# Trace of `terraform/identity.tf` — 20 blocks

> PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.

Run `f6267c3f-2848-4aa5-89df-5fee8b15b3b9` · source digest `sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70`

The draft keeps a one-paragraph comment above each block: where it comes from, why its values are what they are, what is not carried and which decision is open. Each section of this file is the whole comment the generators wrote for one block, unabridged and in the order they wrote it: the rule and the knowledge-base stamp, the references with their digests, the evidence of each chosen value, the reason of each attribute that is not written and the caveats of the checks. The `# trace:` line above a block names its section by the anchor, which is the trace id.

<a id="TR-58f6779c70bf"></a>

## Trace TR-58f6779c70bf — stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role

| | |
|---|---|
| Block | `stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role` |
| Comment | 3 lines as the generators wrote it, 4 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
Role assignments of service account retail_app_ecs_carts_service_task_execution_role (from the policies of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role); provider experiment "iam".
AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_carts_service_task_execution_role_project_roles, chosen by the architect.
TARGET MATURITY: EXPERIMENTAL — stackit_authorization_project_role_assignment is part of the experimental feature "iam" of the pinned STACKIT provider: "likely going to undergo significant changes or be removed in the future" (enabled in terraform.tf experiments).
````

<a id="TR-74ede57c41f1"></a>

## Trace TR-74ede57c41f1 — stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role

| | |
|---|---|
| Block | `stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role` |
| Comment | 3 lines as the generators wrote it, 4 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
Role assignments of service account retail_app_ecs_carts_service_task_role (from the policies of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role); provider experiment "iam".
AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_carts_service_task_role_project_roles, chosen by the architect.
TARGET MATURITY: EXPERIMENTAL — stackit_authorization_project_role_assignment is part of the experimental feature "iam" of the pinned STACKIT provider: "likely going to undergo significant changes or be removed in the future" (enabled in terraform.tf experiments).
````

<a id="TR-2eebb342bc5c"></a>

## Trace TR-2eebb342bc5c — stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role

| | |
|---|---|
| Block | `stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role` |
| Comment | 3 lines as the generators wrote it, 4 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
Role assignments of service account retail_app_ecs_catalog_service_task_execution_role (from the policies of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role); provider experiment "iam".
AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_catalog_service_task_execution_role_project_roles, chosen by the architect.
TARGET MATURITY: EXPERIMENTAL — stackit_authorization_project_role_assignment is part of the experimental feature "iam" of the pinned STACKIT provider: "likely going to undergo significant changes or be removed in the future" (enabled in terraform.tf experiments).
````

<a id="TR-cf63149db4be"></a>

## Trace TR-cf63149db4be — stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role

| | |
|---|---|
| Block | `stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role` |
| Comment | 3 lines as the generators wrote it, 4 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
Role assignments of service account retail_app_ecs_catalog_service_task_role (from the policies of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role); provider experiment "iam".
AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_catalog_service_task_role_project_roles, chosen by the architect.
TARGET MATURITY: EXPERIMENTAL — stackit_authorization_project_role_assignment is part of the experimental feature "iam" of the pinned STACKIT provider: "likely going to undergo significant changes or be removed in the future" (enabled in terraform.tf experiments).
````

<a id="TR-b9a8861fdbd3"></a>

## Trace TR-b9a8861fdbd3 — stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role

| | |
|---|---|
| Block | `stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role` |
| Comment | 3 lines as the generators wrote it, 4 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
Role assignments of service account retail_app_ecs_checkout_service_task_execution_role (from the policies of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role); provider experiment "iam".
AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_checkout_service_task_execution_role_project_roles, chosen by the architect.
TARGET MATURITY: EXPERIMENTAL — stackit_authorization_project_role_assignment is part of the experimental feature "iam" of the pinned STACKIT provider: "likely going to undergo significant changes or be removed in the future" (enabled in terraform.tf experiments).
````

<a id="TR-8e7b4456f29a"></a>

## Trace TR-8e7b4456f29a — stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role

| | |
|---|---|
| Block | `stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role` |
| Comment | 3 lines as the generators wrote it, 4 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
Role assignments of service account retail_app_ecs_checkout_service_task_role (from the policies of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role); provider experiment "iam".
AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_checkout_service_task_role_project_roles, chosen by the architect.
TARGET MATURITY: EXPERIMENTAL — stackit_authorization_project_role_assignment is part of the experimental feature "iam" of the pinned STACKIT provider: "likely going to undergo significant changes or be removed in the future" (enabled in terraform.tf experiments).
````

<a id="TR-a77098085913"></a>

## Trace TR-a77098085913 — stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role

| | |
|---|---|
| Block | `stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role` |
| Comment | 3 lines as the generators wrote it, 4 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
Role assignments of service account retail_app_ecs_orders_service_task_execution_role (from the policies of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role); provider experiment "iam".
AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_orders_service_task_execution_role_project_roles, chosen by the architect.
TARGET MATURITY: EXPERIMENTAL — stackit_authorization_project_role_assignment is part of the experimental feature "iam" of the pinned STACKIT provider: "likely going to undergo significant changes or be removed in the future" (enabled in terraform.tf experiments).
````

<a id="TR-cf173263597f"></a>

## Trace TR-cf173263597f — stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role

| | |
|---|---|
| Block | `stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.orders_service.aws_iam_role.task_role` |
| Comment | 3 lines as the generators wrote it, 4 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
Role assignments of service account retail_app_ecs_orders_service_task_role (from the policies of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role); provider experiment "iam".
AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_orders_service_task_role_project_roles, chosen by the architect.
TARGET MATURITY: EXPERIMENTAL — stackit_authorization_project_role_assignment is part of the experimental feature "iam" of the pinned STACKIT provider: "likely going to undergo significant changes or be removed in the future" (enabled in terraform.tf experiments).
````

<a id="TR-be8af2d2983d"></a>

## Trace TR-be8af2d2983d — stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role

| | |
|---|---|
| Block | `stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role` |
| Comment | 3 lines as the generators wrote it, 4 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
Role assignments of service account retail_app_ecs_ui_service_task_execution_role (from the policies of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role); provider experiment "iam".
AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_ui_service_task_execution_role_project_roles, chosen by the architect.
TARGET MATURITY: EXPERIMENTAL — stackit_authorization_project_role_assignment is part of the experimental feature "iam" of the pinned STACKIT provider: "likely going to undergo significant changes or be removed in the future" (enabled in terraform.tf experiments).
````

<a id="TR-759ef9228645"></a>

## Trace TR-759ef9228645 — stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role

| | |
|---|---|
| Block | `stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.ui_service.aws_iam_role.task_role` |
| Comment | 3 lines as the generators wrote it, 4 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
Role assignments of service account retail_app_ecs_ui_service_task_role (from the policies of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role); provider experiment "iam".
AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_ui_service_task_role_project_roles, chosen by the architect.
TARGET MATURITY: EXPERIMENTAL — stackit_authorization_project_role_assignment is part of the experimental feature "iam" of the pinned STACKIT provider: "likely going to undergo significant changes or be removed in the future" (enabled in terraform.tf experiments).
````

<a id="TR-935427f3024d"></a>

## Trace TR-935427f3024d — stackit_service_account.retail_app_ecs_carts_service_task_execution_role

| | |
|---|---|
| Block | `stackit_service_account.retail_app_ecs_carts_service_task_execution_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role` |
| Comment | 6 lines as the generators wrote it, 6 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (../../lib/ecs/service/iam.tf:14) — RECONFIGURE / MEDIUM
rule aws.iam_role/role-workload-execution · KB 0.384.0 · target maturity EXPERIMENTAL · lifecycle active · mapping maturity beta · evidence internal · review required
TODO: the name of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role is "retail-app-ecs-carts-service-task-execution-role": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is refused), so the draft names the account "retail-app-ec-e66809", cut and told apart by a suffix of the SHA-256 of the source address — set the name you want.
The permissions of the source policies become the project role assignments below (provider experiment "iam").
NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
````

<a id="TR-eb88a52a7e37"></a>

## Trace TR-eb88a52a7e37 — stackit_service_account.retail_app_ecs_carts_service_task_role

| | |
|---|---|
| Block | `stackit_service_account.retail_app_ecs_carts_service_task_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role` |
| Comment | 7 lines as the generators wrote it, 7 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (../../lib/ecs/service/iam.tf:31) — RECONFIGURE / LOW
rule aws.iam_role/role-workload-execution · KB 0.384.0 · target maturity EXPERIMENTAL · lifecycle active · mapping maturity beta · evidence internal · review required
TODO: the name of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role is "retail-app-ecs-carts-service-task-role": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is refused), so the draft names the account "retail-app-ec-d67986", cut and told apart by a suffix of the SHA-256 of the source address — set the name you want.
The permissions of the source policies become the project role assignments below (provider experiment "iam").
NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
WARNING linked-dependency-unread: This unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table), whose own decision the target does not carry (it is REDESIGN), and the semantic contract of aws_iam_role does not read aws_dynamodb_table, so what the reference becomes is not assessed.
````

<a id="TR-089026082d6f"></a>

## Trace TR-089026082d6f — stackit_service_account.retail_app_ecs_catalog_service_task_execution_role

| | |
|---|---|
| Block | `stackit_service_account.retail_app_ecs_catalog_service_task_execution_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role` |
| Comment | 8 lines as the generators wrote it, 8 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (../../lib/ecs/service/iam.tf:14) — RECONFIGURE / LOW
rule aws.iam_role/role-workload-execution · KB 0.384.0 · target maturity EXPERIMENTAL · lifecycle active · mapping maturity beta · evidence internal · review required
TODO: the name of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role is "retail-app-ecs-catalog-service-task-execution-role": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is refused), so the draft names the account "retail-app-ec-bf495d", cut and told apart by a suffix of the SHA-256 of the source address — set the name you want.
The permissions of the source policies become the project role assignments below (provider experiment "iam").
NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
WARNING linked-dependency-unread: This unit names module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it against a shared instance or a note) and the draft does not create it), and the semantic contract of aws_iam_role does not read aws_secretsmanager_secret, so what the reference becomes is not assessed.
WARNING linked-dependency-unread: This unit names module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it against a shared instance or a note) and the draft does not create it), and the semantic contract of aws_iam_role does not read aws_secretsmanager_secret, so what the reference becomes is not assessed.
````

<a id="TR-e48f32c8ead8"></a>

## Trace TR-e48f32c8ead8 — stackit_service_account.retail_app_ecs_catalog_service_task_role

| | |
|---|---|
| Block | `stackit_service_account.retail_app_ecs_catalog_service_task_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role` |
| Comment | 6 lines as the generators wrote it, 6 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (../../lib/ecs/service/iam.tf:31) — RECONFIGURE / MEDIUM
rule aws.iam_role/role-workload-execution · KB 0.384.0 · target maturity EXPERIMENTAL · lifecycle active · mapping maturity beta · evidence internal · review required
TODO: the name of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role is "retail-app-ecs-catalog-service-task-role": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is refused), so the draft names the account "retail-app-ec-940be8", cut and told apart by a suffix of the SHA-256 of the source address — set the name you want.
The permissions of the source policies become the project role assignments below (provider experiment "iam").
NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
````

<a id="TR-101825075cda"></a>

## Trace TR-101825075cda — stackit_service_account.retail_app_ecs_checkout_service_task_execution_role

| | |
|---|---|
| Block | `stackit_service_account.retail_app_ecs_checkout_service_task_execution_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role` |
| Comment | 6 lines as the generators wrote it, 6 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (../../lib/ecs/service/iam.tf:14) — RECONFIGURE / MEDIUM
rule aws.iam_role/role-workload-execution · KB 0.384.0 · target maturity EXPERIMENTAL · lifecycle active · mapping maturity beta · evidence internal · review required
TODO: the name of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role is "retail-app-ecs-checkout-service-task-execution-role": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is refused), so the draft names the account "retail-app-ec-7b153c", cut and told apart by a suffix of the SHA-256 of the source address — set the name you want.
The permissions of the source policies become the project role assignments below (provider experiment "iam").
NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
````

<a id="TR-822b8a98ff0d"></a>

## Trace TR-822b8a98ff0d — stackit_service_account.retail_app_ecs_checkout_service_task_role

| | |
|---|---|
| Block | `stackit_service_account.retail_app_ecs_checkout_service_task_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role` |
| Comment | 7 lines as the generators wrote it, 7 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (../../lib/ecs/service/iam.tf:31) — RECONFIGURE / LOW
rule aws.iam_role/role-workload-execution · KB 0.384.0 · target maturity EXPERIMENTAL · lifecycle active · mapping maturity beta · evidence internal · review required
TODO: the name of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role is "retail-app-ecs-checkout-service-task-role": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is refused), so the draft names the account "retail-app-ec-bd3876", cut and told apart by a suffix of the SHA-256 of the source address — set the name you want.
The permissions of the source policies become the project role assignments below (provider experiment "iam").
NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
WARNING linked-dependency-unread: This unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table), whose own decision the target does not carry (it is REDESIGN), and the semantic contract of aws_iam_role does not read aws_dynamodb_table, so what the reference becomes is not assessed.
````

<a id="TR-0054e8101f59"></a>

## Trace TR-0054e8101f59 — stackit_service_account.retail_app_ecs_orders_service_task_execution_role

| | |
|---|---|
| Block | `stackit_service_account.retail_app_ecs_orders_service_task_execution_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role` |
| Comment | 8 lines as the generators wrote it, 8 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (../../lib/ecs/service/iam.tf:14) — RECONFIGURE / LOW
rule aws.iam_role/role-workload-execution · KB 0.384.0 · target maturity EXPERIMENTAL · lifecycle active · mapping maturity beta · evidence internal · review required
TODO: the name of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role is "retail-app-ecs-orders-service-task-execution-role": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is refused), so the draft names the account "retail-app-ec-a8100a", cut and told apart by a suffix of the SHA-256 of the source address — set the name you want.
The permissions of the source policies become the project role assignments below (provider experiment "iam").
NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
WARNING linked-dependency-unread: This unit names module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it against a shared instance or a note) and the draft does not create it), and the semantic contract of aws_iam_role does not read aws_secretsmanager_secret, so what the reference becomes is not assessed.
WARNING linked-dependency-unread: This unit names module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it against a shared instance or a note) and the draft does not create it), and the semantic contract of aws_iam_role does not read aws_secretsmanager_secret, so what the reference becomes is not assessed.
````

<a id="TR-60af0bd02bd2"></a>

## Trace TR-60af0bd02bd2 — stackit_service_account.retail_app_ecs_orders_service_task_role

| | |
|---|---|
| Block | `stackit_service_account.retail_app_ecs_orders_service_task_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.orders_service.aws_iam_role.task_role` |
| Comment | 6 lines as the generators wrote it, 6 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (../../lib/ecs/service/iam.tf:31) — RECONFIGURE / MEDIUM
rule aws.iam_role/role-workload-execution · KB 0.384.0 · target maturity EXPERIMENTAL · lifecycle active · mapping maturity beta · evidence internal · review required
TODO: the name of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role is "retail-app-ecs-orders-service-task-role": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is refused), so the draft names the account "retail-app-ec-561956", cut and told apart by a suffix of the SHA-256 of the source address — set the name you want.
The permissions of the source policies become the project role assignments below (provider experiment "iam").
NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
````

<a id="TR-02dcd9e3db54"></a>

## Trace TR-02dcd9e3db54 — stackit_service_account.retail_app_ecs_ui_service_task_execution_role

| | |
|---|---|
| Block | `stackit_service_account.retail_app_ecs_ui_service_task_execution_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role` |
| Comment | 6 lines as the generators wrote it, 6 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (../../lib/ecs/service/iam.tf:14) — RECONFIGURE / MEDIUM
rule aws.iam_role/role-workload-execution · KB 0.384.0 · target maturity EXPERIMENTAL · lifecycle active · mapping maturity beta · evidence internal · review required
TODO: the name of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role is "retail-app-ecs-ui-service-task-execution-role": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is refused), so the draft names the account "retail-app-ec-f7f0f9", cut and told apart by a suffix of the SHA-256 of the source address — set the name you want.
The permissions of the source policies become the project role assignments below (provider experiment "iam").
NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
````

<a id="TR-14c0a005bdbf"></a>

## Trace TR-14c0a005bdbf — stackit_service_account.retail_app_ecs_ui_service_task_role

| | |
|---|---|
| Block | `stackit_service_account.retail_app_ecs_ui_service_task_role` in `terraform/identity.tf` |
| Source units | `module.retail_app_ecs.module.ui_service.aws_iam_role.task_role` |
| Comment | 6 lines as the generators wrote it, 6 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (../../lib/ecs/service/iam.tf:31) — RECONFIGURE / MEDIUM
rule aws.iam_role/role-workload-execution · KB 0.384.0 · target maturity EXPERIMENTAL · lifecycle active · mapping maturity beta · evidence internal · review required
TODO: the name of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role is "retail-app-ecs-ui-service-task-role": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is refused), so the draft names the account "retail-app-ec-c5eb68", cut and told apart by a suffix of the SHA-256 of the source address — set the name you want.
The permissions of the source policies become the project role assignments below (provider experiment "iam").
NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
````