# Trace of `terraform/messaging.tf` — 2 blocks

> PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.

Run `f6267c3f-2848-4aa5-89df-5fee8b15b3b9` · source digest `sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70`

The draft keeps a one-paragraph comment above each block: where it comes from, why its values are what they are, what is not carried and which decision is open. Each section of this file is the whole comment the generators wrote for one block, unabridged and in the order they wrote it: the rule and the knowledge-base stamp, the references with their digests, the evidence of each chosen value, the reason of each attribute that is not written and the caveats of the checks. The `# trace:` line above a block names its section by the anchor, which is the trace id.

<a id="TR-9aa24821e695"></a>

## Trace TR-9aa24821e695 — stackit_rabbitmq_credential.dependencies_mq

| | |
|---|---|
| Block | `stackit_rabbitmq_credential.dependencies_mq` in `terraform/messaging.tf` |
| Source units | `module.dependencies.aws_mq_broker.mq` |
| Comment | 6 lines as the generators wrote it, 7 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.dependencies.aws_mq_broker.mq.
the credential of the clients of stackit_rabbitmq_instance.dependencies_mq: the instance has no host, port, user or password attribute (pinned provider).
host, hosts, port, username, password, uri, uris, management, http_api_uri and http_api_uris are computed attributes of this credential (password and uri are sensitive); the provider schema describes none of them.
A RabbitMQ credential is a user of the whole instance: the broker users of the source (and their tags and permissions) are not copied, and the vhosts, queues and exchanges of the broker are created in the instance outside Terraform.
STACKIT generates the password; the sensitive output dependencies_mq_rabbitmq_credential_password exposes it (a reference to this resource, never a value).
Read it after the apply and give it to every client before the cutover; the state holds it in plain text and the draft creates no secret for it.
````

<a id="TR-6212f52df434"></a>

## Trace TR-6212f52df434 — stackit_rabbitmq_instance.dependencies_mq

| | |
|---|---|
| Block | `stackit_rabbitmq_instance.dependencies_mq` in `terraform/messaging.tf` |
| Source units | `module.dependencies.aws_mq_broker.mq` |
| Comment | 18 lines as the generators wrote it, 14 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.dependencies.aws_mq_broker.mq (../../lib/dependencies/mq.tf:12) — RECONFIGURE / MEDIUM
rule aws.mq_broker/rabbitmq · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required
NOT CARRIED (module.dependencies.aws_mq_broker.mq): user — the broker users are not copied: the draft writes one stackit_rabbitmq_credential for the instance, a user whose username and password STACKIT generates (both computed, pinned provider) — clients get new credentials.
NOT CARRIED (module.dependencies.aws_mq_broker.mq): apply_immediately = true — when a change reaches the broker is not carried: Amazon MQ applies a change in the next maintenance window unless apply_immediately applies it at once, with a brief downtime as the broker reboots (aws provider 6.66.0, aws_mq_broker), while stackit_rabbitmq_instance has no attribute for it (pinned provider; the RabbitMQ API 2.3.0 has no deferral setting either) — this configuration cannot choose between the two; the documentation read does not say when STACKIT applies a change to an instance or whether it restarts the broker, so agree the change window with the operator before the cutover.
NOT CARRIED (module.dependencies.aws_mq_broker.mq): auto_minor_version_upgrade = true — the minor-version upgrade policy is not carried: Amazon MQ upgrades the broker to new minor versions as it releases them when auto_minor_version_upgrade is true (aws provider 6.66.0, aws_mq_broker), while stackit_rabbitmq_instance takes one explicit version and has no upgrade policy (pinned provider; the RabbitMQ API 2.3.0 has none) — the draft pins the version its variable names and nothing in this configuration upgrades it later; whether STACKIT patches an instance on its own is not stated in the documentation read, so keeping the instance current is a task the operator plans.
DEFAULT plan_name: var.dependencies_mq_plan_name defaults to stackit-rabbitmq-8.16.50-replica (broker instance type mq.m5.large has 2 vCPU and 8 GiB (AWS price list, mq_broker_sizes.json), and the broker is a single instance: the smallest replica (three nodes, high availability) RabbitMQ plan of the eu01 catalogue (2026-10-18) that holds 2 vCPU and 8 GiB (8.59 GB at 10^9 bytes per GB) of memory (the plan table gives its RAM as "GB" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)): 8 vCPU / 16 GB RAM / 50 GB disk per node; the disk is not a figure of the source, so the smallest disk of that size is taken and the disk is open; no single-node plan of that size exists, so this replica plan adds the replicas the source does not have, and their price; this plan is larger than the one the other reading gives: reading the table's GB as a GiB, stackit-rabbitmq-4.8.50-single (4 vCPU / 8 GB RAM / 50 GB disk per node) would hold the source, and the draft is priced on the larger plan; if the table's GB is a GiB, answer choose-the-size and set stackit-rabbitmq-4.8.50-single). A proposal the customer confirms or changes; it does not close the sizing decision.
The decision DEC-GEN-CONVERT-SIZE-FROM-SOURCE (alias `convert:module.dependencies.aws_mq_broker.mq:dependencies_mq_plan_name:SIZE_FROM_SOURCE`) stays open: check it, and answer choose-the-size in decisions.yaml if the plan is wrong; the next run then writes no default.
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
WARNING engine-version-upgrade: Engine version UPGRADE: the source runs RabbitMQ 3.13 (engine_version); STACKIT RabbitMQ in eu01 offers 4.1 (service catalogue of eu01, read 2026-10-18), none of them the source's version.
DEFAULT: reachable on STACKIT from the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients of this service, and from no other address; change the list with var.dependencies_mq_allowed_cidrs or answer the decision DEC-GEN-CONVERT-EXPOSURE-WIDENED (alias `convert:module.dependencies.aws_mq_broker.mq:exposure:EXPOSURE_WIDENED`) in decisions.yaml — check that these are all its clients.
The clients are module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the members of module.retail_app_ecs.module.orders_service.aws_security_group.this (named by module.dependencies.aws_security_group_rule.mq[0]), the only clients the source admitted; the egress addresses are those of every pod of stackit_ske_cluster.retail_app_ecs_cluster, so the list is wider than the source's by the other workloads of the cluster — check that is acceptable; the rule names its group through a module input or a list the scan does not pin to one element, so check that no client is missing.
stackit_rabbitmq_instance has no network attribute (pinned provider; parameters.sgw_acl is its only access control), so any placement in a drafted network is not carried; the RabbitMQ instance is on its own endpoint outside the project network, and the source module.dependencies.aws_mq_broker.mq is reached only from inside its VPC (the broker states publicly_accessible = false: it is reached from inside the VPC that hosts its subnets).
SECURITY_OBSERVATION Single-node data store of module.dependencies.aws_mq_broker.mq, deployment_mode (non-blocking): The source broker module.dependencies.aws_mq_broker.mq runs as SINGLE_INSTANCE: one broker in one availability zone, no standby. Source: ../../lib/dependencies/mq.tf:12. In the draft (NOT_VERIFIED): the redundancy of the drafted stackit_rabbitmq_instance is the plan the draft leaves to a person (a variable), and this build does not compare it with the source's single instance. Hardening, if wanted (a note, not a change; owner Security Architect): choose a target plan with more than one node, or accept the single instance knowingly.
````