# Trace of `terraform/network.tf` — 2 blocks

> PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.

Run `f6267c3f-2848-4aa5-89df-5fee8b15b3b9` · source digest `sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70`

The draft keeps a one-paragraph comment above each block: where it comes from, why its values are what they are, what is not carried and which decision is open. Each section of this file is the whole comment the generators wrote for one block, unabridged and in the order they wrote it: the rule and the knowledge-base stamp, the references with their digests, the evidence of each chosen value, the reason of each attribute that is not written and the caveats of the checks. The `# trace:` line above a block names its section by the anchor, which is the trace id.

<a id="TR-d39d5b78739a"></a>

## Trace TR-d39d5b78739a — stackit_network.vpc_vpc_private

| | |
|---|---|
| Block | `stackit_network.vpc_vpc_private` in `terraform/network.tf` |
| Source units | `module.vpc.module.vpc.aws_subnet.private` |
| Comment | 15 lines as the generators wrote it, 14 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.vpc.module.vpc.aws_subnet.private (.terraform/modules/vpc.vpc/main.tf:267) — RECONFIGURE / MEDIUM
rule aws.subnet/subnet · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required
DNS: the source uses the AWS VPC resolver, which answers internal EC2 host names (module.vpc.module.vpc.aws_vpc.this enable_dns_hostnames = true); ipv4_nameservers = var.default_ipv4_nameservers resolves public names only.
Private DNS parity not established: STACKIT documents no private DNS zone or internal name resolution (STACKIT DNS serves public zones only; the DNS Resolver product is in beta); names only the VPC resolver answers need a DNS server of your own.
TODO: PRIVATE_EGRESS_EQUIVALENCE_UNPROVEN — whether the source gives this subnet an IPv4 route to the internet is not proven (table-not-proven (selects-collapsed)); the network drafted here keeps STACKIT's default gateway with its outbound source NAT, and the draft leaves its routing and gateway settings at their platform defaults (the finding subnet-egress-ipv4-unproven names what would decide it).
Behind the network ACL module.vpc.module.vpc.aws_default_network_acl.this (no STACKIT resource, so nothing here refuses what it refuses): not every rule of it could be read, so a deny rule may be among them (see module.vpc.module.vpc.aws_default_network_acl.this).
NOT CARRIED (module.vpc.module.vpc.aws_subnet.private): availability_zone, availability_zone_id — stackit_network has no availability zone (pinned provider): the network serves the region; servers and volumes choose their zone.
NOT CARRIED (module.vpc.module.vpc.aws_subnet.private): vpc_id — the source VPC is not generated: the network is created in the project (stackit_network also takes a vpc_id of the experimental STACKIT VPC feature, pinned provider — not used by this draft).
NOT CARRIED (module.vpc.module.vpc.aws_subnet.private): tags — the tags are not visible statically (a variable without a value, a computed value, a module output or an expression the scan cannot evaluate): no label is written for them. Set the labels of the stackit_network yourself where they are still wanted (STACKIT IaaS API, Labels: keys and values of letters, digits, '-', '_' and '.').
WARNING topology-vpc-unproven: The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this subnet names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own).
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
WARNING subnet-egress-ipv4-unproven: PRIVATE_EGRESS_EQUIVALENCE_UNPROVEN (IPv4, not proven).
Drafted, consumers not placed: decision DEC-GEN-CONVERT-WORKLOAD-PLACEMENT (alias `convert:module.vpc.module.vpc.aws_subnet.private:network:WORKLOAD_PLACEMENT`). Nothing in the draft is placed in this network, although the source places module.dependencies.aws_mq_broker.mq, module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, module.dependencies.module.catalog_rds.aws_rds_cluster.this and 7 more in its subnet: decide where the workloads go (the step of this network waits for the decision); the drafted Kubernetes cluster stackit_ske_cluster.retail_app_ecs_cluster of these consumers sets no network.id; regenerate the draft rather than edit it.
TODO: how many instances module.vpc.module.vpc.aws_subnet.private creates is not visible statically (its count/for_each is not known): count is var.vpc_vpc_private_count — set it to the real number and check each instance's settings.
````

<a id="TR-ca04594a2ad9"></a>

## Trace TR-ca04594a2ad9 — stackit_network.vpc_vpc_public

| | |
|---|---|
| Block | `stackit_network.vpc_vpc_public` in `terraform/network.tf` |
| Source units | `module.vpc.module.vpc.aws_subnet.public` |
| Comment | 16 lines as the generators wrote it, 15 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.vpc.module.vpc.aws_subnet.public (.terraform/modules/vpc.vpc/main.tf:131) — RECONFIGURE / MEDIUM
rule aws.subnet/subnet · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required
DNS: the source uses the AWS VPC resolver, which answers internal EC2 host names (module.vpc.module.vpc.aws_vpc.this enable_dns_hostnames = true); ipv4_nameservers = var.default_ipv4_nameservers resolves public names only.
Private DNS parity not established: STACKIT documents no private DNS zone or internal name resolution (STACKIT DNS serves public zones only; the DNS Resolver product is in beta); names only the VPC resolver answers need a DNS server of your own.
TODO: PRIVATE_EGRESS_EQUIVALENCE_UNPROVEN — whether the source gives this subnet an IPv4 route to the internet is not proven (the route table association module.vpc.module.vpc.aws_route_table_association.public names the subnet module.vpc.module.vpc.aws_subnet.public but the scan cannot show that it names every instance of it (a value that is not exactly one reference to it, an index that picks some instances, a count or for_each that is not the subnet's own), so which table it follows is not decided here); the network drafted here keeps STACKIT's default gateway with its outbound source NAT, and the draft leaves its routing and gateway settings at their platform defaults (the finding subnet-egress-ipv4-unproven names what would decide it).
Behind the network ACL module.vpc.module.vpc.aws_default_network_acl.this (no STACKIT resource, so nothing here refuses what it refuses): not every rule of it could be read, so a deny rule may be among them (see module.vpc.module.vpc.aws_default_network_acl.this).
NOT CARRIED (module.vpc.module.vpc.aws_subnet.public): availability_zone, availability_zone_id — stackit_network has no availability zone (pinned provider): the network serves the region; servers and volumes choose their zone.
NOT CARRIED (module.vpc.module.vpc.aws_subnet.public): vpc_id — the source VPC is not generated: the network is created in the project (stackit_network also takes a vpc_id of the experimental STACKIT VPC feature, pinned provider — not used by this draft).
NOT CARRIED (module.vpc.module.vpc.aws_subnet.public): tags — the tags are not visible statically (a variable without a value, a computed value, a module output or an expression the scan cannot evaluate): no label is written for them. Set the labels of the stackit_network yourself where they are still wanted (STACKIT IaaS API, Labels: keys and values of letters, digits, '-', '_' and '.').
WARNING topology-vpc-unproven: The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this subnet names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own).
WARNING subnet-route-table-undecided: The scan cannot say which route table this subnet follows: a route table association may name it through a value the scan cannot resolve (a variable, a literal ID, a conditional, a value from a module call), an association names only some of its instances or repeats by a count or for_each that is not the subnet's own (aws_subnet.x[0].id for a counted subnet, fewer association instances than subnet instances), an association may create no instance (a count or for_each that a variable decides, count = var.on ? 1 : 0, whatever the variable's default: the subnet then follows the main route table), the VPC of the subnet or its main route table is not decided (count or for_each, two resources that set the main table, a main association and an aws_default_route_table on one VPC, a table or VPC outside the configuration).
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
WARNING subnet-egress-ipv4-unproven: PRIVATE_EGRESS_EQUIVALENCE_UNPROVEN (IPv4, not proven).
TODO: how many instances module.vpc.module.vpc.aws_subnet.public creates is not visible statically (its count/for_each is not known): count is var.vpc_vpc_public_count — set it to the real number and check each instance's settings.
````