone", "sha256": "sha256:0e687b53d36142d32908140a37a97f62928114877a0989cd496b1a31c0c03b48" }, { "kind": "review_cause", "id": "aws.subnet/availability-zone", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:b7c227d12f16960b694c76edaebeaa4eb6e1c2ce904c0f48e83f794a07fe3138" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "shape": "RSH-0002171813ad", "subject": "module.vpc.module.vpc.aws_subnet.public", "resolution": { "decision_id": "DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC", "source_family": "aws.subnet", "source_semantic": "unit-review", "affected_units": [ "module.vpc.module.vpc.aws_subnet.public" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "availability-resilience", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS", "kind": "unit-review", "family": "aws.vpc", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.vpc", "block": "module.vpc.module.vpc.aws_vpc.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.vpc.module.vpc.aws_vpc.this", "artifact": "assessment.json", "pointer": "/units/8" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.vpc.module.vpc.aws_vpc.this|default-nacl-rules", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/277" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_vpc.this|default-route-table", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/278" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_vpc.this|default-security-group-omitted-direction", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/279" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_vpc.this|main-table-set", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/281" }, { "kind": "semantic", "id": "module.vpc.module.vpc.aws_vpc.this|network-topology-boundary", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/282" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:4865af5a8e50259aa89eda3cb3004ce9ea97b5c15f0b1eca3b8d2b5c3f3514dd", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.vpc/default-nacl-rules", "sha256": "sha256:8ebcc2c505c19e85c562a54b351c4a129b25d52436a0393a16691b4c7e20ad5c" }, { "kind": "contract_semantic", "id": "aws.vpc/default-route-table", "sha256": "sha256:d30603d78aab37fb6fa255701bba13eceba97beee472c068713fd387c5f71c78" }, { "kind": "contract_semantic", "id": "aws.vpc/default-security-group-omitted-direction", "sha256": "sha256:84c6075dd8c71e425220c7bd0037c0e97b164aa370ae2199ba02417a8790901c" }, { "kind": "contract_semantic", "id": "aws.vpc/main-table-set", "sha256": "sha256:1803e1619f03e87c514ab1970d2399ab7d1a2a82ab527d505fa2337720b9c82b" }, { "kind": "contract_semantic", "id": "aws.vpc/network-topology-boundary", "sha256": "sha256:bb521d053843a208a04c4ce223552c480b048ac26009e3e9762034a1afb94fc5" }, { "kind": "review_cause", "id": "aws.vpc/default-nacl-rules", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.vpc/default-route-table", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.vpc/default-security-group-omitted-direction", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" }, { "kind": "review_cause", "id": "aws.vpc/main-table-set", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "aws.vpc/network-topology-boundary", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:b25af41cfbf903a0a38114116600fd7b6a404dd41e3651b6374d9b17e055b358" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 3 }, { "cause": "TARGET_LIMIT", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 5 critical settings of module.vpc.module.vpc.aws_vpc.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-VPC-DEFAULT-NACL-RULES", "kind": "default-nacl-rules", "family": "aws.vpc", "title": "Review the default nacl rules setting", "block": "default-nacl-rules", "category": "network-exposure", "why": "The knowledge base cannot decide \"default-nacl-rules\" of the aws.vpc contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.vpc.module.vpc.aws_vpc.this|default-nacl-rules" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for module.vpc.module.vpc.aws_vpc.this outside the draft; the plan states no title for it." }, { "id": "DEC-NET-AWS-VPC-DEFAULT-ROUTE-TABLE", "kind": "default-route-table", "family": "aws.vpc", "title": "Review the default route table setting", "block": "default-route-table", "category": "network-exposure", "why": "The knowledge base cannot decide \"default-route-table\" of the aws.vpc contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.vpc.module.vpc.aws_vpc.this|default-route-table" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-VPC-DEFAULT-SECURITY-GROUP-OMITTED-DIRECTION", "kind": "default-security-group-omitted-direction", "family": "aws.vpc", "title": "Review the default security group omitted direction setting", "block": "default-security-group-omitted-direction", "category": "network-exposure", "why": "The knowledge base cannot decide \"default-security-group-omitted-direction\" of the aws.vpc contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.vpc.module.vpc.aws_vpc.this|default-security-group-omitted-direction" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-VPC-MAIN-TABLE-SET", "kind": "main-table-set", "family": "aws.vpc", "title": "Review the main table set setting", "block": "main-table-set", "category": "network-exposure", "why": "The knowledge base cannot decide \"main-table-set\" of the aws.vpc contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.vpc.module.vpc.aws_vpc.this|main-table-set" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-VPC-NETWORK-TOPOLOGY-BOUNDARY", "kind": "network-topology-boundary", "family": "aws.vpc", "title": "Confirm that the project is the boundary of one network", "block": "network-topology-boundary", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-topology-boundary\" of the aws.vpc contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.vpc.module.vpc.aws_vpc.this|network-topology-boundary" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result." } ], "resolution": { "decision_id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS", "source_family": "aws.vpc", "source_semantic": "unit-review", "affected_units": [ "module.vpc.module.vpc.aws_vpc.this" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "network-security", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Review the default nacl rules setting; the 5 settings of the record state their own.", "source_observation": "The source states 5 critical settings on module.vpc.module.vpc.aws_vpc.this that the knowledge base cannot decide: Review the default nacl rules setting; Review the default route table setting; Review the default security group omitted direction setting; Review the main table set setting; Confirm that the project is the boundary of one network.", "generated_target_behavior": "Review the default nacl rules setting: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the default route table setting: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the default security group omitted direction setting: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the main table set setting: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the default nacl rules setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the default route table setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the default security group omitted direction setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the main table set setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect now.", "next_action": "Review the default nacl rules setting: Carry out the manual work the plan names for module.vpc.module.vpc.aws_vpc.this outside the draft; the plan states no title for it.", "why_open": [ "Review the default nacl rules setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The account's default network ACL is adopted by the VPC (aws_default_network_acl); a deny rule, a rule that is not all-protocol, a CIDR other than 0.0.0.0/0 or ::/0, or an explicitly empty rule list narrows or leaves undecided what the AWS default allow-all states.", "Review the default route table setting: A check of the knowledge base (vpc main table undecided) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The account's default route table is adopted (a facet of the VPC, aws_default_route_table, AWS provider 6.66.0). Routes other than a plain 0.0.0.0/0 to an internet or NAT gateway are REVIEW.", "Review the default security group omitted direction setting: A check of the knowledge base (vpc default sg no ingress rules) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The adopted default security group of the VPC (a facet, aws_default_security_group) does not state an ingress or an egress direction. Nothing is drafted for this facet, so the empty direction is not reproduced: a person decides whether servers that used the default group must stay without outbound traffic (delete the allow-all egress rules of the STACKIT group after apply) or are meant to have it, and puts them in a STACKIT group that states no ingress rule, not in the project's default group.", "Review the main table set setting: A check of the knowledge base (vpc main table undecided) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting names the route table that is the main route table of the VPC, when the configuration sets it or the scan cannot tell. STACKIT has no main route table.", "Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). STACKIT has no VPC container in its stable model: the project is the boundary of its networks and its virtual router routes between all networks of one project (docs.stackit.cloud core-networking architecture, updated Aug 20, 2026: \"Routing between multiple Virtual Networks in the same project\"; SNA \"extends the networking architecture to enable cross-project connectivity\"). Several VPCs, or a count the scan cannot see: the draft puts every network in the one var.project_id and cannot keep them apart — REVIEW, the choice is the architect's. A unit that names a VPC, or is placed in a subnet (subnet_id, subnets, vpc_config.subnet_ids, ...), without one whole reference to the VPC or to a subnet of the estate may stand in a VPC the estate does not create: the architect decides it the same way (REVIEW)." ], "closes_when": [ "Review the default nacl rules setting: A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.", "Review the default route table setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the default route table setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the default security group omitted direction setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the default security group omitted direction setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the main table set setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Review the main table set setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded." ], "required_inputs": [], "resolution_paths": [ { "id": "default-nacl-rules/carry-out-by-hand", "title": "Review the default nacl rules setting: Carry out the work the knowledge base's note names, by hand", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person does the work outside the draft; StackToIT neither does nor verifies it.", "regeneration: not stated — treated as required" ], "risk": [ "The work is not in the draft, so it is forgotten unless it is planned as a manual step." ], "evidence": [ "contract note aws.vpc/default-nacl-rules: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"" ], "regeneration_required": true }, { "id": "default-route-table/bring-the-closing-evidence", "title": "Review the default route table setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.vpc/default-route-table: \"The account's default route table is adopted (a facet of the VPC, aws_default_route_table, AWS provider 6.66.0).\"" ], "regeneration_required": true }, { "id": "default-security-group-omitted-direction/bring-the-closing-evidence", "title": "Review the default security group omitted direction setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.vpc/default-security-group-omitted-direction: \"The adopted default security group of the VPC (a facet, aws_default_security_group) does not state an ingress or an egress direction.\"" ], "regeneration_required": true }, { "id": "main-table-set/bring-the-closing-evidence", "title": "Review the main table set setting: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.vpc/default-route-table: \"The account's default route table is adopted (a facet of the VPC, aws_default_route_table, AWS provider 6.66.0).\"" ], "regeneration_required": true }, { "id": "network-topology-boundary/bring-the-closing-evidence", "title": "Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.vpc/default-route-table: \"The account's default route table is adopted (a facet of the VPC, aws_default_route_table, AWS provider 6.66.0).\"" ], "regeneration_required": true } ], "required_verification": [ "Review the default nacl rules setting: the decision or the manual work is done and recorded (who, when, what was configured and why)", "Review the default route table setting: the check, proof or closing evidence is recorded with its result", "Review the default security group omitted direction setting: the check, proof or closing evidence is recorded with its result", "Review the main table set setting: the check, proof or closing evidence is recorded with its result", "Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the default nacl rules setting: Manual work remains: a person closes the semantic, the draft does not.", "Review the default route table setting: Manual work remains: a person closes the semantic, the draft does not.", "Review the default security group omitted direction setting: Manual work remains: a person closes the semantic, the draft does not.", "Review the main table set setting: Manual work remains: a person closes the semantic, the draft does not.", "Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.vpc/default-nacl-rules: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/tcfp-default-network-acl--egress--action: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/tcfp-default-network-acl--egress--cidr-block: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/tcfp-default-network-acl--egress--from-port: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/tcfp-default-network-acl--egress--ipv6-cidr-block: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/tcfp-default-network-acl--egress--protocol: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/tcfp-default-network-acl--egress--rule-no: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/tcfp-default-network-acl--egress--to-port: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/tcfp-default-network-acl--ingress--action: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/tcfp-default-network-acl--ingress--cidr-block: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/tcfp-default-network-acl--ingress--from-port: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/tcfp-default-network-acl--ingress--ipv6-cidr-block: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/tcfp-default-network-acl--ingress--protocol: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/tcfp-default-network-acl--ingress--rule-no: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/tcfp-default-network-acl--ingress--to-port: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"", "contract note aws.vpc/default-route-table: \"The account's default route table is adopted (a facet of the VPC, aws_default_route_table, AWS provider 6.66.0).\"", "contract note aws.vpc/main-table-set: \"The setting names the route table that is the main route table of the VPC, when the configuration sets it or the scan cannot tell.\"", "contract note aws.vpc/network-topology-boundary: \"STACKIT has no VPC container in its stable model: the project is the boundary of its networks and its virtual router routes between all networks of one project (docs.stackit.cloud core-networking arch\"", "contract note aws.vpc/default-security-group-omitted-direction: \"The adopted default security group of the VPC (a facet, aws_default_security_group) does not state an ingress or an egress direction.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect", "mode": "MANUAL", "phase": "FOUNDATION", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS", "kind": "unit-review", "family": "aws.vpc", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-aws.vpc", "block": "module.vpc.module.vpc.aws_vpc.this", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "module.vpc.module.vpc.aws_vpc.this", "artifact": "assessment.json", "pointer": "/units/8" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "module.vpc.module.vpc.aws_vpc.this|dns-settings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/280" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:922a8c15b2b7499818c932ef55606b1e59f94f004ed39d782da13bce247b427c", "kb_dependencies": [ { "kind": "contract_semantic", "id": "aws.vpc/dns-settings", "sha256": "sha256:bfc22d8464b3de0e531fa7dd811e57729b71f9199afbcd422e3a30d4a1210296" }, { "kind": "review_cause", "id": "aws.vpc/dns-settings", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:cf773f243b88c0f4a074eff319871c3bb5787549b954a01a750246bcb33248c9" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of module.vpc.module.vpc.aws_vpc.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-OPS-AWS-VPC-DNS-SETTINGS", "kind": "dns-settings", "family": "aws.vpc", "title": "Confirm how names resolve for the servers of the migrated networks", "block": "enable_dns_hostnames", "category": "availability-durability", "why": "The knowledge base cannot decide \"dns-settings\" of the aws.vpc contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "module.vpc.module.vpc.aws_vpc.this|dns-settings" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result." } ], "resolution": { "decision_id": "DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS", "source_family": "aws.vpc", "source_semantic": "unit-review", "affected_units": [ "module.vpc.module.vpc.aws_vpc.this" ], "affected_application": [], "action_type": "VERIFY_BEHAVIOR", "work_package": "private-egress-dns", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "REQUIRES_VERIFICATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "the guidance closes it by a runtime or validation result", "source_observation": "The source states 1 critical setting on module.vpc.module.vpc.aws_vpc.this that the knowledge base cannot decide: Confirm how names resolve for the servers of the migrated networks.", "generated_target_behavior": "Confirm how names resolve for the servers of the migrated networks: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/dns-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Confirm how names resolve for the servers of the migrated networks: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_vpc.this/dns-settings now.", "next_action": "Confirm how names resolve for the servers of the migrated networks: Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result.", "why_open": [ "Confirm how names resolve for the servers of the migrated networks: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. enable_dns_support and enable_dns_hostnames of the VPC decide how names resolve for what runs in it; STACKIT has no VPC object (each subnet becomes a stackit_network)." ], "closes_when": [ "Confirm how names resolve for the servers of the migrated networks: A person confirms how names resolve for the servers of the migrated networks." ], "required_inputs": [], "resolution_paths": [ { "id": "dns-settings/verify-on-target", "title": "Confirm how names resolve for the servers of the migrated networks: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.vpc/dns-settings: \"A person confirms how names resolve for the servers of the migrated networks.\"" ], "regeneration_required": true } ], "required_verification": [ "Confirm how names resolve for the servers of the migrated networks: the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Confirm how names resolve for the servers of the migrated networks: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.vpc/dns-settings: \"A person confirms how names resolve for the servers of the migrated networks.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/module.vpc.module.vpc.aws_vpc.this/dns-settings", "mode": "MANUAL", "phase": "FOUNDATION", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-OPS-STACKITLOGS-ACTION-ARCHIVE-FLOW", "kind": "ARCHIVE_FLOW", "family": "stackitlogs", "source": "MANUAL_ACTION", "group": "GRP-MANUAL-ACTION-stackitlogs", "block": "ARCHIVE_FLOW", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "TECHNICAL_VALIDATION_PASSED", "owner_role": "Platform Architect", "required_by_phase": "CUTOVER_PREREQUISITE", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "artifact": "assessment.json", "pointer": "/units/1" } ], "affected_applications": [], "members": [ { "kind": "action", "id": "stackitlogs:archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "artifact": "workspace.json", "pointer": "/units/26/deployment_prerequisites/manual_actions/0" } ], "options": [], "recommended_option": null, "blocking_effect": "MANUAL_ACTION_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "artifact": "workspace.json", "pointer": "/units/26/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:bb64988972ed356df4aa14fc8e54b8401f2f06a46c9738974e9ce41147d7a9f6", "kb_dependencies": [ { "kind": "review_cause", "id": "stackitlogs/ARCHIVE_FLOW", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" } ], "kb_dependencies_sha256": "sha256:d0c401dfda1e6d6567b70698edf5199e12079a6a9e38903447cf4935fed73c0c" }, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The plan of the draft lists the stackitlogs manual action kind \"archive flow\" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.", "required_evidence": [], "resolution": { "decision_id": "DEC-OPS-STACKITLOGS-ACTION-ARCHIVE-FLOW", "source_family": "stackitlogs", "source_semantic": "ARCHIVE_FLOW", "affected_units": [ "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "CUTOVER_PREREQUISITE", "raw_semantic_status": "MANUAL_ACTION_OPEN", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "the plan names manual work outside the draft", "source_observation": "The plan names manual work (archive flow) on module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks.", "generated_target_behavior": "The draft does not do this work; the plan lists it as manual work.", "residual_difference": "the work outside the draft is neither done nor verified by StackToIT", "execution_effect": "No step waits for it. Held by something else first: MAN/logs/archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks.", "next_action": "Outside the draft, for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: Configure a cold-storage log flow for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: send a copy of its logs, in parallel to the Logs instance stackit_logs_instance.logs_retention_180d, to a long-term store (for example a separate Object Storage bucket) that keeps them for the retention beyond 180 days; the plan lists it as manual work.", "why_open": [ "The plan of the draft lists the stackitlogs manual action kind \"archive flow\" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan." ], "closes_when": [ "a line the log producers of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks send is found both in the Logs instance and in the archive, and logs older than 180 days are readable from the archive" ], "required_inputs": [ "where the archive is kept (for example an Object Storage bucket) and the retention in days the workload needs there (the source keeps its logs for ever)" ], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/logs/archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "mode": "MANUAL", "phase": "PLATFORM", "executable": false, "waits_for_this": false } ] } }, { "id": "DEC-OPS-STACKITLOGS-ACTION-LABEL-CONVENTION", "kind": "LABEL_CONVENTION", "family": "stackitlogs", "source": "MANUAL_ACTION", "group": "GRP-MANUAL-ACTION-stackitlogs", "block": "LABEL_CONVENTION", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "TECHNICAL_VALIDATION_PASSED", "owner_role": "Platform Architect", "required_by_phase": "CUTOVER_PREREQUISITE", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "artifact": "assessment.json", "pointer": "/units/1" } ], "affected_applications": [], "members": [ { "kind": "action", "id": "stackitlogs:label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "artifact": "workspace.json", "pointer": "/units/26/deployment_prerequisites/manual_actions/1" } ], "options": [], "recommended_option": null, "blocking_effect": "MANUAL_ACTION_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "artifact": "workspace.json", "pointer": "/units/26/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:b58c0c06f680feba6220276e5fbad92f2c72b3b306439aa1b3976d3534797a14", "kb_dependencies": [ { "kind": "review_cause", "id": "stackitlogs/LABEL_CONVENTION", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:38945168b2f2937f0a3aa90cbabea8d4da46e1be8e809d7ead7bbb6d8d5c595b" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The plan of the draft lists the stackitlogs manual action kind \"label convention\" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.", "required_evidence": [], "resolution": { "decision_id": "DEC-OPS-STACKITLOGS-ACTION-LABEL-CONVENTION", "source_family": "stackitlogs", "source_semantic": "LABEL_CONVENTION", "affected_units": [ "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "CUTOVER_PREREQUISITE", "raw_semantic_status": "MANUAL_ACTION_OPEN", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "the plan names manual work outside the draft", "source_observation": "The plan names manual work (label convention) on module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks.", "generated_target_behavior": "The draft does not do this work; the plan lists it as manual work.", "residual_difference": "the work outside the draft is neither done nor verified by StackToIT", "execution_effect": "No step waits for it. The plan can start MAN/logs/label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks now.", "next_action": "Outside the draft, for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: Choose a static label and send the name of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (and of its streams) from its log producers as the value of that label; the plan lists it as manual work.", "why_open": [ "The plan of the draft lists the stackitlogs manual action kind \"label convention\" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan." ], "closes_when": [ "a static label is chosen, the log producers of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks send its name as the value of that label, and a line one of them sends is found by that label" ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/logs/label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-OPS-STACKITLOGS-ACTION-TARGET-PRECONDITION", "kind": "TARGET_PRECONDITION", "family": "stackitlogs", "source": "MANUAL_ACTION", "group": "GRP-MANUAL-ACTION-stackitlogs", "block": "TARGET_PRECONDITION", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "TECHNICAL_VALIDATION_PASSED", "owner_role": "Platform Architect", "required_by_phase": "CUTOVER_PREREQUISITE", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "artifact": "assessment.json", "pointer": "/units/1" } ], "affected_applications": [], "members": [ { "kind": "action", "id": "stackitlogs:token:stackit_logs_instance.logs_retention_180d", "artifact": "workspace.json", "pointer": "/units/26/deployment_prerequisites/manual_actions/2" } ], "options": [], "recommended_option": null, "blocking_effect": "MANUAL_ACTION_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "artifact": "workspace.json", "pointer": "/units/26/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:869fcb456492cde1234d12ef703bdb950ac8fd8e22799b1525a5563d29e506d0", "kb_dependencies": [ { "kind": "review_cause", "id": "stackitlogs/TARGET_PRECONDITION", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:78614094fd30d57756cdc7e437d195104e62ff218fd21a5e386a86d5a8ca8f41" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The plan of the draft lists the stackitlogs manual action kind \"target precondition\" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.", "required_evidence": [], "resolution": { "decision_id": "DEC-OPS-STACKITLOGS-ACTION-TARGET-PRECONDITION", "source_family": "stackitlogs", "source_semantic": "TARGET_PRECONDITION", "affected_units": [ "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "CUTOVER_PREREQUISITE", "raw_semantic_status": "MANUAL_ACTION_OPEN", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "the plan names manual work outside the draft", "source_observation": "The plan names manual work (target precondition) on module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks.", "generated_target_behavior": "The draft does not do this work; the plan lists it as manual work.", "residual_difference": "the work outside the draft is neither done nor verified by StackToIT", "execution_effect": "No step waits for it. The plan can start MAN/logs/token:stackit_logs_instance.logs_retention_180d now.", "next_action": "Outside the draft, for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: Before any log source writes to stackit_logs_instance.logs_retention_180d: create a write access token for the instance (stackit_logs_access_token with the permission write), set the access control list of the instance, and point the shipper at the instance's ingest_url (Loki API) or ingest_otlp_url (OpenTelemetry); the plan lists it as manual work.", "why_open": [ "The plan of the draft lists the stackitlogs manual action kind \"target precondition\" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan." ], "closes_when": [ "a write access token for stackit_logs_instance.logs_retention_180d exists, the access control list of the instance is set, and a log line sent with the token to the ingest address of the instance is accepted" ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/logs/token:stackit_logs_instance.logs_retention_180d", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-SEC-STACKITSG-ACTION-INCOMPLETE", "kind": "INCOMPLETE", "family": "stackitsg", "source": "MANUAL_ACTION", "group": "GRP-MANUAL-ACTION-stackitsg", "block": "INCOMPLETE", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "TECHNICAL_VALIDATION_PASSED", "owner_role": "Security Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "artifact": "assessment.json", "pointer": "/units/11" } ], "affected_applications": [], "members": [ { "kind": "action", "id": "awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules", "artifact": "workspace.json", "pointer": "/units/39/deployment_prerequisites/manual_actions/0" }, { "kind": "action", "id": "awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules", "artifact": "workspace.json", "pointer": "/units/39/deployment_prerequisites/manual_actions/1" } ], "options": [], "recommended_option": null, "blocking_effect": "MANUAL_ACTION_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "artifact": "workspace.json", "pointer": "/units/39/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:246f8bd919be5928fd53549dda1b5936212a68d1c144c86e55d5ed6b3e165741", "kb_dependencies": [ { "kind": "review_cause", "id": "stackitsg/INCOMPLETE", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:82b7420c25df2b3e3dce07530fedb0c73f975b628559ac3addd227886f46cbeb" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The plan of the draft lists the stackitsg manual action kind \"incomplete\" (2 actions): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.", "required_evidence": [], "resolution": { "decision_id": "DEC-SEC-STACKITSG-ACTION-INCOMPLETE", "source_family": "stackitsg", "source_semantic": "INCOMPLETE", "affected_units": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "MANUAL_ACTION_OPEN", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "the plan names manual work outside the draft", "source_observation": "The plan names manual work (incomplete) on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.", "generated_target_behavior": "The draft does not do this work; the plan lists it as manual work.", "residual_difference": "the work outside the draft is neither done nor verified by StackToIT", "execution_effect": "No step waits for it. The plan can start MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules-b506f3 and MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules-a538f6 now.", "next_action": "Outside the draft, for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: Re-create the rules beyond the known set of group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules) (and 1 more manual steps); the plan lists it as manual work.", "why_open": [ "The plan of the draft lists the stackitsg manual action kind \"incomplete\" (2 actions): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan." ], "closes_when": [ "every entry of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules is known and has a rule, or it is confirmed that the known entries are all", "every entry of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules is known and has a rule, or it is confirmed that the known entries are all" ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules-b506f3", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false }, { "id": "MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules-a538f6", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-SEC-STACKITSG-ACTION-UNPLACED", "kind": "UNPLACED", "family": "stackitsg", "source": "MANUAL_ACTION", "group": "GRP-MANUAL-ACTION-stackitsg", "block": "UNPLACED", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "TECHNICAL_VALIDATION_PASSED", "owner_role": "Security Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "artifact": "assessment.json", "pointer": "/units/11" } ], "affected_applications": [], "members": [ { "kind": "action", "id": "awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]", "artifact": "workspace.json", "pointer": "/units/39/deployment_prerequisites/manual_actions/2" }, { "kind": "action", "id": "awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]", "artifact": "workspace.json", "pointer": "/units/39/deployment_prerequisites/manual_actions/3" } ], "options": [], "recommended_option": null, "blocking_effect": "MANUAL_ACTION_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "artifact": "workspace.json", "pointer": "/units/39/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:c30c890a1799d91f5c3dd6213a6e7ae3d8c381d635b1bb48ea9a45e4efebf255", "kb_dependencies": [ { "kind": "review_cause", "id": "stackitsg/UNPLACED", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:1e0b3d10d12c2152345db3e5a14df278ba329f473967455f9158fa0eb219684a" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The plan of the draft lists the stackitsg manual action kind \"unplaced\" (2 actions): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.", "required_evidence": [], "resolution": { "decision_id": "DEC-SEC-STACKITSG-ACTION-UNPLACED", "source_family": "stackitsg", "source_semantic": "UNPLACED", "affected_units": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "MANUAL_ACTION_OPEN", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "the plan names manual work outside the draft", "source_observation": "The plan names manual work (unplaced) on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.", "generated_target_behavior": "The draft does not do this work; the plan lists it as manual work.", "residual_difference": "the work outside the draft is neither done nor verified by StackToIT", "execution_effect": "No step waits for it. The plan can start MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules.0-217968 and MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules.0-f26028 now.", "next_action": "Outside the draft, for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] on the security group it belongs to and write it (and 1 more manual steps); the plan lists it as manual work.", "why_open": [ "The plan of the draft lists the stackitsg manual action kind \"unplaced\" (2 actions): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan." ], "closes_when": [ "the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] is written on the security group it belongs to", "the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] is written on the security group it belongs to" ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules.0-217968", "mode": "MANUAL", "phase": "PREPARE", "executable": true, "waits_for_this": false }, { "id": "MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules.0-f26028", "mode": "MANUAL", "phase": "PREPARE", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-NET-STACKITROUTE-STATEMENT-NOT-DRAFTED", "kind": "NOT_DRAFTED", "family": "stackitroute", "source": "PLAN_STATEMENT", "group": "GRP-PLAN-STATEMENT-stackitroute", "block": "NOT_DRAFTED", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "module.vpc.module.vpc.aws_route_table.private", "artifact": "assessment.json", "pointer": "/units/78" }, { "kind": "unit", "id": "module.vpc.module.vpc.aws_route_table.public", "artifact": "assessment.json", "pointer": "/units/79" } ], "affected_applications": [], "members": [ { "kind": "plan_statement", "id": "stackitroute:statement:module.vpc.module.vpc.aws_route_table.private", "artifact": "workspace.json", "pointer": "/units/77/plan_statements/0" }, { "kind": "plan_statement", "id": "stackitroute:statement:module.vpc.module.vpc.aws_route_table.public", "artifact": "workspace.json", "pointer": "/units/78/plan_statements/0" } ], "options": [], "recommended_option": null, "blocking_effect": "PLAN_STATEMENT_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.vpc.module.vpc.aws_route_table.private", "artifact": "workspace.json", "pointer": "/units/77/trace" }, { "kind": "evidence", "id": "module.vpc.module.vpc.aws_route_table.public", "artifact": "workspace.json", "pointer": "/units/78/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:650b81a7db5184350b172778d82ba46d11cd6e33c14f6a6e897d1c2e161a6fdb", "kb_dependencies": [ { "kind": "review_cause", "id": "stackitroute/NOT_DRAFTED", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:4d101cce382446307a7bc4915ae3b5bdd3448296b22e9c0fe9e3e5508a3d60e0" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 2 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "why": "The stackitroute plan of the draft writes no resource for 2 units and states why (no resource is written for the unit and the plan names a step beside it): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.", "required_evidence": [], "resolution": { "decision_id": "DEC-NET-STACKITROUTE-STATEMENT-NOT-DRAFTED", "source_family": "stackitroute", "source_semantic": "NOT_DRAFTED", "affected_units": [ "module.vpc.module.vpc.aws_route_table.private", "module.vpc.module.vpc.aws_route_table.public" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "routing-architecture", "owner_role": "Network Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "PLAN_STATEMENT_OPEN", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "guidance_ref": "stackitroute-not-drafted/NOT_DRAFTED", "state_reason": "the plan writes no resource for the unit and names the work a person does instead", "source_observation": "The plan writes no resource for module.vpc.module.vpc.aws_route_table.private: STACKIT's default routing replaces the table, with a loss: a route of the table sends traffic to a NAT gateway (the others, if any, to an internet gateway), and the reachability is observed on the target for a project outside a Network Area, which this draft does not write. Observed in one sandbox project outside a Network Area (tested on a STACKIT project on 2026-10-10; routing tables are refused there): a routed network reaches the internet with no route and no routing table configured, a server without a public IP through the network's shared SNAT address and a server with a public IP through its own; nothing initiated from the internet reached a server behind the network address; egress is restricted by the egress rules of security groups, not by a route; routed networks reach each other with no table. No stackit_routing_table is drafted. A NAT gateway adds what an internet route does not. Its fixed egress address is LOST (observed): the address a routed STACKIT network leaves by is the network's publicIp, one address for every routed network of the project, not fixed (it changed twice when every network of the project was deleted) and not settable (a PATCH of it answers 202 and is ignored), so a third party's allow-list on the NAT gateway's address does not survive; a STACKIT public IP per server keeps its address, the only one the probe saw stay fixed. The egress restriction (the gateway as the only way out of a private subnet) is carried by the egress rules of security groups, not by a route (observed); whether the source restricts egress that way is for the architect. The absence of inbound paths of a private subnet is observed for a server without a public IP (tcp 22, 80 and 8080 on the network address). Not observed: a Network Area and its default routing table. The outbound address of the servers an allow-list names is the architect's choice: keep the changing address, or give each server that an allow-list names a STACKIT public IP. The plan writes no resource for module.vpc.module.vpc.aws_route_table.public: STACKIT's default routing replaces the table: every route of the table sends traffic to an internet gateway, and the equivalence is observed on the target for a project outside a Network Area, which this draft does not write. Observed in one sandbox project outside a Network Area (tested on a STACKIT project on 2026-10-10; routing tables are refused there): a routed network reaches the internet with no route and no routing table configured, a server without a public IP through the network's shared SNAT address and a server with a public IP through its own; nothing initiated from the internet reached a server behind the network address; egress is restricted by the egress rules of security groups, not by a route; routed networks reach each other with no table. No stackit_routing_table is drafted. Observed in one project of one region on one day, so not HIGH; not observed: a Network Area and its default routing table, where this would be open again. The draft writes no routing table for a table whose routes all send traffic to an internet gateway: STACKIT's default routing gave a routed network the same reachability in one STACKIT test project outside a Network Area. The default routing table of a Network Area was never read.", "generated_target_behavior": "The draft writes no resource for module.vpc.module.vpc.aws_route_table.private and module.vpc.module.vpc.aws_route_table.public. No stackit_routing_table is written; the plan names the precondition step: create the target project outside a Network Area.", "residual_difference": "The reachability inside a Network Area, and for a server without a public IP the new outbound path: it leaves through the network's shared SNAT address, which the source's internet gateway did not give it.", "execution_effect": "No step waits for it. The plan can start MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.private and MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.public now. Held by something else first: DEC/routing/DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST.", "next_action": "Outside the draft, for module.vpc.module.vpc.aws_route_table.private and module.vpc.module.vpc.aws_route_table.public: Create the target project outside a Network Area: module.vpc.module.vpc.aws_route_table.private is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area (and 2 more manual steps); the plan lists it as manual work.", "why_open": [ "The stackitroute plan of the draft writes no resource for 2 units and states why (no resource is written for the unit and the plan names a step beside it): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan." ], "closes_when": [ "The knowledge base states no closing condition for a statement of the plan; it is done when the target project exists outside a Network Area and the reachability of its networks is observed on it.", "the target project exists outside a Network Area, or the architect has decided how module.vpc.module.vpc.aws_route_table.private is replaced inside the area", "the decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST is answered (accepted or rejected, with its evidence) in the inputs of the run and is no longer open when the run is repeated", "the target project exists outside a Network Area, or the architect has decided how module.vpc.module.vpc.aws_route_table.public is replaced inside the area" ], "required_inputs": [ "the STACKIT project the draft is created in (var.project_id) and whether it lies inside a Network Area", "the answer to the decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST" ], "resolution_paths": [ { "id": "create-the-project-outside-an-area", "title": "Create the target project outside a Network Area, as the plan's precondition step says", "prerequisites": [ "a target project that is not part of a Network Area (var.project_id naming one inside an area is not covered)" ], "effects": [ "The default routing replaces the table; nothing is drafted." ], "risk": [ "Inside an area the statement does not hold and the table is open again." ], "evidence": [ "decision kind stackitroute.NAT_FIXED_EGRESS_ADDRESS_LOST of the knowledge base: \"When creating the first network in a public project, STACKIT automatically creates and assigns a public IP for all Virtual Networks. It supports outbound internet access but does not allow traffic initiated from the public internet to reach your resources.\"", "a test on a STACKIT project on 2026-10-10: \"Not inferred: a routing table. The API shows none and the probe makes no statement about the table of a Network Area; only that the connectivity exists without one in this project.\"" ], "regeneration_required": false } ], "required_verification": [ "the target project's type (outside a Network Area) and the reachability observed on it" ], "next_run_changes": [ "Without a bound target environment a rerun states the same precondition. A target environment that places the project in a Network Area, or states an egress other than STACKIT's default routing, reopens the equivalence: the table is held for an architect with an open decision on the routing equivalence instead of this statement." ], "remains_manual": [ "Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "decision kind stackitroute.route-set of the knowledge base: \"Every routed network follows the default routing table of its Network Area unless another is assigned\"", "the generator of the draft: \"A target environment that places the project in a Network Area, or states an outbound path other than STACKIT's routed default, is\"", "the description of the target-environment profile in the product documentation: \"or states an egress other than `ROUTED_DEFAULT`, reopens the equivalence: the table is held for an architect with the open decision `TARGET_ROUTING_EQUIVALENCE_UNPROVEN`\"" ], "related_execution_steps": [ { "id": "MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.private", "mode": "MANUAL", "phase": "PREPARE", "executable": true, "waits_for_this": false }, { "id": "DEC/routing/stackitroute:module.vpc.module.vpc.aws_route_table.private:NAT_FIXED_EGRESS_ADDRESS_LOST", "mode": "MANUAL", "phase": "PREPARE", "executable": false, "waits_for_this": false }, { "id": "MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.public", "mode": "MANUAL", "phase": "PREPARE", "executable": true, "waits_for_this": false } ] } }, { "id": "DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW", "kind": "MANUAL_REVIEW", "family": "stackitsa", "source": "PLAN_STATEMENT", "group": "GRP-PLAN-STATEMENT-stackitsa", "block": "MANUAL_REVIEW", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/29" }, { "kind": "unit", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/40" }, { "kind": "unit", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/42" }, { "kind": "unit", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/41" }, { "kind": "unit", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "artifact": "assessment.json", "pointer": "/units/43" } ], "affected_applications": [], "members": [ { "kind": "plan_statement", "id": "stackitsa:statement:module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/40/plan_statements/0" }, { "kind": "plan_statement", "id": "stackitsa:statement:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/44/plan_statements/0" }, { "kind": "plan_statement", "id": "stackitsa:statement:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/48/plan_statements/0" }, { "kind": "plan_statement", "id": "stackitsa:statement:module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/52/plan_statements/0" }, { "kind": "plan_statement", "id": "stackitsa:statement:module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/56/plan_statements/0" } ], "options": [], "recommended_option": null, "blocking_effect": "PLAN_STATEMENT_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/40/trace" }, { "kind": "evidence", "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/44/trace" }, { "kind": "evidence", "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/48/trace" }, { "kind": "evidence", "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/52/trace" }, { "kind": "evidence", "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "artifact": "workspace.json", "pointer": "/units/56/trace" } ], "review_binding": { "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "kb_version": "0.384.0", "kb_sha256": "fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9", "members_sha256": "sha256:8ae94bd60884e4f89887095201ccae2cb675b6de0ca40c6d52a7a14653c82f28", "kb_dependencies": [ { "kind": "review_cause", "id": "stackitsa/MANUAL_REVIEW", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:83a8f6eef89167b4a870555fd2ffcf930e8e1486e7893eb941efdfcf7f52cb49" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 5 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The stackitsa plan of the draft writes no resource for 5 units and states why (the plan states the cause for each unit: module.retail_app_ecs.module.carts_service.aws_ecs_service.this: module.retail_app_ecs.module.carts_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); module.retail_app_ecs.module.checkout_service.aws_ecs_service.this: module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); and 2 more): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.", "required_evidence": [], "resolution": { "decision_id": "DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW", "source_family": "stackitsa", "source_semantic": "MANUAL_REVIEW", "affected_units": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "module.retail_app_ecs.module.ui_service.aws_ecs_service.this" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "PLAN_STATEMENT_OPEN", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "the plan writes no resource for the unit and names the work a person does instead", "source_observation": "The plan writes no resource for module.retail_app_ecs.module.carts_service.aws_ecs_service.this: module.retail_app_ecs.module.carts_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person). The plan writes no resource for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person). The plan writes no resource for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this: module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person). The plan writes no resource for module.retail_app_ecs.module.orders_service.aws_ecs_service.this: module.retail_app_ecs.module.orders_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person). The plan writes no resource for module.retail_app_ecs.module.ui_service.aws_ecs_service.this: module.retail_app_ecs.module.ui_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person).", "generated_target_behavior": "The draft writes no resource for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this and 1 more.", "residual_difference": "the work outside the draft is neither done nor verified by StackToIT", "execution_effect": "No step waits for it. The plan can start MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.execution_role_arn-586451, MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.task_role_arn-686488, MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.execution_role_arn-dedc98, MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.task_role_arn-15a967, MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.execution_role_arn-b70bc2, MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.task_role_arn-9651e2, MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.execution_role_arn-eacc48, MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.task_role_arn-d0b927, MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.execution_role_arn-2d22d2 and MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.task_role_arn-0c66b7 now.", "next_action": "Outside the draft, for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this and 1 more: Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach (and 9 more manual steps); the plan lists it as manual work.", "why_open": [ "The stackitsa plan of the draft writes no resource for 5 units and states why (the plan states the cause for each unit: module.retail_app_ecs.module.carts_service.aws_ecs_service.this: module.retail_app_ecs.module.carts_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); module.retail_app_ecs.module.checkout_service.aws_ecs_service.this: module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); and 2 more): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan." ], "closes_when": [ "the identity fact of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed", "the identity fact of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed", "the identity fact of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed", "the identity fact of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed", "the identity fact of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed", "the identity fact of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed", "the identity fact of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed", "the identity fact of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed", "the identity fact of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed", "the identity fact of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed" ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.execution_role_arn-586451", "mode": "MANUAL", "phase": "PREPARE", "executable": true, "waits_for_this": false }, { "id": "MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.task_role_arn-686488", "mode": "MANUAL", "phase": "PREPARE", "executable": true, "waits_for_this": false }, { "id": "MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.execution_role_arn-dedc98", "mode": "MANUAL", "phase": "PREPARE", "executable": true, "waits_for_this": false }, { "id": "MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.task_role_arn-15a967", "mode": "MANUAL", "phase": "PREPARE", "executable": true, "waits_for_this": false }, { "id": "MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.execution_role_arn-b70bc2", "mode": "MANUAL", "phase": "PREPARE", "executable": true, "waits_for_this": false }, { "id": "MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.task_role_arn-9651e2", "mode": "MANUAL", "phase": "PREPARE", "executable": true, "waits_for_this": false }, { "id": "MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.execution_role_arn-eacc48", "mode": "MANUAL", "phase": "PREPARE", "executable": true, "waits_for_this": false }, { "id": "MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.task_role_arn-d0b927", "mode": "MANUAL", "phase": "PREPARE", "executable": true, "waits_for_this": false }, { "id": "MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.execution_role_arn-2d22d2", "mode": "MANUAL", "phase": "PREPARE", "executable": true, "waits_for_this": false }, { "id": "MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.task_role_arn-0c66b7", "mode": "MANUAL", "phase": "PREPARE", "executable": true, "waits_for_this": false } ] } } ], "groups": [ { "id": "GRP-PLAN-DECISION-convert", "source": "PLAN_DECISION", "family": "convert", "title": "Plan decisions · convert", "record_ids": [ "DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION", "DEC-GEN-CONVERT-API-OPT-IN", "DEC-GEN-CONVERT-DATA-MOVEMENT", "DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE", "DEC-GEN-CONVERT-EXPOSURE-WIDENED", "DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH", "DEC-GEN-CONVERT-POD-SEGMENTATION", "DEC-GEN-CONVERT-SIZE-FROM-SOURCE", "DEC-GEN-CONVERT-WORKLOAD-PLACEMENT" ], "records": 9, "status": "OPEN", "open_items": 24, "accepted_items": 0, "units": 17, "by_status": [ { "key": "OPEN", "count": 9 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Data Architect", "Network Architect", "Platform Architect", "Security Architect" ], "earliest_phase": "BEFORE_PILOT", "conditional": 0 }, { "id": "GRP-PLAN-DECISION-stackitlogs", "source": "PLAN_DECISION", "family": "stackitlogs", "title": "Plan decisions · stackitlogs", "record_ids": [ "DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS" ], "records": 1, "status": "OPEN", "open_items": 1, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 1 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Platform Architect" ], "earliest_phase": "CUTOVER_PREREQUISITE", "conditional": 0 }, { "id": "GRP-PLAN-DECISION-stackitroute", "source": "PLAN_DECISION", "family": "stackitroute", "title": "Plan decisions · stackitroute", "record_ids": [ "DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST" ], "records": 1, "status": "OPEN", "open_items": 1, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 1 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Network Architect" ], "earliest_phase": "BEFORE_PILOT", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.cloudwatch_log_group", "source": "CRITICAL_SEMANTIC", "family": "aws.cloudwatch_log_group", "title": "Critical semantics · aws.cloudwatch_log_group", "record_ids": [ "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-CLOUDWATCH-LOG-GROUP-ECS-TASKS" ], "records": 1, "status": "OPEN", "open_items": 1, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 1 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Platform Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.dynamodb_table", "source": "CRITICAL_SEMANTIC", "family": "aws.dynamodb_table", "title": "Critical semantics · aws.dynamodb_table", "record_ids": [ "DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE", "DEC-OPS-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE", "DEC-SEC-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE" ], "records": 3, "status": "OPEN", "open_items": 6, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 3 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Data Architect", "Platform Architect", "Security Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.ecs", "source": "CRITICAL_SEMANTIC", "family": "aws.ecs", "title": "Critical semantics · aws.ecs", "record_ids": [ "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS" ], "records": 25, "status": "OPEN", "open_items": 76, "accepted_items": 0, "units": 5, "by_status": [ { "key": "OPEN", "count": 25 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect", "NOT_STATED", "Network Architect", "Platform Architect", "Security Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.eip", "source": "CRITICAL_SEMANTIC", "family": "aws.eip", "title": "Critical semantics · aws.eip", "record_ids": [ "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-EIP-NAT" ], "records": 1, "status": "OPEN", "open_items": 1, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 1 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Network Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.elasticache", "source": "CRITICAL_SEMANTIC", "family": "aws.elasticache", "title": "Critical semantics · aws.elasticache", "record_ids": [ "DEC-DATA-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374" ], "records": 4, "status": "OPEN", "open_items": 9, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 4 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Data Architect", "Network Architect", "Platform Architect", "Security Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.iam_role", "source": "CRITICAL_SEMANTIC", "family": "aws.iam_role", "title": "Critical semantics · aws.iam_role", "record_ids": [ "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885", "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA", "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913", "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1", "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673", "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6", "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202", "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65", "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0", "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE" ], "records": 10, "status": "OPEN", "open_items": 40, "accepted_items": 0, "units": 10, "by_status": [ { "key": "OPEN", "count": 10 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.internet_gateway", "source": "CRITICAL_SEMANTIC", "family": "aws.internet_gateway", "title": "Critical semantics · aws.internet_gateway", "record_ids": [ "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-INTERNET-GATEWAY-THIS" ], "records": 1, "status": "OPEN", "open_items": 1, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 1 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Network Architect" ], "earliest_phase": "NOT_STATED", "conditional": 1 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.kms_key", "source": "CRITICAL_SEMANTIC", "family": "aws.kms_key", "title": "Critical semantics · aws.kms_key", "record_ids": [ "DEC-IAM-MODULE-RETAIL-APP-ECS-AWS-KMS-KEY-CMK" ], "records": 1, "status": "OPEN", "open_items": 1, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 1 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.lb", "source": "CRITICAL_SEMANTIC", "family": "aws.lb", "title": "Critical semantics · aws.lb", "record_ids": [ "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS", "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS" ], "records": 2, "status": "OPEN", "open_items": 8, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 2 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Network Architect", "Platform Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.mq_broker", "source": "CRITICAL_SEMANTIC", "family": "aws.mq_broker", "title": "Critical semantics · aws.mq_broker", "record_ids": [ "DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "DEC-NET-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "DEC-SEC-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ" ], "records": 4, "status": "OPEN", "open_items": 7, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 4 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect", "Network Architect", "Platform Architect", "Security Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.nat_gateway", "source": "CRITICAL_SEMANTIC", "family": "aws.nat_gateway", "title": "Critical semantics · aws.nat_gateway", "record_ids": [ "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS" ], "records": 1, "status": "OPEN", "open_items": 3, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 1 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Network Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.opensearch", "source": "CRITICAL_SEMANTIC", "family": "aws.opensearch", "title": "Critical semantics · aws.opensearch", "record_ids": [ "DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E" ], "records": 4, "status": "OPEN", "open_items": 14, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 4 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect", "Network Architect", "Platform Architect", "Security Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.rds_cluster", "source": "CRITICAL_SEMANTIC", "family": "aws.rds_cluster", "title": "Critical semantics · aws.rds_cluster", "record_ids": [ "DEC-DATA-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "DEC-DATA-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "DEC-IAM-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "DEC-OPS-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS" ], "records": 10, "status": "OPEN", "open_items": 24, "accepted_items": 0, "units": 2, "by_status": [ { "key": "OPEN", "count": 10 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Data Architect", "Identity Architect", "Network Architect", "Platform Architect", "Security Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.route_table", "source": "CRITICAL_SEMANTIC", "family": "aws.route_table", "title": "Critical semantics · aws.route_table", "record_ids": [ "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE", "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC" ], "records": 2, "status": "OPEN", "open_items": 13, "accepted_items": 0, "units": 2, "by_status": [ { "key": "OPEN", "count": 2 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Network Architect" ], "earliest_phase": "NOT_STATED", "conditional": 13 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret", "source": "CRITICAL_SEMANTIC", "family": "aws.secretsmanager_secret", "title": "Critical semantics · aws.secretsmanager_secret", "record_ids": [ "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB", "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB", "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E", "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E", "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ", "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ", "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB", "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB" ], "records": 8, "status": "OPEN", "open_items": 10, "accepted_items": 0, "units": 4, "by_status": [ { "key": "OPEN", "count": 8 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Platform Architect", "Security Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.security_group", "source": "CRITICAL_SEMANTIC", "family": "aws.security_group", "title": "Critical semantics · aws.security_group", "record_ids": [ "DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG", "DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ", "DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS", "DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0", "DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS", "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS", "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862", "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF", "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F", "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F", "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3", "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS" ], "records": 12, "status": "OPEN", "open_items": 76, "accepted_items": 0, "units": 12, "by_status": [ { "key": "OPEN", "count": 12 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Network Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.subnet", "source": "CRITICAL_SEMANTIC", "family": "aws.subnet", "title": "Critical semantics · aws.subnet", "record_ids": [ "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE", "DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE", "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC", "DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC" ], "records": 4, "status": "OPEN", "open_items": 11, "accepted_items": 0, "units": 2, "by_status": [ { "key": "OPEN", "count": 4 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Network Architect", "Platform Architect" ], "earliest_phase": "NOT_STATED", "conditional": 11 }, { "id": "GRP-CRITICAL-SEMANTIC-aws.vpc", "source": "CRITICAL_SEMANTIC", "family": "aws.vpc", "title": "Critical semantics · aws.vpc", "record_ids": [ "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS", "DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS" ], "records": 2, "status": "OPEN", "open_items": 6, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 2 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Network Architect", "Platform Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-MANUAL-ACTION-stackitlogs", "source": "MANUAL_ACTION", "family": "stackitlogs", "title": "Manual actions · stackitlogs", "record_ids": [ "DEC-OPS-STACKITLOGS-ACTION-ARCHIVE-FLOW", "DEC-OPS-STACKITLOGS-ACTION-LABEL-CONVENTION", "DEC-OPS-STACKITLOGS-ACTION-TARGET-PRECONDITION" ], "records": 3, "status": "OPEN", "open_items": 3, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 3 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Platform Architect" ], "earliest_phase": "CUTOVER_PREREQUISITE", "conditional": 0 }, { "id": "GRP-MANUAL-ACTION-stackitsg", "source": "MANUAL_ACTION", "family": "stackitsg", "title": "Manual actions · stackitsg", "record_ids": [ "DEC-SEC-STACKITSG-ACTION-INCOMPLETE", "DEC-SEC-STACKITSG-ACTION-UNPLACED" ], "records": 2, "status": "OPEN", "open_items": 4, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 2 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Security Architect" ], "earliest_phase": "BEFORE_PILOT", "conditional": 0 }, { "id": "GRP-PLAN-STATEMENT-stackitroute", "source": "PLAN_STATEMENT", "family": "stackitroute", "title": "Plan statements · stackitroute", "record_ids": [ "DEC-NET-STACKITROUTE-STATEMENT-NOT-DRAFTED" ], "records": 1, "status": "OPEN", "open_items": 2, "accepted_items": 0, "units": 2, "by_status": [ { "key": "OPEN", "count": 1 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Network Architect" ], "earliest_phase": "BEFORE_PILOT", "conditional": 0 }, { "id": "GRP-PLAN-STATEMENT-stackitsa", "source": "PLAN_STATEMENT", "family": "stackitsa", "title": "Plan statements · stackitsa", "record_ids": [ "DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW" ], "records": 1, "status": "OPEN", "open_items": 5, "accepted_items": 0, "units": 5, "by_status": [ { "key": "OPEN", "count": 1 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect" ], "earliest_phase": "BEFORE_PILOT", "conditional": 0 } ], "id_grammar": "DEC-\u003cAREA\u003e-\u003cKEY\u003e; AREA one of NET, IAM, DATA, SEC, OPS, CMP, GEN; KEY 5 to 64 characters A-Z, 0-9, - (first A-Z or 0-9); built here as DEC-\u003cAREA\u003e-\u003cFAMILY\u003e-\u003cKIND\u003e", "counts": { "records": 113, "plan_records": 11, "plan_decisions": 25, "plan_decision_states": { "pending": 25, "accepted_awaiting_verification": 0, "rejected": 0, "stale": 0 }, "semantic_records": 95, "open_critical_semantics": 308, "conditional_semantics": 25, "action_records": 5, "manual_actions": 7, "statement_records": 2, "plan_statements": 7, "closed_statements": 17, "units": 48, "by_status": [ { "key": "OPEN", "count": 113 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "by_source": [ { "source": "PLAN_DECISION", "records": 11, "open_items": 25, "accepted_items": 0, "units": 19, "conditional": 0, "open_records": 11, "open_units": 19, "open_default_records": 2, "open_draft_default_records": 2 }, { "source": "CRITICAL_SEMANTIC", "records": 95, "open_items": 308, "accepted_items": 0, "units": 48, "conditional": 25, "open_records": 95, "open_units": 48, "open_confirm_only_items": 1 }, { "source": "MANUAL_ACTION", "records": 5, "open_items": 7, "accepted_items": 0, "units": 2, "conditional": 0, "open_records": 5, "open_units": 2 }, { "source": "PLAN_STATEMENT", "records": 2, "open_items": 7, "accepted_items": 0, "units": 7, "conditional": 0, "open_records": 2, "open_units": 7 } ], "by_cause": [ { "key": "CUSTOMER_INPUT", "count": 12 }, { "key": "TARGET_LIMIT", "count": 8 }, { "key": "EVIDENCE_GAP", "count": 0 }, { "key": "IMPLEMENTATION_GAP", "count": 22 }, { "key": "APPLY_TIME", "count": 0 }, { "key": "DEPENDS_ON_UNIT", "count": 12 }, { "key": "NOT_CLASSIFIED", "count": 6 }, { "key": "MIXED", "count": 53 } ], "root_causes": 1, "dependent_units": 0, "by_blocker_class": [ { "class": "ROOT_BLOCKER", "records": 1, "items": 1 }, { "class": "GENUINELY_UNACCOUNTED", "records": 102, "items": 317 }, { "class": "OPTIONAL_CONDITIONAL", "records": 10, "items": 29 }, { "class": "PROPAGATED_IMPACT", "records": 0, "items": 0 } ] }, "review_input": { "state": "NOT_PROVIDED", "entries": 0 }, "unmatched_reviews": [], "state_definitions": { "review_state": "ARCHITECT_REVIEWED: a review of the decisions file, bound to this run (source digest, knowledge base and members all hold), covers every member of the record and accepts or rejects it; the outcome is the status and the review of the record. UNREVIEWED: none was given, it covers only some members, or its binding no longer holds. A review never closes a plan decision, a critical semantic or a manual action.", "design_state": "OPEN: this run's plan or draft still carries the item. DESIGN_RESOLVED: stated only for an entry of the decisions file that this run's register does not hold, written for another source digest and the same knowledge base, in a run that read the plans of a generated draft without a degraded reading: the item is gone from the plan or draft of the later source. It is inferred from the absent id, so an id misspelled in the file reads the same way; a review never sets it.", "validation_state": "TECHNICAL_VALIDATION_PASSED: this run ran tofu validate on the draft, it passed, and the record belongs to a family of the draft (security group, routing, identity or logs) that the validation covered. NOT_VALIDATED: tofu validate was not asked for, did not run, or the record is a critical semantic of the source, which a schema check of the draft does not cover. FAILED: tofu validate rejected the draft that holds the family. It is a static check against the pinned provider schema, not target behaviour and not approval." }, "root_causes": [ { "id": "DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE", "why": "The source runs an engine version newer than every version STACKIT offers in the region (1 converter decision): a snapshot of the newer engine is not restored into the older one, so the step that creates the instance waits until a person chooses how the data reaches the offered version (re-read from the source), runs the engine self-managed on SKE, or waits for the version; the unit that owns one is not automation-eligible until then.", "records": [ "DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE" ], "dependent_units": [], "dependent_records": [], "dependent_items": 0, "next_step": "Decide engine version downgrade for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: choose one of the 3 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "next_record": "DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE" } ], "record_shapes": [ { "id": "RSH-0002171813ad", "why": "The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.", "required_evidence": [ "the failure-domain difference, named: a Single-AZ server is not restarted in another zone, and its volumes are not mirrored to another zone", "the recovery expectation (RTO and RPO) the accepted placement has to meet, and the verification that shows it does", "the source zone layout: which AWS zone each subnet is in and which servers it places there", "the target placement of the servers of each subnet, as the regenerated draft writes it (target.placement.availability_zone answered); a STACKIT network is regional and has no zone" ], "items": [ { "id": "DEC-OPS-AWS-SUBNET-AVAILABILITY-ZONE", "kind": "availability-zone", "family": "aws.subnet", "title": "Confirm the availability zone of the subnet", "block": "availability_zone", "category": "availability-durability", "why": "The knowledge base cannot decide \"availability-zone\" of the aws.subnet contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "{subject}|availability-zone" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "accept-the-availability-zone-difference", "title": "Accept the availability-zone difference of the placement the draft writes for the servers of the subnet", "effect": "The servers the subnet places stay, each with its volumes, in the one Single-AZ zone the regenerated draft writes for them; the STACKIT network of the subnet is regional. A Single-AZ server is not restarted in another zone when its zone fails and its volumes are not mirrored to another zone, so a zone outage takes down what sits in that zone. The Metro zone is no spread either: it restarts a single instance in another zone and may place all instances in one zone. The review accepts that difference with the source zone layout, the target placement of each server, the failure-domain difference, the recovery expectation (RTO and RPO) and the verification it requires; the check then closes as an accepted design change bound to the draft that writes those placements, and frees nothing else.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://docs.stackit.cloud/products/compute-engine/server/basics/regions-and-availability-zones/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-25", "quote": "In a single AZ setup, a service runs in the specific AZ you select. It won’t be restarted in a different zone if an outage occurs." }, { "url": "https://docs.stackit.cloud/products/storage/block-storage/basics/service-plans/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-25", "quote": "Single Availability Zone (Single AZ) setup implies fixed assignment to one Availability Zone. Data in a Single AZ are not mirrored across different Availability Zones." }, { "url": "https://docs.stackit.cloud/products/compute-engine/server/basics/regions-and-availability-zones/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-25", "quote": "This failover process can take time but significantly increases uptime for single-instance workloads. For high-availability workloads, Metro AZ behavior is less predictable. Because STACKIT places instances based on system load, all instances may end up in the same AZ." } ] } ], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the availability zone of the subnet for {subject}, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on {subject} that the knowledge base cannot decide: Confirm the availability zone of the subnet.", "generated_target_behavior": "Confirm the availability zone of the subnet: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/availability-zone). The network carries no zone (the subnet's zone is named \"not carried\" in the Terraform comments). Every server reads the one zone variable (var.availability_zone) in a source of one zone, a zone variable named after the server, without a default, in a source of several zones, or the zone answered for it in target.placement.availability_zone.", "residual_difference": "Confirm the availability zone of the subnet: That the source's spread over zones and its failure domains are kept on the target. Owner hold: the record closes only by the explicit acceptance of the availability-zone difference in the decisions file. The knowledge base's closing condition names only the Single-AZ zones eu01-1, eu01-2 and eu01-3; the Metro zone is not among them.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/availability-zone now.", "next_action": "Confirm the availability zone of the subnet: Confirm the availability zone of the subnet for {subject}, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm the availability zone of the subnet: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The availability zone of the subnet. STACKIT networks are regional (stackit_network has no zone field, pinned provider); the zone is chosen per server and volume, and AWS zone names do not map to STACKIT zones.", "Confirm the availability zone of the subnet: The record closes only by the explicit acceptance of the availability-zone difference in the decisions file; an answered placement alone never closes it." ], "closes_when": [ "Confirm the availability zone of the subnet: A person decides, per source zone, which STACKIT zone (eu01-1, eu01-2 or eu01-3) takes the servers and volumes that sat in it, so that the source's spread and its failure domains are kept.", "Confirm the availability zone of the subnet: The record closes only by the explicit acceptance of the availability-zone difference in the decisions file; an answered placement alone never closes it." ], "required_inputs": [ "target.placement.availability_zone", "the source zone layout: which AWS zone each subnet is in and which servers it places there", "the target placement of the servers of each subnet, as the regenerated draft writes it (target.placement.availability_zone answered); a STACKIT network is regional and has no zone", "the failure-domain difference, named: a Single-AZ server is not restarted in another zone, and its volumes are not mirrored to another zone", "the recovery expectation (RTO and RPO) the accepted placement has to meet, and the verification that shows it does" ], "resolution_paths": [ { "id": "availability-zone/map-each-source-zone", "title": "Confirm the availability zone of the subnet: Map each source zone to one STACKIT zone through the servers' placement", "prerequisites": [ "target.placement.availability_zone answered for each server whose zone the scan shows, with a zone the region's catalogue lists", "the draft regenerated with the answers" ], "effects": [ "The servers and volumes of one source subnet land in the STACKIT zone chosen for its source zone; the networks stay regional. The record stays open until a review in the decisions file accepts the difference (accept-the-availability-zone-difference with its acceptance)." ], "risk": [ "Two source zones mapped to one STACKIT zone lose the spread without any error." ], "evidence": [ "contract note aws.subnet/availability-zone: \"STACKIT networks are regional (stackit_network has no zone field, pinned provider); the zone is chosen per server and volume, and AWS zone names do not map to STACKIT zones.\"", "STACKIT provider schema 0.120.0: \"The availability zone of the server.\"" ], "regeneration_required": true }, { "id": "availability-zone/redesign-on-metro-zone", "title": "Confirm the availability zone of the subnet: Redesign the resilience on the Metro zone (eu01-m)", "prerequisites": [ "the architect's decision that single-instance failover replaces the spread over zones", "target.placement.availability_zone answered eu01-m for the servers concerned, and the draft regenerated" ], "effects": [ "As for the volumes' zone: Metro restarts a failed instance in another zone and does not keep a spread of several instances. The Metro zone is not among the zones the knowledge base's closing condition names (eu01-1, eu01-2 or eu01-3), so on this path too the record closes only by the explicit acceptance of the availability-zone difference." ], "risk": [ "The source's spread is not kept as a spread, and the Metro zone is not among the zones the closing condition names." ], "evidence": [ "provider-docs mirror stackit/docs.stackit.cloud/products/compute-engine/server/basics/regions-and-availability-zones.html: \"Because STACKIT places instances based on system load, all instances may end up in the same AZ.\"", "contract note aws.subnet/availability-zone: \"which STACKIT zone (eu01-1, eu01-2 or eu01-3) takes the servers and volumes\"" ], "regeneration_required": true }, { "id": "availability-zone/accept-the-availability-zone-difference", "title": "Confirm the availability zone of the subnet: Accept the availability-zone difference of the placement the draft writes for the servers of the subnet", "prerequisites": [], "effects": [ "The servers the subnet places stay, each with its volumes, in the one Single-AZ zone the regenerated draft writes for them; the STACKIT network of the subnet is regional. A Single-AZ server is not restarted in another zone when its zone fails and its volumes are not mirrored to another zone, so a zone outage takes down what sits in that zone. The Metro zone is no spread either: it restarts a single instance in another zone and may place all instances in one zone. The review accepts that difference with the source zone layout, the target placement of each server, the failure-domain difference, the recovery expectation (RTO and RPO) and the verification it requires; the check then closes as an accepted design change bound to the draft that writes those placements, and frees nothing else." ], "risk": [], "evidence": [ "https://docs.stackit.cloud/products/compute-engine/server/basics/regions-and-availability-zones/", "https://docs.stackit.cloud/products/storage/block-storage/basics/service-plans/", "https://docs.stackit.cloud/products/compute-engine/server/basics/regions-and-availability-zones/" ], "regeneration_required": false } ], "required_verification": [ "Confirm the availability zone of the subnet: placement evidence on the target for every server of the subnet", "Confirm the availability zone of the subnet: a failure-domain assessment", "Confirm the availability zone of the subnet: the recovery expectations and the backup and restore chain that meets them", "Confirm the availability zone of the subnet: the architect's documented decision", "Confirm the availability zone of the subnet: a validation result of the regenerated draft", "Confirm the availability zone of the subnet: the explicit acceptance of the availability-zone difference, recorded in the decisions file with the source and target layout, the failure-domain difference and the recovery expectations" ], "next_run_changes": [ "An answered placement regenerates the servers and volumes in the chosen zones. The setting stays open: an answer never closes a critical setting, and the record closes only by the explicit acceptance of the availability-zone difference in the decisions file. A review in the decisions file that chooses the option accept-the-availability-zone-difference with its acceptance fields (source zone layout, target placement per pair, the failure-domain difference, the recovery expectation, the required verification) closes the record as an accepted design change, bound to the draft that writes the placements it names." ], "remains_manual": [ "Confirm the availability zone of the subnet: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.subnet/availability-zone: \"The availability zone of the subnet.\"", "owner ruling of 2026-10-26: \"Ruling 1: the placement answer stays INPUT_APPLIED; a separate ACCEPTED_DIFFERENCE review in the `--decisions` file (option `accept-the-availability-zone-difference` on the AZ records\"", "provider-docs mirror stackit/docs.stackit.cloud/platform/regions.html: \"Metro AZ is not available for all services.\"", "https://docs.stackit.cloud/products/compute-engine/server/basics/regions-and-availability-zones/", "https://docs.stackit.cloud/products/storage/block-storage/basics/service-plans/" ], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/availability-zone", "mode": "MANUAL", "phase": "FOUNDATION", "executable": true, "waits_for_this": false } ] } }, { "id": "RSH-33ed39910304", "why": "The knowledge base cannot decide 4 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-identity-architect.", "required_evidence": [], "items": [ { "id": "DEC-IAM-AWS-ECS-SERVICE-EXECUTE-COMMAND", "kind": "service-execute-command", "family": "aws.ecs", "title": "Review the service execute command setting", "block": "enable_execute_command", "category": "identity-access", "why": "The knowledge base cannot decide \"service-execute-command\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|service-execute-command" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the service execute command setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-AWS-ECS-SERVICE-TASK-DEFINITION", "kind": "service-task-definition", "family": "aws.ecs", "title": "Review the service task definition setting", "block": "task_definition", "category": "identity-access", "why": "The knowledge base cannot decide \"service-task-definition\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|service-task-definition" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the service task definition setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-AWS-ECS-TD-EXECUTION-ROLE-ARN", "kind": "td-execution-role-arn", "family": "aws.ecs", "title": "Confirm the execution role ARN of the ECS task definition", "block": "td-execution-role-arn", "category": "identity-access", "why": "The knowledge base cannot decide \"td-execution-role-arn\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|td-execution-role-arn" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the execution role ARN of the ECS task definition for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-AWS-ECS-TD-TASK-ROLE-ARN", "kind": "td-task-role-arn", "family": "aws.ecs", "title": "Confirm the task role ARN of the ECS task definition", "block": "td-task-role-arn", "category": "identity-access", "why": "The knowledge base cannot decide \"td-task-role-arn\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|td-task-role-arn" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the task role ARN of the ECS task definition for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "state_reason": "a person's decision or input is still open This is the state of the setting of {name} unit that asks the most, Review the service execute command setting; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on {subject} that the knowledge base cannot decide: Review the service execute command setting; Review the service task definition setting; Confirm the execution role ARN of the ECS task definition; Confirm the task role ARN of the ECS task definition.", "generated_target_behavior": "Review the service execute command setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-identity-architect). Review the service task definition setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-identity-architect). Confirm the execution role ARN of the ECS task definition: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-identity-architect). Confirm the task role ARN of the ECS task definition: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-identity-architect).", "residual_difference": "Review the service execute command setting: the target behaviour of {name} setting is not established Review the service task definition setting: the target behaviour of {name} setting is not established Confirm the execution role ARN of the ECS task definition: the target behaviour of {name} setting is not established Confirm the task role ARN of the ECS task definition: the target behaviour of {name} setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-identity-architect now.", "next_action": "Review the service execute command setting: Review the service execute command setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the service execute command setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. ECS Exec opens a shell in a running task; kubectl exec (and who may use it through RBAC) is the counterpart and is not part of the draft.", "Review the service task definition setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. The task definition the service runs (family:revision or ARN) becomes the Deployment's pod template; ecs_service.task_definition names it as a string, the definition itself is a separate resource a person translates.", "Confirm the execution role ARN of the ECS task definition: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. ecs_task_definition.execution_role_arn of the template the group builds its instances from: The role ECS uses to pull images and read the secrets it injects into the containers. Not verified as carried by any semantic of {name} family — reviewed.", "Confirm the task role ARN of the ECS task definition: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. ecs_task_definition.task_role_arn of the template the group builds its instances from: The role the application in the containers acts as towards AWS APIs. Not verified as carried by any semantic of {name} family — reviewed." ], "closes_when": [ "Review the service execute command setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.", "Review the service task definition setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.", "Confirm the execution role ARN of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.", "Confirm the task role ARN of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/open-settings-identity-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "RSH-36efe43b05d1", "why": "The knowledge base cannot decide 5 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-network-architect.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-ECS-SERVICE-CONNECT-VALUES", "kind": "service-connect-values", "family": "aws.ecs", "title": "Review the service connect values setting", "block": "service_connect_configuration", "category": "network-exposure", "why": "The knowledge base cannot decide \"service-connect-values\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|service-connect-values" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the service connect values setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ECS-SERVICE-DISCOVERY", "kind": "service-discovery", "family": "aws.ecs", "title": "Review the service discovery setting", "block": "service_connect_configuration", "category": "network-exposure", "why": "The knowledge base cannot decide \"service-discovery\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|service-discovery" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the service discovery setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ECS-SERVICE-NETWORK-PLACEMENT", "kind": "service-network-placement", "family": "aws.ecs", "title": "Review the service network placement setting", "block": "network_configuration", "category": "network-exposure", "why": "The knowledge base cannot decide \"service-network-placement\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|service-network-placement" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the service network placement setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ECS-SERVICE-PUBLIC-IP-SETTING", "kind": "service-public-ip-setting", "family": "aws.ecs", "title": "Review the service public IP setting setting", "block": "network_configuration", "category": "network-exposure", "why": "The knowledge base cannot decide \"service-public-ip-setting\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|service-public-ip-setting" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the service public IP setting setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-ECS-TD-NETWORK-MODE", "kind": "td-network-mode", "family": "aws.ecs", "title": "Confirm the network mode of the ECS task definition", "block": "td-network-mode", "category": "network-exposure", "why": "The knowledge base cannot decide \"td-network-mode\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|td-network-mode" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the network mode of the ECS task definition for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "state_reason": "a person's decision or input is still open This is the state of the setting of {name} unit that asks the most, Review the service connect values setting; the 5 settings of the record state their own.", "source_observation": "The source states 5 critical settings on {subject} that the knowledge base cannot decide: Review the service connect values setting; Review the service discovery setting; Review the service network placement setting; Review the service public IP setting setting; Confirm the network mode of the ECS task definition.", "generated_target_behavior": "Review the service connect values setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect). Review the service discovery setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect). Review the service network placement setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect). Review the service public IP setting setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect). Confirm the network mode of the ECS task definition: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect).", "residual_difference": "Review the service connect values setting: the target behaviour of {name} setting is not established Review the service discovery setting: the target behaviour of {name} setting is not established Review the service network placement setting: the target behaviour of {name} setting is not established Review the service public IP setting setting: the target behaviour of {name} setting is not established Confirm the network mode of the ECS task definition: the target behaviour of {name} setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-network-architect now.", "next_action": "Review the service connect values setting: Review the service connect values setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the service connect values setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. Service Connect's switch, namespace, service names, client aliases (DNS name and port), traffic-test header rules, mTLS settings (KMS key, role, private CA) and proxy logging: an AWS-managed service mesh with no draft counterpart; discovery on SKE is Kubernetes Services and DNS, mesh features a person's choice.", "Review the service discovery setting: A check of the knowledge base (ecs service discovery) fired on {name} unit and leaves the setting to a person: the target does not settle it by itself (a finding of {name} unit describes it). The setting states how ECS services find each other: AWS Cloud Map registries and namespaces, or ECS Service Connect.", "Review the service network placement setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. The subnets and security groups the tasks' network interfaces use (awsvpc mode); on SKE pods take the cluster's network and NetworkPolicies decide reachability — a person re-expresses the security group rules.", "Review the service public IP setting setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. assign_public_ip in either state (the public ip setting reads only true through the public address check): tasks with a public address are exposed unless a person decides the exposure on SKE explicitly (LoadBalancer services, network policies); false is the private default and is still re-checked, the draft carries no service block.", "Confirm the network mode of the ECS task definition: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. ecs_task_definition.network_mode of the template the group builds its instances from: How the containers are networked (awsvpc, bridge, host, none): whether each task has its own interface and security groups or shares the host's network. Not verified as carried by any semantic of {name} family — reviewed." ], "closes_when": [ "Review the service connect values setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.", "Review the service discovery setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE.", "Review the service network placement setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.", "Review the service public IP setting setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.", "Confirm the network mode of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/open-settings-network-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "RSH-39ce01e47cee", "why": "The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-IAM-AWS-RDS-CLUSTER-ADMIN-USERNAME-NOT-CARRIED", "kind": "admin-username-not-carried", "family": "aws.rds_cluster", "title": "Review the admin username not carried setting", "block": "master_username", "category": "identity-access", "why": "The knowledge base cannot decide \"admin-username-not-carried\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|admin-username-not-carried" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the admin username not carried setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on {subject} that the knowledge base cannot decide: Review the admin username not carried setting.", "generated_target_behavior": "Review the admin username not carried setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/admin-username-not-carried).", "residual_difference": "Review the admin username not carried setting: the target behaviour of {name} setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/admin-username-not-carried now.", "next_action": "Review the admin username not carried setting: Review the admin username not carried setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the admin username not carried setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. The master username is not a literal of a single cluster that PostgreSQL Flex accepts: a name a variable supplies or that is not visible statically (the draft writes the user with a variable that has no default), a name STACKIT reserves (admin and postgres: the draft writes a variable that rejects them), or a repeated cluster (a user per cluster only when every instance is evaluated). A person chooses the administrator's name on the target — REVIEW." ], "closes_when": [ "Review the admin username not carried setting: A person creates the administrator on the target with a name the target accepts and confirms the application connects with it." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/admin-username-not-carried", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "RSH-3ef4cfa13ede", "why": "The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-SEC-AWS-SECRETSMANAGER-SECRET-SECRET-VALUE", "kind": "secret-value", "family": "aws.secretsmanager_secret", "title": "Review the secret value setting", "block": "insecure_value", "category": "secret-handling", "why": "The knowledge base cannot decide \"secret-value\" of the aws.secretsmanager_secret contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|secret-value" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for {subject} outside the draft; the plan states no title for it." } ], "resolution": { "state_reason": "the guidance names a manual step as the only path", "source_observation": "The source states 1 critical setting on {subject} that the knowledge base cannot decide: Review the secret value setting.", "generated_target_behavior": "Review the secret value setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/secret-value). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Review the secret value setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/secret-value now.", "next_action": "Review the secret value setting: Carry out the manual work the plan names for {subject} outside the draft; the plan states no title for it.", "why_open": [ "Review the secret value setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The value moves to STACKIT Secrets Manager (Vault-compatible KV). The draft generates the shared instance, and the plan a WriteSecret step for an aws_secretsmanager_secret or a SecureString aws_ssm_parameter that is not repeated. The step writes the document the person supplies and does not carry this setting (the value is the person's document); for a secret repeated by count or for_each whose instances are not all known, and for a parameter whose type is not the literal SecureString, only the instance is generated. What a person decides, per secret: where the value comes from (the same value fetched from a secure source, or a new one — moving is the moment to rotate) and the Vault path the application will read, then writes it with the Vault provider or CLI — REVIEW. History: added with aws_ssm_parameter on 2026-09-24; REVIEW since 2026-09-27 (was TRANSFORMED); 2026-10-29 the wording names the WriteSecret step of the plan; 2026-10-30 the step is also made for a SecureString parameter." ], "closes_when": [ "Review the secret value setting: A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client." ], "required_inputs": [], "resolution_paths": [ { "id": "secret-value/decide-and-carry-out", "title": "Review the secret value setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.", "regeneration: not stated — treated as required" ], "risk": [ "The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes." ], "evidence": [ "contract note aws.secretsmanager_secret/plain-parameter-kind: \"A person decides per parameter whether the value is plain configuration for the consuming workload or a secret, which then belongs in the Secrets Manager instance.\"" ], "regeneration_required": true } ], "required_verification": [ "Review the secret value setting: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Review the secret value setting: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.secretsmanager_secret/plain-parameter-kind: \"A person decides per parameter whether the value is plain configuration for the consuming workload or a secret, which then belongs in the Secrets Manager instance.\"", "contract note aws.secretsmanager_secret/plain-parameter-value: \"A person decides per parameter whether the value is plain workload configuration or a secret, and sets it there, since nothing of the value is copied.\"", "contract note aws.secretsmanager_secret/secret-value: \"A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client.\"", "contract note aws.secretsmanager_secret/tc-ssm-parameter-value: \"A person decides whether the value is configuration or a secret and writes it to the workload configuration or, as a secret, to the Secrets Manager instance, as nothing of it is copied.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/secret-value", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "RSH-4b058b494a25", "why": "The knowledge base cannot decide 3 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-network-architect.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-RDS-CLUSTER-DB-NETWORK-PLACEMENT", "kind": "db-network-placement", "family": "aws.rds_cluster", "title": "Decide how clients reach the database (the endpoint STACKIT assigns and its access list)", "block": "availability_zones", "category": "network-exposure", "why": "The knowledge base cannot decide \"db-network-placement\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|db-network-placement" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide how clients reach the database (the endpoint STACKIT assigns and its access list) for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-RDS-CLUSTER-MEMBER-SETTINGS", "kind": "member-settings", "family": "aws.rds_cluster", "title": "Review the member settings setting", "block": "member-settings", "category": "network-exposure", "why": "The knowledge base cannot decide \"member-settings\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|member-settings" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the member settings setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-RDS-CLUSTER-SECURITY-GROUPS", "kind": "security-groups", "family": "aws.rds_cluster", "title": "Review the security groups setting", "block": "vpc_security_group_ids", "category": "network-exposure", "why": "The knowledge base cannot decide \"security-groups\" of the aws.rds_cluster contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|security-groups" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the security groups setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "state_reason": "a person's decision or input is still open This is the state of the setting of {name} unit that asks the most, Decide how clients reach the database (the endpoint STACKIT assigns and its access list); the 3 settings of the record state their own.", "source_observation": "The source states 3 critical settings on {subject} that the knowledge base cannot decide: Decide how clients reach the database (the endpoint STACKIT assigns and its access list); Review the member settings setting; Review the security groups setting.", "generated_target_behavior": "Decide how clients reach the database (the endpoint STACKIT assigns and its access list): The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect). Review the member settings setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect). Review the security groups setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect).", "residual_difference": "Decide how clients reach the database (the endpoint STACKIT assigns and its access list): the target behaviour of {name} setting is not established Review the member settings setting: the target behaviour of {name} setting is not established Review the security groups setting: the target behaviour of {name} setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-network-architect now.", "next_action": "Decide how clients reach the database (the endpoint STACKIT assigns and its access list): Decide how clients reach the database (the endpoint STACKIT assigns and its access list) for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Decide how clients reach the database (the endpoint STACKIT assigns and its access list): The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. The STACKIT database resource has no subnet, availability-zone or IP-family attribute (pinned provider): clients reach it at the endpoint STACKIT assigns, restricted by its ACL — a person decides how clients reach it — REVIEW.", "Review the member settings setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. Cluster members are not separate STACKIT resources (the flavor defines the nodes, pinned provider): a member's failover priority, parameter group, subnet group, zone, CA certificate and Performance Insights key have no attribute — a person decides what the nodes need — REVIEW.", "Review the security groups setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. STACKIT database instances have no security groups: access is a CIDR ACL (network.acl, pinned provider); the draft's ACL variable defaults to the CIDRs of the groups' ingress rules where visible, and group-to-group rules cannot be expressed — a person checks the ACL — REVIEW." ], "closes_when": [ "Decide how clients reach the database (the endpoint STACKIT assigns and its access list): A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.", "Review the member settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.", "Review the security groups setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/open-settings-network-architect", "mode": "MANUAL", "phase": "DATA", "executable": true, "waits_for_this": false } ] } }, { "id": "RSH-7025c7c4ba2c", "why": "The knowledge base cannot decide 2 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-security-architect.", "required_evidence": [ "for the platform default: STACKIT's written statement of how the values are encrypted at rest when the instance has no KMS key, since the pages read do not state it", "the STACKIT KMS key (key ring, key, key version) and the service account that performs the key operations for the instance, with a role of the Secrets Manager", "which AWS keys the secrets used (one key for all, or one per secret), and which secrets must stay under separate keys" ], "items": [ { "id": "DEC-SEC-AWS-SECRETSMANAGER-SECRET-CUSTOMER-MANAGED-KEY", "kind": "customer-managed-key", "family": "aws.secretsmanager_secret", "title": "Confirm the customer-managed encryption key", "block": "key_id", "category": "encryption", "why": "The knowledge base cannot decide \"customer-managed-key\" of the aws.secretsmanager_secret contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|customer-managed-key" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "kms-key-on-the-secrets-manager-instance", "title": "Encrypt the Secrets Manager instance with a key of the STACKIT KMS", "effect": "The instance gets a kms_key (key ring, key, key version and the service account that performs the key operations, which holds at least the Secrets Manager Reader role) and all its secret values are encrypted with that key; a key version change re-encrypts the stored secrets. The key belongs to the instance: secrets that used different AWS keys and must stay under different keys belong in different instances. The configuration is available by API and the provider; the portal does not offer it. A review records the choice and closes no critical setting by itself.", "evidence": [ { "url": "https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "With KMS encryption, all secret values in a Secrets Manager instance can be encrypted using a STACKIT Key Management Service (KMS) key. ... Who authorizes? A service account whose email address is stored in the instance’s KMS configuration and which has at least the role “Secrets Manager Reader” or “Secrets Manager Admin” role. ... At the moment it is not possible to configure KMS via the Portal UI." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/secretsmanager_instance.md#L34", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "`kms_key` (Attributes) The STACKIT-KMS key for secret encryption and decryption. ... `key_id` (String) UUID of the key within the STACKIT-KMS to use for the encryption. `key_ring_id` ... `key_version` (Number) ... `service_account_email` (String) Service-Account linked to the Key within the STACKIT-KMS." }, { "url": "https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "Changing keyVersion affects not only new/future write operations. Already stored secrets are automatically re-encrypted." } ] }, { "id": "accept-an-instance-without-a-customer-key", "title": "Use the Secrets Manager instance without a customer key", "effect": "The instance has no kms_key and the secret values are not under a key the customer controls. The pages read describe encryption with a KMS key as optional and do not state how the values are encrypted at rest without one, so this choice accepts an unstated platform default and not a proven equivalent. The review records who accepts it and the requirement the customer key served. A review records the choice and closes no critical setting by itself.", "evidence": [ { "url": "https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "With KMS encryption, all secret values in a Secrets Manager instance can be encrypted using a STACKIT Key Management Service (KMS) key. ... Who authorizes? A service account whose email address is stored in the instance’s KMS configuration and which has at least the role “Secrets Manager Reader” or “Secrets Manager Admin” role. ... At the moment it is not possible to configure KMS via the Portal UI." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/secretsmanager_instance.md#L34", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "`kms_key` (Attributes) The STACKIT-KMS key for secret encryption and decryption. ... `key_id` (String) UUID of the key within the STACKIT-KMS to use for the encryption. `key_ring_id` ... `key_version` (Number) ... `service_account_email` (String) Service-Account linked to the Key within the STACKIT-KMS." } ] } ], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for {subject}: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-SEC-AWS-SECRETSMANAGER-SECRET-SECRET-VALUE", "kind": "secret-value", "family": "aws.secretsmanager_secret", "title": "Review the secret value setting", "block": "insecure_value", "category": "secret-handling", "why": "The knowledge base cannot decide \"secret-value\" of the aws.secretsmanager_secret contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|secret-value" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Carry out the manual work the plan names for {subject} outside the draft; the plan states no title for it." } ], "resolution": { "state_reason": "the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Review the secret value setting; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on {subject} that the knowledge base cannot decide: Confirm the customer-managed encryption key; Review the secret value setting.", "generated_target_behavior": "Confirm the customer-managed encryption key: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the secret value setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Confirm the customer-managed encryption key: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the secret value setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-security-architect now.", "next_action": "Review the secret value setting: Carry out the manual work the plan names for {subject} outside the draft; the plan states no title for it.", "why_open": [ "Confirm the customer-managed encryption key: A check of the knowledge base (secret cmk) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below). The AWS key does not move, AWS's key per secret has no per-secret counterpart, and the draft sets the kms_key block (referencing the drafted STACKIT key) only when every source of the shared instance is an AWS secret that references that one key — otherwise it names the key NOT CARRIED with the reason; either way a person decides (REVIEW, see the customer-managed key check).", "Review the secret value setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The value moves to STACKIT Secrets Manager (Vault-compatible KV). The draft generates the shared instance, and the plan a WriteSecret step for an aws_secretsmanager_secret or a SecureString aws_ssm_parameter that is not repeated. The step writes the document the person supplies and does not carry this setting (the value is the person's document); for a secret repeated by count or for_each whose instances are not all known, and for a parameter whose type is not the literal SecureString, only the instance is generated. What a person decides, per secret: where the value comes from (the same value fetched from a secure source, or a new one — moving is the moment to rotate) and the Vault path the application will read, then writes it with the Vault provider or CLI — REVIEW. History: added with aws_ssm_parameter on 2026-09-24; REVIEW since 2026-09-27 (was TRANSFORMED); 2026-10-29 the wording names the WriteSecret step of the plan; 2026-10-30 the step is also made for a SecureString parameter." ], "closes_when": [ "Confirm the customer-managed encryption key: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm the customer-managed encryption key: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the secret value setting: A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client." ], "required_inputs": [ "which AWS keys the secrets used (one key for all, or one per secret), and which secrets must stay under separate keys", "the STACKIT KMS key (key ring, key, key version) and the service account that performs the key operations for the instance, with a role of the Secrets Manager", "for the platform default: STACKIT's written statement of how the values are encrypted at rest when the instance has no KMS key, since the pages read do not state it" ], "resolution_paths": [ { "id": "customer-managed-key/verify-on-target", "title": "Confirm the customer-managed encryption key: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.secretsmanager_secret/customer-managed-key: \"Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below).\"" ], "regeneration_required": true }, { "id": "customer-managed-key/kms-key-on-the-secrets-manager-instance", "title": "Confirm the customer-managed encryption key: Encrypt the Secrets Manager instance with a key of the STACKIT KMS", "prerequisites": [], "effects": [ "The instance gets a kms_key (key ring, key, key version and the service account that performs the key operations, which holds at least the Secrets Manager Reader role) and all its secret values are encrypted with that key; a key version change re-encrypts the stored secrets. The key belongs to the instance: secrets that used different AWS keys and must stay under different keys belong in different instances. The configuration is available by API and the provider; the portal does not offer it. A review records the choice and closes no critical setting by itself." ], "risk": [], "evidence": [ "https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/secretsmanager_instance.md#L34", "https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/" ], "regeneration_required": false }, { "id": "customer-managed-key/accept-an-instance-without-a-customer-key", "title": "Confirm the customer-managed encryption key: Use the Secrets Manager instance without a customer key", "prerequisites": [], "effects": [ "The instance has no kms_key and the secret values are not under a key the customer controls. The pages read describe encryption with a KMS key as optional and do not state how the values are encrypted at rest without one, so this choice accepts an unstated platform default and not a proven equivalent. The review records who accepts it and the requirement the customer key served. A review records the choice and closes no critical setting by itself." ], "risk": [], "evidence": [ "https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/secretsmanager_instance.md#L34" ], "regeneration_required": false }, { "id": "secret-value/decide-and-carry-out", "title": "Review the secret value setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.", "regeneration: not stated — treated as required" ], "risk": [ "The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes." ], "evidence": [ "contract note aws.secretsmanager_secret/plain-parameter-kind: \"A person decides per parameter whether the value is plain configuration for the consuming workload or a secret, which then belongs in the Secrets Manager instance.\"" ], "regeneration_required": true } ], "required_verification": [ "Confirm the customer-managed encryption key: the check, proof or closing evidence is recorded with its result", "Review the secret value setting: the decision or the manual work is done and recorded (who, when, what was configured and why)" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Confirm the customer-managed encryption key: Manual work remains: a person closes the semantic, the draft does not.", "Review the secret value setting: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.secretsmanager_secret/customer-managed-key: \"Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below).\"", "contract note aws.secretsmanager_secret/recovery-window: \"A person confirms the deletion safety the application needs, since how long a deleted STACKIT secret can be restored is not documented.\"", "contract note aws.secretsmanager_secret/tc-secretsmanager-secret-name: \"A person confirms the secret name or path the application looks up on the target, or accepts the new one.\"", "contract note aws.secretsmanager_secret/tc-ssm-parameter-name: \"A person confirms the name the application uses to look the parameter up on the target, or accepts the new one.\"", "https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/secretsmanager_instance.md#L34", "contract note aws.secretsmanager_secret/plain-parameter-kind: \"A person decides per parameter whether the value is plain configuration for the consuming workload or a secret, which then belongs in the Secrets Manager instance.\"", "contract note aws.secretsmanager_secret/plain-parameter-value: \"A person decides per parameter whether the value is plain workload configuration or a secret, and sets it there, since nothing of the value is copied.\"", "contract note aws.secretsmanager_secret/secret-value: \"A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client.\"", "contract note aws.secretsmanager_secret/tc-ssm-parameter-value: \"A person decides whether the value is configuration or a secret and writes it to the workload configuration or, as a secret, to the Secrets Manager instance, as nothing of it is copied.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/open-settings-security-architect", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "RSH-8a0bbd0646ff", "why": "The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-OPS-AWS-SECRETSMANAGER-SECRET-TC-SECRETSMANAGER-SECRET-NAME", "kind": "tc-secretsmanager-secret-name", "family": "aws.secretsmanager_secret", "title": "Confirm the name of the Secrets Manager secret", "block": "name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-secretsmanager-secret-name\" of the aws.secretsmanager_secret contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|tc-secretsmanager-secret-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for {subject}: the check, proof or closing evidence is recorded with its result." } ], "resolution": { "state_reason": "the guidance closes it by a runtime or validation result", "source_observation": "The source states 1 critical setting on {subject} that the knowledge base cannot decide: Confirm the name of the Secrets Manager secret.", "generated_target_behavior": "Confirm the name of the Secrets Manager secret: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/tc-secretsmanager-secret-name). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.", "residual_difference": "Confirm the name of the Secrets Manager secret: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/tc-secretsmanager-secret-name now.", "next_action": "Confirm the name of the Secrets Manager secret: Verify on the target for {subject}: the check, proof or closing evidence is recorded with its result.", "why_open": [ "Confirm the name of the Secrets Manager secret: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_secretsmanager_secret.name: Friendly name used to address the secret; losing it breaks lookups by name but does not change who may reach or read the value, its encryption or deletion behaviour (IAM statements that scope by name are assessed on the IAM policy). No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract)." ], "closes_when": [ "Confirm the name of the Secrets Manager secret: A person confirms the secret name or path the application looks up on the target, or accepts the new one." ], "required_inputs": [], "resolution_paths": [ { "id": "tc-secretsmanager-secret-name/verify-on-target", "title": "Confirm the name of the Secrets Manager secret: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.secretsmanager_secret/customer-managed-key: \"Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below).\"" ], "regeneration_required": true } ], "required_verification": [ "Confirm the name of the Secrets Manager secret: the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Confirm the name of the Secrets Manager secret: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.secretsmanager_secret/customer-managed-key: \"Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below).\"", "contract note aws.secretsmanager_secret/recovery-window: \"A person confirms the deletion safety the application needs, since how long a deleted STACKIT secret can be restored is not documented.\"", "contract note aws.secretsmanager_secret/tc-secretsmanager-secret-name: \"A person confirms the secret name or path the application looks up on the target, or accepts the new one.\"", "contract note aws.secretsmanager_secret/tc-ssm-parameter-name: \"A person confirms the name the application uses to look the parameter up on the target, or accepts the new one.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/tc-secretsmanager-secret-name", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false } ] } }, { "id": "RSH-b2d8975431a4", "why": "The knowledge base cannot decide 7 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-SECURITY-GROUP-EGRESS-RULE-PROTOCOL", "kind": "egress-rule-protocol", "family": "aws.security_group", "title": "Decide how the target enforces the protocol of the outbound rules of the security group", "block": "egress", "category": "network-exposure", "why": "The knowledge base cannot decide \"egress-rule-protocol\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|egress-rule-protocol" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide how the target enforces the protocol of the outbound rules of the security group for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-EGRESS-SOURCES", "kind": "egress-sources", "family": "aws.security_group", "title": "Decide how the target enforces the destinations the outbound rules of the security group allow", "block": "egress", "category": "network-exposure", "why": "The knowledge base cannot decide \"egress-sources\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|egress-sources" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide how the target enforces the destinations the outbound rules of the security group allow for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-INGRESS-SOURCES", "kind": "ingress-sources", "family": "aws.security_group", "title": "Confirm the sources the inbound rules of the security group allow", "block": "ingress", "category": "network-exposure", "why": "The knowledge base cannot decide \"ingress-sources\" of the aws.security_group contract for 1 unit (LEDGER): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|ingress-sources" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for {subject}: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-NETWORK-TOPOLOGY-BOUNDARY", "kind": "network-topology-boundary", "family": "aws.security_group", "title": "Confirm that the project is the boundary of one network", "block": "network-topology-boundary", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-topology-boundary\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|network-topology-boundary" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for {subject}: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-RULE-PORTS", "kind": "rule-ports", "family": "aws.security_group", "title": "Confirm the ports of the rules of the security group", "block": "egress", "category": "network-exposure", "why": "The knowledge base cannot decide \"rule-ports\" of the aws.security_group contract for 1 unit (LEDGER): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|rule-ports" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for {subject}: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-SECURITY-GROUP-VPC-MEMBERSHIP", "kind": "security-group-vpc-membership", "family": "aws.security_group", "title": "Decide which networks the security group may be attached to (a STACKIT group has no network scope)", "block": "vpc_id", "category": "network-exposure", "why": "The knowledge base cannot decide \"security-group-vpc-membership\" of the aws.security_group contract for 1 unit (UNSUPPORTED): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|security-group-vpc-membership" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide which networks the security group may be attached to (a STACKIT group has no network scope) for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STATEFUL", "kind": "stateful", "family": "aws.security_group", "title": "Review the stateful setting", "block": "stateful", "category": "network-exposure", "why": "The knowledge base cannot decide \"stateful\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|stateful" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the stateful setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "state_reason": "a person's decision or input is still open This is the state of the setting of {name} unit that asks the most, Decide how the target enforces the protocol of the outbound rules of the security group; the 7 settings of the record state their own.", "source_observation": "The source states 7 critical settings on {subject} that the knowledge base cannot decide: Decide how the target enforces the protocol of the outbound rules of the security group; Decide how the target enforces the destinations the outbound rules of the security group allow; Confirm the sources the inbound rules of the security group allow; Confirm that the project is the boundary of one network; Confirm the ports of the rules of the security group; Decide which networks the security group may be attached to (a STACKIT group has no network scope); Review the stateful setting.", "generated_target_behavior": "Decide how the target enforces the protocol of the outbound rules of the security group: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). Decide how the target enforces the destinations the outbound rules of the security group allow: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). Confirm the sources the inbound rules of the security group allow: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the ports of the rules of the security group: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on {subject}. The plan refuses REF/root/security-group-membership-parity. In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the stateful setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings).", "residual_difference": "Decide how the target enforces the protocol of the outbound rules of the security group: the target behaviour of {name} setting is not established Decide how the target enforces the destinations the outbound rules of the security group allow: the target behaviour of {name} setting is not established Confirm the sources the inbound rules of the security group allow: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the ports of the rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the stateful setting: the target behaviour of {name} setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/open-settings now.", "next_action": "Decide how the target enforces the protocol of the outbound rules of the security group: Decide how the target enforces the protocol of the outbound rules of the security group for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Decide how the target enforces the protocol of the outbound rules of the security group: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; {name} setting is not carried as an enforced control. protocol → stackit_security_group_rule.protocol (pinned provider). the egress restriction setting reads the same attribute and is REVIEW exactly when the egress restriction check fires; {name} semantic is then REVIEW as well, so the two critical readers of egress.protocol never disagree (TRANSFORMED only when neither check fires).", "Decide how the target enforces the destinations the outbound rules of the security group allow: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; {name} setting is not carried as an enforced control. As ingress sources; the egress restriction setting reads egress.cidr_blocks too and is REVIEW exactly when the egress restriction check fires — the same order here, so the two never disagree.", "Confirm the sources the inbound rules of the security group allow: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; {name} setting is not carried as an enforced control. Whether the draft carries {name} setting is decided by its semantic ledger entry \"security group rules\", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).", "Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on {name} unit and leaves the setting to a person: the target does not settle it by itself (a finding of {name} unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, {name} security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.", "Confirm the ports of the rules of the security group: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; {name} setting is not carried as an enforced control. Whether the draft carries {name} setting is decided by its semantic ledger entry \"security group rules\", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of {name} unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.", "Review the stateful setting: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; {name} setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true)." ], "closes_when": [ "Decide how the target enforces the protocol of the outbound rules of the security group: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.", "Decide how the target enforces the destinations the outbound rules of the security group allow: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.", "Confirm the sources the inbound rules of the security group allow: The knowledge base states no closing condition for {name} setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm the sources the inbound rules of the security group allow: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.", "Confirm that the project is the boundary of one network: The knowledge base states no closing condition for {name} setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Confirm the ports of the rules of the security group: The knowledge base states no closing condition for {name} setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm the ports of the rules of the security group: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in {name} project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.", "Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference." ], "required_inputs": [], "resolution_paths": [ { "id": "ingress-sources/verify-on-target", "title": "Confirm the sources the inbound rules of the security group allow: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true }, { "id": "network-topology-boundary/bring-the-closing-evidence", "title": "Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "regeneration_required": true }, { "id": "rule-ports/verify-on-target", "title": "Confirm the ports of the rules of the security group: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true }, { "id": "security-group-vpc-membership/verify-on-target", "title": "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true } ], "required_verification": [ "Confirm the sources the inbound rules of the security group allow: the check, proof or closing evidence is recorded with its result", "Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result", "Confirm the ports of the rules of the security group: the check, proof or closing evidence is recorded with its result", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Confirm the sources the inbound rules of the security group allow: Manual work remains: a person closes the semantic, the draft does not.", "Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.", "Confirm the ports of the rules of the security group: Manual work remains: a person closes the semantic, the draft does not.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"", "contract note aws.security_group/ingress-sources: \"cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).\"", "contract note aws.security_group/rule-ports: \"Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).\"", "contract note aws.security_group/security-group-vpc-membership: \"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in {name} project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.\"", "contract note aws.security_group/vpc-egress-rules: \"As vpc ingress rules (direction egress).\"", "contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false }, { "id": "REF/root/security-group-membership-parity", "mode": "REFUSE", "phase": "SECURITY", "executable": false, "waits_for_this": false } ] } }, { "id": "RSH-be63643f5df1", "why": "The knowledge base cannot decide 4 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-security-architect.", "required_evidence": [], "items": [ { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-DEFINITIONS", "kind": "td-container-definitions", "family": "aws.ecs", "title": "Confirm the container definitions of the ECS task definition", "block": "td-container-definitions", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-definitions\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|td-container-definitions" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container definitions of the ECS task definition for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-IMAGE-REGISTRY", "kind": "td-container-image-registry", "family": "aws.ecs", "title": "Confirm the container image registry", "block": "td-container-image-registry", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-image-registry\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|td-container-image-registry" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container image registry for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-PLAINTEXT-SECRET-ENV", "kind": "td-container-plaintext-secret-env", "family": "aws.ecs", "title": "Confirm the container plaintext secret env", "block": "td-container-plaintext-secret-env", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-plaintext-secret-env\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|td-container-plaintext-secret-env" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container plaintext secret env for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-AWS-ECS-TD-CONTAINER-SECRET-REFERENCES", "kind": "td-container-secret-references", "family": "aws.ecs", "title": "Confirm the container secret references", "block": "td-container-secret-references", "category": "secret-handling", "why": "The knowledge base cannot decide \"td-container-secret-references\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|td-container-secret-references" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the container secret references for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "state_reason": "a person's decision or input is still open This is the state of the setting of {name} unit that asks the most, Confirm the container definitions of the ECS task definition; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on {subject} that the knowledge base cannot decide: Confirm the container definitions of the ECS task definition; Confirm the container image registry; Confirm the container plaintext secret env; Confirm the container secret references.", "generated_target_behavior": "Confirm the container definitions of the ECS task definition: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect). Confirm the container image registry: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect). Confirm the container plaintext secret env: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect). Confirm the container secret references: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect).", "residual_difference": "Confirm the container definitions of the ECS task definition: the target behaviour of {name} setting is not established Confirm the container image registry: the target behaviour of {name} setting is not established Confirm the container plaintext secret env: the target behaviour of {name} setting is not established Confirm the container secret references: the target behaviour of {name} setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-security-architect now.", "next_action": "Confirm the container definitions of the ECS task definition: Confirm the container definitions of the ECS task definition for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm the container definitions of the ECS task definition: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry.", "Confirm the container image registry: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses.", "Confirm the container plaintext secret env: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated.", "Confirm the container secret references: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, \"the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store\", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own)." ], "closes_when": [ "Confirm the container definitions of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.", "Confirm the container image registry: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.", "Confirm the container plaintext secret env: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.", "Confirm the container secret references: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/open-settings-security-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "RSH-cb0cea16aa72", "why": "The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-platform-architect.", "required_evidence": [], "items": [ { "id": "DEC-OPS-AWS-ECS-SERVICE-DESIRED-COUNT", "kind": "service-desired-count", "family": "aws.ecs", "title": "Review the service desired count setting", "block": "desired_count", "category": "availability-durability", "why": "The knowledge base cannot decide \"service-desired-count\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|service-desired-count" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the service desired count setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on {subject} that the knowledge base cannot decide: Review the service desired count setting.", "generated_target_behavior": "Review the service desired count setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-platform-architect).", "residual_difference": "Review the service desired count setting: the target behaviour of {name} setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-platform-architect now.", "next_action": "Review the service desired count setting: Review the service desired count setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the service desired count setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. desired_count is the number of tasks ECS keeps running (ecs_service docs: 'Number of instances of the task definition to place and keep running'); on SKE it becomes Deployment replicas or a HorizontalPodAutoscaler floor. The draft writes it as the replicas of the Deployment in kubernetes/\u003cservice\u003e/manifests.yaml when it is a literal number (a HorizontalPodAutoscaler owns the count where the service has a scaling target and policy the draft translates; a number that is not visible statically is a REQUIRED_ token) — a person confirms the number, REVIEW." ], "closes_when": [ "Review the service desired count setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/open-settings-platform-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "RSH-d2eec00d6c00", "why": "The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-platform-architect.", "required_evidence": [], "items": [ { "id": "DEC-GEN-AWS-ECS-TASK-DEFINITION", "kind": "task-definition", "family": "aws.ecs", "title": "Review the task definition setting", "block": "task-definition", "why": "The knowledge base cannot decide \"task-definition\" of the aws.ecs contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|task-definition" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the task definition setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on {subject} that the knowledge base cannot decide: Review the task definition setting.", "generated_target_behavior": "Review the task definition setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-platform-architect).", "residual_difference": "Review the task definition setting: the target behaviour of {name} setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-platform-architect now.", "next_action": "Review the task definition setting: Review the task definition setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the task definition setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. The ECS task definition: the containers a service runs, with their CPU and memory, environment, secrets and health checks." ], "closes_when": [ "Review the task definition setting: A person translates the task definition into Kubernetes Deployments and Services on SKE (CPU and memory, environment, secrets and health checks become manifest fields); the rule names a Cloud Foundry push as the other way for a simple web app." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/open-settings-platform-architect", "mode": "MANUAL", "phase": "PLATFORM", "executable": true, "waits_for_this": false } ] } }, { "id": "RSH-d431130ed2e0", "why": "The knowledge base cannot decide 6 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings.", "required_evidence": [], "items": [ { "id": "DEC-NET-AWS-SECURITY-GROUP-EGRESS-RESTRICTION", "kind": "egress-restriction", "family": "aws.security_group", "title": "Decide the outbound (egress) rules of the security group", "block": "egress", "category": "network-exposure", "why": "The knowledge base cannot decide \"egress-restriction\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|egress-restriction" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for {subject}: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-NETWORK-TOPOLOGY-BOUNDARY", "kind": "network-topology-boundary", "family": "aws.security_group", "title": "Confirm that the project is the boundary of one network", "block": "network-topology-boundary", "category": "network-exposure", "why": "The knowledge base cannot decide \"network-topology-boundary\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|network-topology-boundary" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for {subject}: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-RULE-PORTS", "kind": "rule-ports", "family": "aws.security_group", "title": "Confirm the ports of the rules of the security group", "block": "egress", "category": "network-exposure", "why": "The knowledge base cannot decide \"rule-ports\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|rule-ports" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "REQUIRES_VERIFICATION", "next_action": "Verify on the target for {subject}: the check, proof or closing evidence is recorded with its result." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-SECURITY-GROUP-VPC-MEMBERSHIP", "kind": "security-group-vpc-membership", "family": "aws.security_group", "title": "Decide which networks the security group may be attached to (a STACKIT group has no network scope)", "block": "vpc_id", "category": "network-exposure", "why": "The knowledge base cannot decide \"security-group-vpc-membership\" of the aws.security_group contract for 1 unit (UNSUPPORTED): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|security-group-vpc-membership" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide which networks the security group may be attached to (a STACKIT group has no network scope) for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-VALUES", "kind": "standalone-rule-values", "family": "aws.security_group", "title": "Review the standalone rule values setting", "block": "standalone-rule-values", "category": "network-exposure", "why": "The knowledge base cannot decide \"standalone-rule-values\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|standalone-rule-values" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the standalone rule values setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-NET-AWS-SECURITY-GROUP-STATEFUL", "kind": "stateful", "family": "aws.security_group", "title": "Review the stateful setting", "block": "stateful", "category": "network-exposure", "why": "The knowledge base cannot decide \"stateful\" of the aws.security_group contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|stateful" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the stateful setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "state_reason": "the execution plan refuses REF/root/security-group-membership-parity because the target has no counterpart for the setting: a person accepts the difference or redesigns, and the step stays refused This is the state of the setting of {name} unit that asks the most, Decide which networks the security group may be attached to (a STACKIT group has no network scope); the 6 settings of the record state their own.", "source_observation": "The source states 6 critical settings on {subject} that the knowledge base cannot decide: Decide the outbound (egress) rules of the security group; Confirm that the project is the boundary of one network; Confirm the ports of the rules of the security group; Decide which networks the security group may be attached to (a STACKIT group has no network scope); Review the standalone rule values setting; Review the stateful setting.", "generated_target_behavior": "Decide the outbound (egress) rules of the security group: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the ports of the rules of the security group: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on {subject}. The plan refuses REF/root/security-group-membership-parity. In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the standalone rule values setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). Review the stateful setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings).", "residual_difference": "Decide the outbound (egress) rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the ports of the rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the standalone rule values setting: the target behaviour of {name} setting is not established Review the stateful setting: the target behaviour of {name} setting is not established", "execution_effect": "No step waits for it. Held by something else first: REF/root/security-group-membership-parity.", "next_action": "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Decide the outbound (egress) rules of the security group: A check of the knowledge base (sg egress restricted) fired on {name} unit and leaves the setting to a person: the target does not settle it by itself (a finding of {name} unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.", "Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on {name} unit and leaves the setting to a person: the target does not settle it by itself (a finding of {name} unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, {name} security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.", "Confirm the ports of the rules of the security group: This draft writes no stackit_security_group, stackit_security_group_rule for {name} unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of {name} draft: A check of the knowledge base (sg rule not rendered) fired on {name} unit and leaves the setting to a person: the target does not settle it by itself (a finding of {name} unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): This draft writes no stackit_security_group, stackit_security_group_rule for {name} unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of {name} draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of {name} unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.", "Review the standalone rule values setting: This draft writes no stackit_security_group, stackit_security_group_rule for {name} unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of {name} draft: A check of the knowledge base (sg rule not rendered) fired on {name} unit and leaves the setting to a person: the target does not settle it by itself (a finding of {name} unit describes it). An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW.", "Review the stateful setting: This draft writes no stackit_security_group, stackit_security_group_rule for {name} unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of {name} draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; {name} setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true)." ], "closes_when": [ "Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for {name} setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: The knowledge base states no closing condition for {name} setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Confirm the ports of the rules of the security group: The knowledge base states no closing condition for {name} setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.", "Confirm the ports of the rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in {name} project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.", "Review the standalone rule values setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.", "Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference." ], "required_inputs": [], "resolution_paths": [ { "id": "egress-restriction/verify-on-target", "title": "Decide the outbound (egress) rules of the security group: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true }, { "id": "network-topology-boundary/bring-the-closing-evidence", "title": "Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for", "prerequisites": [ "the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.", "regeneration: not stated — treated as required" ], "risk": [ "A decision recorded without the evidence the finding names leaves the difference the finding describes in place." ], "evidence": [ "contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "regeneration_required": true }, { "id": "rule-ports/verify-on-target", "title": "Confirm the ports of the rules of the security group: Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true }, { "id": "security-group-vpc-membership/verify-on-target", "title": "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm", "prerequisites": [ "the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run" ], "effects": [ "A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.", "regeneration: not stated — treated as required" ], "risk": [ "A setting confirmed from the draft alone, without the check, can still differ at runtime." ], "evidence": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"" ], "regeneration_required": true } ], "required_verification": [ "Decide the outbound (egress) rules of the security group: the check, proof or closing evidence is recorded with its result", "Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result", "Confirm the ports of the rules of the security group: the check, proof or closing evidence is recorded with its result", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result" ], "next_run_changes": [ "Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes." ], "remains_manual": [ "Decide the outbound (egress) rules of the security group: Manual work remains: a person closes the semantic, the draft does not.", "Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.", "Confirm the ports of the rules of the security group: Manual work remains: a person closes the semantic, the draft does not.", "Decide which networks the security group may be attached to (a STACKIT group has no network scope): Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"", "contract note aws.security_group/ingress-sources: \"cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).\"", "contract note aws.security_group/rule-ports: \"Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).\"", "contract note aws.security_group/security-group-vpc-membership: \"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in {name} project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.\"", "contract note aws.security_group/vpc-egress-rules: \"As vpc ingress rules (direction egress).\"", "contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"" ], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/open-settings", "mode": "MANUAL", "phase": "SECURITY", "executable": true, "waits_for_this": false }, { "id": "REF/root/security-group-membership-parity", "mode": "REFUSE", "phase": "SECURITY", "executable": false, "waits_for_this": false } ] } } ], "template": [ { "id": "DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:7d4ce9ee9ce1f3acbba48c88c829f6eb66a62259ada1ad27007786228edd5d9d", "artifact_sha256": "sha256:d657345b9c347c9f67a71d34532dd9b788bb6c142734877e5b4a3580c976dd9a", "kb_dependencies_sha256": "sha256:3cff130385543c2c208d88b90edeb0c1f0fe7d19da8e60e6420d1f8dfd5b3f07", "members": [ "convert:module.retail_app_ecs.module.alb.aws_lb.this:network_id:AMBIGUOUS_INSTANCE_SELECTION" ] }, { "id": "DEC-GEN-CONVERT-API-OPT-IN", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:e38398c0e3d250ba5bc2f41d119954b6cca973ef84267dcb555af7fa66082039", "artifact_sha256": "sha256:8f448648a56ee601d5c9aeef0b5a933cd2aabe601c1db6a7695df6b7315e6bef", "kb_dependencies_sha256": "sha256:03735a47b22c84235c95ed16b33e929eb21e905431c7a1c2103a67e6c13f9395", "members": [ "convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN" ] }, { "id": "DEC-GEN-CONVERT-DATA-MOVEMENT", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:bd6dc33bd3777ba67c03a89361624334a25a61983906190c138fe87904c08a32", "artifact_sha256": "sha256:15bd4a976759c2e9e78fcac08a2e4bb165e943ae8006503f5b7e166f2e075a97", "kb_dependencies_sha256": "sha256:610870c4321b580122859ef332af5301a6bd3a8973057240bd04c7d631e03a41", "members": [ "convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:data:DATA_MOVEMENT", "convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:data:DATA_MOVEMENT", "convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:data:DATA_MOVEMENT", "convert:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this:data:DATA_MOVEMENT", "convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:data:DATA_MOVEMENT" ] }, { "id": "DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:da0e0583e3f086831a47b05396b1d30756583e8d7f3d4dd2b89e37050a55f030", "artifact_sha256": "sha256:dc1e43b17cf02fc8aa65d7e26ca697d4699550aa5046f8552e15968db7b53c64", "kb_dependencies_sha256": "sha256:df6451f6350a2b971c09bbf5ecf6ab18b5750dd81cbfa67f5af0282c74b4283b", "members": [ "convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:version:ENGINE_VERSION_DOWNGRADE" ] }, { "id": "DEC-GEN-CONVERT-EXPOSURE-WIDENED", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:423e4ba2d45f712b067c92f5838a736429f1ad4d536c2a73854bfed78e11de19", "artifact_sha256": "sha256:6a3930f51ec64054caff9296506c7e1d98a191a1b856d8742e3f58fb75e37071", "kb_dependencies_sha256": "sha256:54db0cb3f0a546a487cbbf2ad23a0bc21bc2410cb91089a25cec295baf9709b2", "members": [ "convert:module.dependencies.aws_mq_broker.mq:exposure:EXPOSURE_WIDENED", "convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:exposure:EXPOSURE_WIDENED", "convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED", "convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:exposure:EXPOSURE_WIDENED", "convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED", "module.dependencies.aws_mq_broker.mq|network-exposure" ] }, { "id": "DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:d7bf04a14592c56905fb4aaaf64310c4a399ab5a50cefaace7cdb6f7435abf4a", "artifact_sha256": "sha256:f4d05a27ee3dc30c9802a025a3ba2390b8efe68eba7027ef1a0a9d29bc87a4d0", "kb_dependencies_sha256": "sha256:9a087b808a89168f09e6e245d0b89524c03ac3e758f07e554c71661a6068b367", "members": [ "convert:module.retail_app_ecs.module.alb.aws_lb.this:target_pools:INGRESS_EXPOSURE_PATH" ] }, { "id": "DEC-GEN-CONVERT-POD-SEGMENTATION", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:29854ad7b6a2cfd7733fbf071811c930e5023b74bc53cbea83bece2408c8973d", "artifact_sha256": "sha256:4e0ef236960deac4d2b2ebae29798e224cb78827e6fa6fbb95b47aa06542708b", "kb_dependencies_sha256": "sha256:0ab49a10e7889d96d2724e04ceb59d86dea0c9e7505705506b10ad00b58faa14", "members": [ "convert:module.retail_app_ecs.module.carts_service.aws_security_group.this:security-group:POD_SEGMENTATION", "convert:module.retail_app_ecs.module.catalog_service.aws_security_group.this:security-group:POD_SEGMENTATION", "convert:module.retail_app_ecs.module.checkout_service.aws_security_group.this:security-group:POD_SEGMENTATION", "convert:module.retail_app_ecs.module.orders_service.aws_security_group.this:security-group:POD_SEGMENTATION", "convert:module.retail_app_ecs.module.ui_service.aws_security_group.this:security-group:POD_SEGMENTATION" ] }, { "id": "DEC-GEN-CONVERT-SIZE-FROM-SOURCE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:68bd3fec47f2c8f8025a99a3b80707342357b42589bda9f46be69f7182fb9730", "artifact_sha256": "sha256:47d23376f79ef8f3b2f4b11187b1b9a723301f6aa27bae31bad3b3205556514b", "kb_dependencies_sha256": "sha256:4aefcdb4f8cff3c728aa8535ac7777fa49c3c4576077a04da8978b2e25bb606e", "members": [ "convert:module.dependencies.aws_mq_broker.mq:dependencies_mq_plan_name:SIZE_FROM_SOURCE", "convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:dependencies_checkout_elasticache_redis_default_plan_name:SIZE_FROM_SOURCE", "convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:dependencies_orders_rds_this_flavor_id:SIZE_FROM_SOURCE" ] }, { "id": "DEC-GEN-CONVERT-WORKLOAD-PLACEMENT", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:8423085c8f163f8f11a333347eb7eb7897eac61922c9c6cd69a52a5a7a6893f9", "artifact_sha256": "sha256:6fcbcaeb18342452421d74df69cd6a2867a13923f52b57ba684e15b806ebb8c1", "kb_dependencies_sha256": "sha256:bf8b1a74b9af3006bff3fdbd5579c5d953ccadafcdfefcf59bee748eb6c1e230", "members": [ "convert:module.vpc.module.vpc.aws_subnet.private:network:WORKLOAD_PLACEMENT" ] }, { "id": "DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:7098dc52d2c6183a8387b8e707e8001532ae3f4483e9dbd7a0e4f826acc8a0ff", "artifact_sha256": "sha256:0fd1c4ea746073abd592bcc4489b34673f50fda951496c9a3f15f5009f1f4539", "kb_dependencies_sha256": "sha256:8b541d850bc366f0bb88d4fa96b68a13df34bd549295919c5c1c9f0ee460fccd", "members": [ "stackitlogs:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks:retention_over_180_days" ] }, { "id": "DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:cbfcbf1e12e98cb3608485caffc5de82e33e3517a0845fc9ca14cbcf7e207d0e", "artifact_sha256": "sha256:37a4992d7cb1b57ebe73b1567f6fec7b6f2f3de527370a9ba50c9d2e600bccea", "kb_dependencies_sha256": "sha256:b7b1559abec6cce3207e0a1fc245a3c875b27a798d1bb922309519ace4b7642c", "members": [ "stackitroute:module.vpc.module.vpc.aws_route_table.private:NAT_FIXED_EGRESS_ADDRESS_LOST" ] }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-CLOUDWATCH-LOG-GROUP-ECS-TASKS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:e71bb0607c0a5ebb2ed51336e2dafb83d87e2ea428ba9c2c59f10bff5d5552d6", "kb_dependencies_sha256": "sha256:5774655a1d63aa238425b6099fc69a5a26fd5b9b39b1bcac21ee61ed7f554738", "members": [ "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks|tc-name" ] }, { "id": "DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:be230134eb933993e87d2acca45d6600aaef296e10ea3f5acfe1bc2868503c4c", "kb_dependencies_sha256": "sha256:f253dc1a178fa55575e3271a5dc6885b281fd306dbc95942af5eaa8225297c89", "members": [ "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|key-schema", "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|point-in-time-recovery", "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|ttl" ] }, { "id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:376e1fb33723b9c06d87ddd508b5b8413291ae6a06d048c7410dbf9c03e42876", "kb_dependencies_sha256": "sha256:bc69719ca67a8a6cb0a7dbb03987ea3abd9d872b00f99be4b5c8a2db76828a44", "members": [ "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|index-projection-and-name", "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|tc-dynamodb-table-name" ] }, { "id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:d1f3a830429052e0e3744c4e3ab5b71cad9aa7b33241a35e16b57107591f512f", "kb_dependencies_sha256": "sha256:6c34d3ca5f92fe1a1fe2ecbb48b9debfdfa82ea1d7512faa7ab7dd98db1e5a09", "members": [ "module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|encryption-at-rest" ] }, { "id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:5049a4a2c775c1575d3ddd82422180bceb433bf018864e226e722dd02283029d", "kb_dependencies_sha256": "sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6", "members": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|task-definition" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:7c029bf6912dd7e466ba3f83acb8125e103ae34e47e23de3a15e3579e13c7302", "kb_dependencies_sha256": "sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d", "members": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-execute-command", "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-task-definition", "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-execution-role-arn", "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-task-role-arn" ] }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:2884efd954f2c3166b542350df1a4b1da31abe480928a9ae49c5b5ec6e816f03", "kb_dependencies_sha256": "sha256:740b2adc13bea6b71c5b1d64e72ccad5fc1c818dc112516074cfe17a9241851e", "members": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-connect-values", "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-discovery", "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-network-placement", "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-public-ip-setting", "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-network-mode" ] }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:ad056df0eb4026158ba41d1e9bd51c3acb82966bbafea534e35a1c48bcc88e3c", "kb_dependencies_sha256": "sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2", "members": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-desired-count" ] }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:8fc8c7f0b478f96951ae2ef830884975f85854c85e40dc0f90397cfd96fe7297", "kb_dependencies_sha256": "sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c", "members": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-definitions", "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-image-registry", "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-plaintext-secret-env", "module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-secret-references" ] }, { "id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:bd5bc5f42f2ccdd48a73d45fd65cc7d9a1889bd33e8ed34e32675b48cd9d43a6", "kb_dependencies_sha256": "sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6", "members": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|task-definition" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:269c883e5118d2289881d64bad4bc6c1a8026b09e6b86d27706930ba115e503d", "kb_dependencies_sha256": "sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d", "members": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-execute-command", "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-task-definition", "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-execution-role-arn", "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-task-role-arn" ] }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:a7b1d712f11c89a96ee56918ef329084ce43708b20a3f11098a99baba0b9f33c", "kb_dependencies_sha256": "sha256:740b2adc13bea6b71c5b1d64e72ccad5fc1c818dc112516074cfe17a9241851e", "members": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-connect-values", "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-discovery", "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-network-placement", "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-public-ip-setting", "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-network-mode" ] }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:73e2e43b1b9a4861741108c4c531cf9c63a53c75ee5e01b4b73dff8acf27e7f2", "kb_dependencies_sha256": "sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2", "members": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-desired-count" ] }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:12a0c54a0723669691b414ab9cfc18d1b7c1a075bd4a331607a44ac5ce805152", "kb_dependencies_sha256": "sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c", "members": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-definitions", "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-image-registry", "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-plaintext-secret-env", "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-secret-references" ] }, { "id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:623898041d449cd3e3c2d56f8809be431447e9c525cd8532005e86be1b16a734", "kb_dependencies_sha256": "sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6", "members": [ "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|task-definition" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:b6de1150e6debd14d0a9aa3604ac089dfcfeba7948cdbead286de7bd9595abde", "kb_dependencies_sha256": "sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d", "members": [ "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-execute-command", "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-task-definition", "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-execution-role-arn", "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-task-role-arn" ] }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:182803b416e449e90a1a14eb9db44d8d5c0bef7a7f4e34722f4e90a13b95e587", "kb_dependencies_sha256": "sha256:740b2adc13bea6b71c5b1d64e72ccad5fc1c818dc112516074cfe17a9241851e", "members": [ "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-connect-values", "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-discovery", "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-network-placement", "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-public-ip-setting", "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-network-mode" ] }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:2a81745ad63beb643a056962323f1bed54efeeb2e2761acae2698f863e5ffbb2", "kb_dependencies_sha256": "sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2", "members": [ "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-desired-count" ] }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:e14fe5e69f14c70daaa5e1cb8fb1b01b17f0cf1b730d6634665513ae538a7be6", "kb_dependencies_sha256": "sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c", "members": [ "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-container-definitions", "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-container-image-registry", "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-container-plaintext-secret-env", "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-container-secret-references" ] }, { "id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:c0df273c3ce35360ad2de7275bf8232309dfe3548560c2d2bf71e5f5209e4108", "kb_dependencies_sha256": "sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6", "members": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|task-definition" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:9355891040e968a2302882459fd2e541f14ac72d084e886cfe7bd6401c5668d1", "kb_dependencies_sha256": "sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d", "members": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-execute-command", "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-task-definition", "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-execution-role-arn", "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-task-role-arn" ] }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:c3fbe4584e6bfa97ed29b1ba37ed5b2284ee1bf2f21e5df2d762845bfcc9bcce", "kb_dependencies_sha256": "sha256:740b2adc13bea6b71c5b1d64e72ccad5fc1c818dc112516074cfe17a9241851e", "members": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-connect-values", "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-discovery", "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-network-placement", "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-public-ip-setting", "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-network-mode" ] }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:a99af72e26244afeba9183b468016c2f97d481f9ef9e344f8b0cd66bc4f96e85", "kb_dependencies_sha256": "sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2", "members": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-desired-count" ] }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:be34e739bc39a8d7f9a75ec54e4a06207f7b84000f5f784e735bcc8fac34a2be", "kb_dependencies_sha256": "sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c", "members": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-definitions", "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-image-registry", "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-plaintext-secret-env", "module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-secret-references" ] }, { "id": "DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:cd84cdba0aa722b0700f256589172631f462ab3a79939d8703d4dcf136e51830", "kb_dependencies_sha256": "sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6", "members": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|task-definition" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:13b648f793c6330d876e75b4a9e7de9a954b1465c6fd5e915538b738c05650ba", "kb_dependencies_sha256": "sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d", "members": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-execute-command", "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-task-definition", "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-execution-role-arn", "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-task-role-arn" ] }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:a803971360a7c14f2d1f59ef457345625b6b24b4ab02a4c951935921fa6b197c", "kb_dependencies_sha256": "sha256:e7d39dd26d25e95decbc7941cd521cd27187f04056ac8fbb3d6a588d2780ea49", "members": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-connect-values", "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-discovery", "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-load-balancer-target", "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-network-placement", "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-public-ip-setting", "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-network-mode" ] }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:892d8be364574bea145cb905c22d892bdcf013b62b24306a5e72cfd27f92bb59", "kb_dependencies_sha256": "sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2", "members": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-desired-count" ] }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:e4bca6f80507db70550fa30296dcb1663d180045b12ab84aef82f90af4d4591f", "kb_dependencies_sha256": "sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c", "members": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-container-definitions", "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-container-image-registry", "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-container-plaintext-secret-env", "module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-container-secret-references" ] }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-EIP-NAT", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:8d53b9492e347facc4402eb7bb6e29a11778a63c708b92d5e683cc85fb10dcd9", "kb_dependencies_sha256": "sha256:4bc458f7128cf963a901fb482f5f02839c79dbf8761eb465d1d4257468472a2f", "members": [ "module.vpc.module.vpc.aws_eip.nat|public-address" ] }, { "id": "DEC-DATA-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:a81099a7a19d0a70e93099ba046b0f6ffe0b067d5d7d330a726223a11b4a8a71", "kb_dependencies_sha256": "sha256:1ee3357c1d90f2bef2277d76647a933f82410caff1d0177f1f0e28eaee2ee43a", "members": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|seed-snapshot", "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|snapshots-off" ] }, { "id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:6a0885338cdc784fa0469bff7f3e328048bdf0779f8fe6695463e4f84db89ece", "kb_dependencies_sha256": "sha256:d1f381c53c8452030abb8fadded9bf0c6eb8d656d37128d0d538bd6b4f33a8dc", "members": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|network-placement" ] }, { "id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:22903c56db5911aeb017374334c4c459471b44cc52549e1be5fc3e282b7f0382", "kb_dependencies_sha256": "sha256:5d0001ac4c605ad621214b69352a2f2bad9716a15d2f911df0e9d0cdcedea51b", "members": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|failover-off", "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|parameter-group", "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|parameter-group-default", "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|tc-elasticache-replication-group-replication-group-id" ] }, { "id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:7a84420d04b71d9952e3521b09fbde28030d59bd2678d039f0ea48f4d8c6eec5", "kb_dependencies_sha256": "sha256:2c0d94a3cf7416d1d38ee33a2c9aee2886f57b65508423676b010d17130cd4c4", "members": [ "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|at-rest-encryption-off", "module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|tcp-elasticache-replication-group-transit-encryption-enabled" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:854ada05e50ac04e13e60fc48160978911c675e9023d17869e5df35f06130e06", "kb_dependencies_sha256": "sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06", "members": [ "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|iam-managed-ecs", "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|iam-trust-service-workload", "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|permissions", "module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|trust" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:51ceb0018ab2bfda815b7e25eead649fca3447af44bcb92f28bf7b0af815f4a4", "kb_dependencies_sha256": "sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be", "members": [ "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|iam-managed-customer-policy", "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|iam-trust-service-workload", "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|permissions", "module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|trust" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:473be156256464a573dc12f091fa5a8c4239899c98d3c87587560d5613b7f301", "kb_dependencies_sha256": "sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06", "members": [ "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|iam-managed-ecs", "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|iam-trust-service-workload", "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|permissions", "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|trust" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:4c1cdaf163c1329c050b9bb8c155cd2416b67516dfdcc85c9ebc37487c1c62ec", "kb_dependencies_sha256": "sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be", "members": [ "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|iam-managed-customer-policy", "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|iam-trust-service-workload", "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|permissions", "module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|trust" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:b7d645453be730367ca644e3bab971d447c08ed019d765ed139181f4eae4d09c", "kb_dependencies_sha256": "sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06", "members": [ "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|iam-managed-ecs", "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|iam-trust-service-workload", "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|permissions", "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|trust" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:4cc70f00b75b15f677d467aad39fca316ea2386384bb118334f60d1b56671a18", "kb_dependencies_sha256": "sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be", "members": [ "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|iam-managed-customer-policy", "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|iam-trust-service-workload", "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|permissions", "module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|trust" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:5cb92f5482d71bb1a60742351a8f0e11a6f28348d2ec19149d8368eb6def2cf7", "kb_dependencies_sha256": "sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06", "members": [ "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|iam-managed-ecs", "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|iam-trust-service-workload", "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|permissions", "module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|trust" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:2f0bb0ed7fec154e45a2cb12fe4064f9f20b82d2c47f71a7c542e4a2c02b85d2", "kb_dependencies_sha256": "sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be", "members": [ "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|iam-managed-customer-policy", "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|iam-trust-service-workload", "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|permissions", "module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|trust" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:0d3abc1d1e4e02ab819f5eb020fea10c4d78955084f9cfbda065762de79660b4", "kb_dependencies_sha256": "sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06", "members": [ "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|iam-managed-ecs", "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|iam-trust-service-workload", "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|permissions", "module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|trust" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:c2be12d3d2e2fb732e8477e43439fd19dffa3bc19f7641e8a62de8194da707fb", "kb_dependencies_sha256": "sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be", "members": [ "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|iam-managed-customer-policy", "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|iam-trust-service-workload", "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|permissions", "module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|trust" ] }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-INTERNET-GATEWAY-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:47c616336e5e1ad5768b91bfcb1100491e0fcda692c9b1fee7c3c8ca251f277e", "kb_dependencies_sha256": "sha256:06c50d347eb940460d3e20bd1422b491e8cd3f0defdee5b724acc00958dd3fa1", "members": [ "module.vpc.module.vpc.aws_internet_gateway.this|network-topology-boundary" ] }, { "id": "DEC-IAM-MODULE-RETAIL-APP-ECS-AWS-KMS-KEY-CMK", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:f89900f92525e7c55732bc4918958a09715b21610264e9c769a83f22f3d3d990", "kb_dependencies_sha256": "sha256:5cc7d34282526a9ba869dfbc29b4eeab68615cecc701d8ccbc66e89c7cea4d13", "members": [ "module.retail_app_ecs.aws_kms_key.cmk|deletion-window" ] }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:f757f9ce3f4966d7d8803d03f11e2b3a0e09c8f5cfa0e4a9c5081c4883698607", "kb_dependencies_sha256": "sha256:ddcf6e6a242b2d5dfe5aae8e00904e05e839215e95782b4cdf84013b73814c1a", "members": [ "module.retail_app_ecs.module.alb.aws_lb.this|client-restriction", "module.retail_app_ecs.module.alb.aws_lb.this|lb-routing-and-addressing", "module.retail_app_ecs.module.alb.aws_lb.this|lb-subnets", "module.retail_app_ecs.module.alb.aws_lb.this|network-exposure", "module.retail_app_ecs.module.alb.aws_lb.this|request-handling" ] }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:1f886639d618968c583259189057db4e9560ece36778f6e9a6944d4309935aca", "kb_dependencies_sha256": "sha256:7043acb60936099ccf2d02a9579423b35351e6dd828273b9d3ca0e98be258b2e", "members": [ "module.retail_app_ecs.module.alb.aws_lb.this|lb-connection-timeouts", "module.retail_app_ecs.module.alb.aws_lb.this|request-header-options", "module.retail_app_ecs.module.alb.aws_lb.this|tc-lb-name" ] }, { "id": "DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:1d010c1b6ab6c30f34ff7ae81cdd495a8a439b7de14ec99385aea80975a5725b", "kb_dependencies_sha256": "sha256:fcc72e842f52db1911a44094da0763f2f3861dca7a5764f68efe67724a1c29ff", "members": [ "module.dependencies.aws_mq_broker.mq|broker-users", "module.dependencies.aws_mq_broker.mq|tc-user--username" ] }, { "id": "DEC-NET-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:0677d3c44629dc255384d38daf4d1be95731a7b0f973c9589d4bbae60eb3321a", "kb_dependencies_sha256": "sha256:6b26ef76da0d040b82dfcce3823bf0c9ee2bb5dbbfaf655bb610a1b13740c547", "members": [ "module.dependencies.aws_mq_broker.mq|broker-network" ] }, { "id": "DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:ef3bdbf036354a9489578e8cc7954091c560180b4f5f81788a824d645c25a480", "kb_dependencies_sha256": "sha256:d399c56bd61185be787a1d869bb94a3737d8820940db9567591409ba1b61ae9e", "members": [ "module.dependencies.aws_mq_broker.mq|engine-version", "module.dependencies.aws_mq_broker.mq|tc-mq-broker-broker-name", "module.dependencies.aws_mq_broker.mq|tcp-deployment-mode" ] }, { "id": "DEC-SEC-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:4e74b75b281d7cca7f66b57294584f30ce28513bc601ae4284f9e27f1e62c0fb", "kb_dependencies_sha256": "sha256:e2afe9f65e46c927d6dbb417aa8c41e8885a02158b60cc03c77e11f5edd05218", "members": [ "module.dependencies.aws_mq_broker.mq|tc-user--password" ] }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:3e80a05723d110a3e1c0d44751fa6e6caf815a7d234eb525820b1d1c73adc582", "kb_dependencies_sha256": "sha256:29e4f09e1d1c036f8c792a72964586ae14d7aacaa4624f262ad51c5164d96d4f", "members": [ "module.vpc.module.vpc.aws_nat_gateway.this|fixed-egress-ip", "module.vpc.module.vpc.aws_nat_gateway.this|nat-placement", "module.vpc.module.vpc.aws_nat_gateway.this|network-topology-boundary" ] }, { "id": "DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:a9e0ee79957045c23a463b07a97b52afc357b86ed2311d9024f40b66f15e8e40", "kb_dependencies_sha256": "sha256:015d35ebcb41585433b3b03ff85346e2bb1ce130ac85ae7e90a2f4f6eeeef8d2", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|access-and-encryption-settings", "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|credentials-and-keys-settings", "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|domain-credentials-and-keys", "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|domain-settings", "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|fine-grained-access", "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|nbr-aws-opensearch-domain-policy", "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|opensearch-domain-policy-resource" ] }, { "id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:efd09ed3163fcd2d1f8f02ae26a7794ec875cfcd3748cbee1def5e930d468b24", "kb_dependencies_sha256": "sha256:75be6c240904ea2183ff076fce9ad6f41158d5bfba70b5f029090b67a9cf1315", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|network-settings", "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|private-endpoint" ] }, { "id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:6624c3ac7454bc6f7584654b5457e914db689e9b03564a6ef798e8fd91f4c794", "kb_dependencies_sha256": "sha256:b373a18848a30ad0874a5fec861e8845077b85460e746a25d0b9d44985e18101", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|cluster-layout-settings", "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|engine-version", "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|storage-settings", "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|tc-opensearch-domain-domain-name" ] }, { "id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:caf9581bf513722f70799201583927c9f7d2aad376462690c78884ffb3e7913a", "kb_dependencies_sha256": "sha256:b5e10b2382a319f48047d0166c4f698c92a41acf6803429131b6c8cb00c3f98e", "members": [ "module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|encryption-at-rest" ] }, { "id": "DEC-DATA-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:3ac0ea2fe4b2c89a0ba32b318fb09555b19d7908dee3884848002f6aaab52ca2", "kb_dependencies_sha256": "sha256:5b13e5758572f5515974e89f2d84b9f3c1d0129e0f2e933bddac05a9567d5be5", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|backup-retention", "module.dependencies.module.catalog_rds.aws_rds_cluster.this|final-snapshot" ] }, { "id": "DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:30cbded70d6861ce65a80938e1025f6e3f6b4b28ba08fb7268b5246df0f1c22b", "kb_dependencies_sha256": "sha256:c4835a8b93fcba2849eaacdf4e71de6d98768797036cbb48f0b6210387745322", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|admin-username-not-carried" ] }, { "id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:08ef1795fb2ca2f1693f6c9f9ca0f87f030551d26b59f47d9f5e242c34a5a85d", "kb_dependencies_sha256": "sha256:f0163b390163c9abfb66c9c2e5830428595abbd5806227eb0ace7abc628c1c45", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|db-network-placement", "module.dependencies.module.catalog_rds.aws_rds_cluster.this|member-settings", "module.dependencies.module.catalog_rds.aws_rds_cluster.this|security-groups" ] }, { "id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:04c13bb75bcc4b3f06e8a9be6649f1aa33f1783b80e228945967077a7b7f440d", "kb_dependencies_sha256": "sha256:3141dd436e156b462d4a71ba5ebd86efdfe3091a9d43db74d443498d9b3853d5", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|engine", "module.dependencies.module.catalog_rds.aws_rds_cluster.this|engine-version", "module.dependencies.module.catalog_rds.aws_rds_cluster.this|member-engine", "module.dependencies.module.catalog_rds.aws_rds_cluster.this|tc-database-name", "module.dependencies.module.catalog_rds.aws_rds_cluster.this|tcf-rds-cluster-instance--identifier" ] }, { "id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:83e2e9a6dde82e51cd66d9801c1c5f0f3264133cdd53c48904171583c84daf89", "kb_dependencies_sha256": "sha256:1551bdcb47c689bbe49c9efbfa4e802a66189277f47e4cacfda15e3dac5d2222", "members": [ "module.dependencies.module.catalog_rds.aws_rds_cluster.this|admin-password", "module.dependencies.module.catalog_rds.aws_rds_cluster.this|parameter-and-option-groups", "module.dependencies.module.catalog_rds.aws_rds_cluster.this|storage-encryption" ] }, { "id": "DEC-DATA-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:c9776a97d7c44508822e47ba0976fac039372b9a459319ac8420e0010f5391f0", "kb_dependencies_sha256": "sha256:7582d365b5cf18a48a8578bf2e9673a1a1590455fd67d128c7917dd1e54f2cdb", "members": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this|final-snapshot" ] }, { "id": "DEC-IAM-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:56a8b21cfab709656b73f9d44bc0f7560aad7fc1566c66d5cd5addcb8bd1753c", "kb_dependencies_sha256": "sha256:c4835a8b93fcba2849eaacdf4e71de6d98768797036cbb48f0b6210387745322", "members": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this|admin-username-not-carried" ] }, { "id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:b3c81382b03c6c736acc4d26ff3e92a4345e4df4789e0623bd0f59c9b345b926", "kb_dependencies_sha256": "sha256:f0163b390163c9abfb66c9c2e5830428595abbd5806227eb0ace7abc628c1c45", "members": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this|db-network-placement", "module.dependencies.module.orders_rds.aws_rds_cluster.this|member-settings", "module.dependencies.module.orders_rds.aws_rds_cluster.this|security-groups" ] }, { "id": "DEC-OPS-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:5fbeb2619f0e2cfb47bde72a31bb3e3a1f5543ba5914660763055c373724e0c8", "kb_dependencies_sha256": "sha256:282d05fd56a28cd5bff146421fbd0febc7842ab3637ae182b9f279576b47992f", "members": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this|tc-database-name", "module.dependencies.module.orders_rds.aws_rds_cluster.this|tcf-rds-cluster-instance--identifier" ] }, { "id": "DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:ab8f2937699001b60dad6a667cbc1e25d1e136bd735d58b05008f2a9eb3b0d60", "kb_dependencies_sha256": "sha256:1551bdcb47c689bbe49c9efbfa4e802a66189277f47e4cacfda15e3dac5d2222", "members": [ "module.dependencies.module.orders_rds.aws_rds_cluster.this|admin-password", "module.dependencies.module.orders_rds.aws_rds_cluster.this|parameter-and-option-groups", "module.dependencies.module.orders_rds.aws_rds_cluster.this|storage-encryption" ] }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:1561d4bf75d1713671e851b18f2c392b9346c65555cab9b2398ea2763bc5b3d6", "kb_dependencies_sha256": "sha256:d2e1fb89315cf21674a6dea0b0b74b073d58e672b7d0724a1a663b3d68f19d9f", "members": [ "module.vpc.module.vpc.aws_route_table.private|egress-restriction", "module.vpc.module.vpc.aws_route_table.private|nat-fixed-egress-address", "module.vpc.module.vpc.aws_route_table.private|network-topology-boundary", "module.vpc.module.vpc.aws_route_table.private|route-destinations", "module.vpc.module.vpc.aws_route_table.private|route-targets", "module.vpc.module.vpc.aws_route_table.private|routes", "module.vpc.module.vpc.aws_route_table.private|subnet-association-target", "module.vpc.module.vpc.aws_route_table.private|tcr-route-table-vpc-id" ] }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:4381bcffbb8aba26ae5ac648a21eb6de290d0ac6a31e8dcfe9735ff5bb04a8aa", "kb_dependencies_sha256": "sha256:864ef886796905191fc25d42b580a577dc5a359a9dce4fe72db62b2c42c2763d", "members": [ "module.vpc.module.vpc.aws_route_table.public|network-topology-boundary", "module.vpc.module.vpc.aws_route_table.public|route-destinations", "module.vpc.module.vpc.aws_route_table.public|route-targets", "module.vpc.module.vpc.aws_route_table.public|routes", "module.vpc.module.vpc.aws_route_table.public|tcr-route-table-vpc-id" ] }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:195cb41bddbb96ebcec7e0f37d5f2f429896503f4ae7885eefe450c77faddf70", "kb_dependencies_sha256": "sha256:d5232f8c08470d7e2cf4d3f67d0a00b792688bf01cef4afeff71224246f0836f", "members": [ "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db|tc-secretsmanager-secret-name" ] }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:3648ebb527da2bc96efc5425a387853eeeef8b1af4da2208b4326214e2fe9417", "kb_dependencies_sha256": "sha256:78742954fe6dab86c51d83509ed0f5019df417f550f7490b99d91c52b676823d", "members": [ "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db|customer-managed-key", "module.retail_app_ecs.aws_secretsmanager_secret.catalog_db|secret-value" ] }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:2073dd961a032b84b2d9831d3f75f110a2575f042a5ea8c79798030c3da3245d", "kb_dependencies_sha256": "sha256:d5232f8c08470d7e2cf4d3f67d0a00b792688bf01cef4afeff71224246f0836f", "members": [ "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch|tc-secretsmanager-secret-name" ] }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:ae17628c8cbe0ab8697ae4bb2880130aeee40989541c8f0376736190f705f513", "kb_dependencies_sha256": "sha256:78742954fe6dab86c51d83509ed0f5019df417f550f7490b99d91c52b676823d", "members": [ "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch|customer-managed-key", "module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch|secret-value" ] }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:5fe5a2647141b1c84f8d6ebec8419e93f5cdd3bf7608a08434c32b8983acd76f", "kb_dependencies_sha256": "sha256:d5232f8c08470d7e2cf4d3f67d0a00b792688bf01cef4afeff71224246f0836f", "members": [ "module.retail_app_ecs.aws_secretsmanager_secret.mq|tc-secretsmanager-secret-name" ] }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:3ae1d83437aa0047401e57a727c9c83c53c975e37cb2489aa208cb01e090a9e2", "kb_dependencies_sha256": "sha256:2cb4b0d96b051195c608023373e582242e4e572c53cb74b1e20d6dda98e3ac19", "members": [ "module.retail_app_ecs.aws_secretsmanager_secret.mq|secret-value" ] }, { "id": "DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:0e7d0853832152461beef7d325cf888b63bc96f93367ca9eaa967f2a0d8d046d", "kb_dependencies_sha256": "sha256:d5232f8c08470d7e2cf4d3f67d0a00b792688bf01cef4afeff71224246f0836f", "members": [ "module.retail_app_ecs.aws_secretsmanager_secret.orders_db|tc-secretsmanager-secret-name" ] }, { "id": "DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:d75d1a13db1394da7b51b43ba4b0a2e89b879d6a844416890877de4f2206469c", "kb_dependencies_sha256": "sha256:2cb4b0d96b051195c608023373e582242e4e572c53cb74b1e20d6dda98e3ac19", "members": [ "module.retail_app_ecs.aws_secretsmanager_secret.orders_db|secret-value" ] }, { "id": "DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:20e99159b8d629dc059056933c714a05c8d0553031578feda2e55da35374d1f9", "kb_dependencies_sha256": "sha256:d123567a803a2c8c7613313b73d5e4c1f379e350b836349b8483d3601048ce69", "members": [ "module.dependencies.aws_security_group.catalog_opensearch_sg|egress-restriction", "module.dependencies.aws_security_group.catalog_opensearch_sg|network-topology-boundary", "module.dependencies.aws_security_group.catalog_opensearch_sg|security-group-vpc-membership", "module.dependencies.aws_security_group.catalog_opensearch_sg|standalone-rule-not-generated", "module.dependencies.aws_security_group.catalog_opensearch_sg|standalone-rule-remote-not-resolved", "module.dependencies.aws_security_group.catalog_opensearch_sg|stateful" ] }, { "id": "DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:8c5aaa45532d67ee2d6bcb3a9534148642f01d37c523570686e3fd349d2dee8b", "kb_dependencies_sha256": "sha256:df7f82fa706407d358518a0ec2c5fb9e357107a7fe196fbbab5b9ee7685bcb0d", "members": [ "module.dependencies.aws_security_group.mq|egress-restriction", "module.dependencies.aws_security_group.mq|network-topology-boundary", "module.dependencies.aws_security_group.mq|security-group-vpc-membership", "module.dependencies.aws_security_group.mq|standalone-rule-not-generated", "module.dependencies.aws_security_group.mq|stateful" ] }, { "id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:ecc068fbe9a8c1df8ea476fa3e0bcf0744ec368b08040242f186cb86c54b706c", "kb_dependencies_sha256": "sha256:5118b33aa50437bb44220519f1d54b70c83925a6a3a5950128f72ff4d74601a8", "members": [ "module.dependencies.module.catalog_rds.aws_security_group.this|egress-restriction", "module.dependencies.module.catalog_rds.aws_security_group.this|network-topology-boundary", "module.dependencies.module.catalog_rds.aws_security_group.this|rule-ports", "module.dependencies.module.catalog_rds.aws_security_group.this|security-group-vpc-membership", "module.dependencies.module.catalog_rds.aws_security_group.this|standalone-rule-values", "module.dependencies.module.catalog_rds.aws_security_group.this|stateful" ] }, { "id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:e2caf76ce6b00a72a5bb989dce3f951588e583a80dba6f2f2d83fa3a24d39303", "kb_dependencies_sha256": "sha256:732bd1fbc54fc9a90a3d44575b2d5e05c3097f0c28b0a7064e46d510941bb10a", "members": [ "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|network-topology-boundary", "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|rule-ports", "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|security-group-vpc-membership", "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-empty-sources", "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-other-sources", "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-values", "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|stateful" ] }, { "id": "DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:c70ab8626c768f56f794aa0d2ead7d41c74347f2a6dcf8782ed4bd599a108b12", "kb_dependencies_sha256": "sha256:5118b33aa50437bb44220519f1d54b70c83925a6a3a5950128f72ff4d74601a8", "members": [ "module.dependencies.module.orders_rds.aws_security_group.this|egress-restriction", "module.dependencies.module.orders_rds.aws_security_group.this|network-topology-boundary", "module.dependencies.module.orders_rds.aws_security_group.this|rule-ports", "module.dependencies.module.orders_rds.aws_security_group.this|security-group-vpc-membership", "module.dependencies.module.orders_rds.aws_security_group.this|standalone-rule-values", "module.dependencies.module.orders_rds.aws_security_group.this|stateful" ] }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:8e08c65f886c3621d3760f297a9f0f9270020b298c499881ee4e87eabdfb2c10", "kb_dependencies_sha256": "sha256:a4363e133238bc96983902cad7b0fbafc8f1363c3d4e0ebd54c8325670ad3a45", "members": [ "module.retail_app_ecs.module.alb.aws_security_group.this|egress-restriction", "module.retail_app_ecs.module.alb.aws_security_group.this|network-topology-boundary", "module.retail_app_ecs.module.alb.aws_security_group.this|security-group-vpc-membership", "module.retail_app_ecs.module.alb.aws_security_group.this|stateful" ] }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:5eb9ea3019259ced92a0d178966ff7f78a63ab44e0f204fdcc70e4e9dbbbdef2", "kb_dependencies_sha256": "sha256:732bd1fbc54fc9a90a3d44575b2d5e05c3097f0c28b0a7064e46d510941bb10a", "members": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|network-topology-boundary", "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|rule-ports", "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|security-group-vpc-membership", "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-empty-sources", "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-other-sources", "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-values", "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|stateful" ] }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:d2ce6c8560f61656e20bb6b51a011c7b79ca81012b6e7dda9e01fb0de53751f3", "kb_dependencies_sha256": "sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624", "members": [ "module.retail_app_ecs.module.carts_service.aws_security_group.this|egress-rule-protocol", "module.retail_app_ecs.module.carts_service.aws_security_group.this|egress-sources", "module.retail_app_ecs.module.carts_service.aws_security_group.this|ingress-sources", "module.retail_app_ecs.module.carts_service.aws_security_group.this|network-topology-boundary", "module.retail_app_ecs.module.carts_service.aws_security_group.this|rule-ports", "module.retail_app_ecs.module.carts_service.aws_security_group.this|security-group-vpc-membership", "module.retail_app_ecs.module.carts_service.aws_security_group.this|stateful" ] }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:533d0003c31ab197546f7c4f8d22e3c3bf725e8b7395b5d3ea21b3278fdb62b3", "kb_dependencies_sha256": "sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624", "members": [ "module.retail_app_ecs.module.catalog_service.aws_security_group.this|egress-rule-protocol", "module.retail_app_ecs.module.catalog_service.aws_security_group.this|egress-sources", "module.retail_app_ecs.module.catalog_service.aws_security_group.this|ingress-sources", "module.retail_app_ecs.module.catalog_service.aws_security_group.this|network-topology-boundary", "module.retail_app_ecs.module.catalog_service.aws_security_group.this|rule-ports", "module.retail_app_ecs.module.catalog_service.aws_security_group.this|security-group-vpc-membership", "module.retail_app_ecs.module.catalog_service.aws_security_group.this|stateful" ] }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:9d37a2eef4e29a3cb7c4a4bac8afc4bf54d07043772e5a624d09c77aa3ddb8ae", "kb_dependencies_sha256": "sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624", "members": [ "module.retail_app_ecs.module.checkout_service.aws_security_group.this|egress-rule-protocol", "module.retail_app_ecs.module.checkout_service.aws_security_group.this|egress-sources", "module.retail_app_ecs.module.checkout_service.aws_security_group.this|ingress-sources", "module.retail_app_ecs.module.checkout_service.aws_security_group.this|network-topology-boundary", "module.retail_app_ecs.module.checkout_service.aws_security_group.this|rule-ports", "module.retail_app_ecs.module.checkout_service.aws_security_group.this|security-group-vpc-membership", "module.retail_app_ecs.module.checkout_service.aws_security_group.this|stateful" ] }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:6761ee5382c2046f852e12938f4868f00aa72c16f7060930ffb775b9e048cb7e", "kb_dependencies_sha256": "sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624", "members": [ "module.retail_app_ecs.module.orders_service.aws_security_group.this|egress-rule-protocol", "module.retail_app_ecs.module.orders_service.aws_security_group.this|egress-sources", "module.retail_app_ecs.module.orders_service.aws_security_group.this|ingress-sources", "module.retail_app_ecs.module.orders_service.aws_security_group.this|network-topology-boundary", "module.retail_app_ecs.module.orders_service.aws_security_group.this|rule-ports", "module.retail_app_ecs.module.orders_service.aws_security_group.this|security-group-vpc-membership", "module.retail_app_ecs.module.orders_service.aws_security_group.this|stateful" ] }, { "id": "DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:d3db27e38c1fef4dfc310642c956f0cd27d824826e599bedf54475accbc6fe8c", "kb_dependencies_sha256": "sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624", "members": [ "module.retail_app_ecs.module.ui_service.aws_security_group.this|egress-rule-protocol", "module.retail_app_ecs.module.ui_service.aws_security_group.this|egress-sources", "module.retail_app_ecs.module.ui_service.aws_security_group.this|ingress-sources", "module.retail_app_ecs.module.ui_service.aws_security_group.this|network-topology-boundary", "module.retail_app_ecs.module.ui_service.aws_security_group.this|rule-ports", "module.retail_app_ecs.module.ui_service.aws_security_group.this|security-group-vpc-membership", "module.retail_app_ecs.module.ui_service.aws_security_group.this|stateful" ] }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:b1a497b9caa9da516a8ceb6a9547cf01be0e17d4e1b868091441dfc57a5ebc5c", "kb_dependencies_sha256": "sha256:97a0cc39677d5688e69a422dadb5017babb8a52cbe2ba1d6f5678a3e8c1c106e", "members": [ "module.vpc.module.vpc.aws_subnet.private|network-topology-boundary", "module.vpc.module.vpc.aws_subnet.private|prefix", "module.vpc.module.vpc.aws_subnet.private|private-egress-ipv4", "module.vpc.module.vpc.aws_subnet.private|subnet-vpc-membership" ] }, { "id": "DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:5f69f9a245d1ee7220cd5f7ae8dd7d6c63754281e22d38e57ece0dd324c9f7ca", "kb_dependencies_sha256": "sha256:b7c227d12f16960b694c76edaebeaa4eb6e1c2ce904c0f48e83f794a07fe3138", "members": [ "module.vpc.module.vpc.aws_subnet.private|availability-zone" ] }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:755f2761ac8b2e8f203b7be58efc5948a0633f72c4f5eadcad7fafd1ed820427", "kb_dependencies_sha256": "sha256:0c657c51ac1ed6771de561cec8183d19d149beb1179624fa61bcba2e95fb1db2", "members": [ "module.vpc.module.vpc.aws_subnet.public|effective-route-table", "module.vpc.module.vpc.aws_subnet.public|network-topology-boundary", "module.vpc.module.vpc.aws_subnet.public|prefix", "module.vpc.module.vpc.aws_subnet.public|private-egress-ipv4", "module.vpc.module.vpc.aws_subnet.public|subnet-vpc-membership" ] }, { "id": "DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:011643d2054f5f8478b444cf7895470f87a6d43d3f75c6ef3ff169fcdffdbdc3", "kb_dependencies_sha256": "sha256:b7c227d12f16960b694c76edaebeaa4eb6e1c2ce904c0f48e83f794a07fe3138", "members": [ "module.vpc.module.vpc.aws_subnet.public|availability-zone" ] }, { "id": "DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:4865af5a8e50259aa89eda3cb3004ce9ea97b5c15f0b1eca3b8d2b5c3f3514dd", "kb_dependencies_sha256": "sha256:b25af41cfbf903a0a38114116600fd7b6a404dd41e3651b6374d9b17e055b358", "members": [ "module.vpc.module.vpc.aws_vpc.this|default-nacl-rules", "module.vpc.module.vpc.aws_vpc.this|default-route-table", "module.vpc.module.vpc.aws_vpc.this|default-security-group-omitted-direction", "module.vpc.module.vpc.aws_vpc.this|main-table-set", "module.vpc.module.vpc.aws_vpc.this|network-topology-boundary" ] }, { "id": "DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:922a8c15b2b7499818c932ef55606b1e59f94f004ed39d782da13bce247b427c", "kb_dependencies_sha256": "sha256:cf773f243b88c0f4a074eff319871c3bb5787549b954a01a750246bcb33248c9", "members": [ "module.vpc.module.vpc.aws_vpc.this|dns-settings" ] }, { "id": "DEC-OPS-STACKITLOGS-ACTION-ARCHIVE-FLOW", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:bb64988972ed356df4aa14fc8e54b8401f2f06a46c9738974e9ce41147d7a9f6", "kb_dependencies_sha256": "sha256:d0c401dfda1e6d6567b70698edf5199e12079a6a9e38903447cf4935fed73c0c", "members": [ "stackitlogs:archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" ] }, { "id": "DEC-OPS-STACKITLOGS-ACTION-LABEL-CONVENTION", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:b58c0c06f680feba6220276e5fbad92f2c72b3b306439aa1b3976d3534797a14", "kb_dependencies_sha256": "sha256:38945168b2f2937f0a3aa90cbabea8d4da46e1be8e809d7ead7bbb6d8d5c595b", "members": [ "stackitlogs:label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" ] }, { "id": "DEC-OPS-STACKITLOGS-ACTION-TARGET-PRECONDITION", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:869fcb456492cde1234d12ef703bdb950ac8fd8e22799b1525a5563d29e506d0", "kb_dependencies_sha256": "sha256:78614094fd30d57756cdc7e437d195104e62ff218fd21a5e386a86d5a8ca8f41", "members": [ "stackitlogs:token:stackit_logs_instance.logs_retention_180d" ] }, { "id": "DEC-SEC-STACKITSG-ACTION-INCOMPLETE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:246f8bd919be5928fd53549dda1b5936212a68d1c144c86e55d5ed6b3e165741", "kb_dependencies_sha256": "sha256:82b7420c25df2b3e3dce07530fedb0c73f975b628559ac3addd227886f46cbeb", "members": [ "awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules", "awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules" ] }, { "id": "DEC-SEC-STACKITSG-ACTION-UNPLACED", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:c30c890a1799d91f5c3dd6213a6e7ae3d8c381d635b1bb48ea9a45e4efebf255", "kb_dependencies_sha256": "sha256:1e0b3d10d12c2152345db3e5a14df278ba329f473967455f9158fa0eb219684a", "members": [ "awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]", "awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]" ] }, { "id": "DEC-NET-STACKITROUTE-STATEMENT-NOT-DRAFTED", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:650b81a7db5184350b172778d82ba46d11cd6e33c14f6a6e897d1c2e161a6fdb", "kb_dependencies_sha256": "sha256:4d101cce382446307a7bc4915ae3b5bdd3448296b22e9c0fe9e3e5508a3d60e0", "members": [ "stackitroute:statement:module.vpc.module.vpc.aws_route_table.private", "stackitroute:statement:module.vpc.module.vpc.aws_route_table.public" ] }, { "id": "DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:8ae94bd60884e4f89887095201ccae2cb675b6de0ca40c6d52a7a14653c82f28", "kb_dependencies_sha256": "sha256:83a8f6eef89167b4a870555fd2ffcf930e8e1486e7893eb941efdfcf7f52cb49", "members": [ "stackitsa:statement:module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "stackitsa:statement:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "stackitsa:statement:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "stackitsa:statement:module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "stackitsa:statement:module.retail_app_ecs.module.ui_service.aws_ecs_service.this" ] } ] }