# Trace of `terraform/observability.tf` — 1 blocks

> PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.

Run `f6267c3f-2848-4aa5-89df-5fee8b15b3b9` · source digest `sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70`

The draft keeps a one-paragraph comment above each block: where it comes from, why its values are what they are, what is not carried and which decision is open. Each section of this file is the whole comment the generators wrote for one block, unabridged and in the order they wrote it: the rule and the knowledge-base stamp, the references with their digests, the evidence of each chosen value, the reason of each attribute that is not written and the caveats of the checks. The `# trace:` line above a block names its section by the anchor, which is the trace id.

<a id="TR-c0888ccac0ab"></a>

## Trace TR-c0888ccac0ab — stackit_logs_instance.logs_retention_180d

| | |
|---|---|
| Block | `stackit_logs_instance.logs_retention_180d` in `terraform/observability.tf` |
| Source units | `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks` |
| Comment | 15 lines as the generators wrote it, 15 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
TODO: node[module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks].name: Choose a static label and send the name of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (and of its streams) from its log producers as the value of that label (the manual action below)
NOT CARRIED (module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks): node[module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks].retention_in_days — the source keeps its logs for ever (it states no period, or 0); a Logs instance keeps at most 180 days, so the logs of this source are kept for 180 days here and anything older has to be archived elsewhere (for example in Object Storage) if it must be kept [evidence: stackitcloud/stackit-api-specifications, services/logs/v1/logs.json:141-175; STACKIT provider schema 0.121.0 (resource_schemas.stackit_logs_instance.block.attributes) (knowledge-base evidence, not in this folder)]
TODO: Configure a cold-storage log flow for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: send a copy of its logs, in parallel to the Logs instance stackit_logs_instance.logs_retention_180d, to a long-term store (for example a separate Object Storage bucket) that keeps them for the retention beyond 180 days — the source keeps its logs for ever and a STACKIT Logs instance keeps at most 180 days (retention beyond 180 days is not supported by the managed service): the first 180 days are kept in the Logs instance, and the longer retention is an archive outside it, which STACKIT recommends as a cold-storage approach (a stream of the log data to a low-cost long-term store in parallel to Logs). The plan creates no archive store, configures no stream and sets no retention of the archive. The step exists only when the decision about the logs beyond 180 days chooses the archive; where the requirement is more than 180 days inside STACKIT Logs with no external archive, the archive is rejected and the migration cannot meet that requirement with STACKIT Logs alone (phase CUTOVER_PREREQUISITE, owner Platform Architect)
TODO: Choose a static label and send the name of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (and of its streams) from its log producers as the value of that label — STACKIT Logs has no log group or stream object that can hold a name, only labels the shipper sends (no-log-group-or-stream-object); the plan chooses no label key and reconfigures no producer (phase CUTOVER_PREREQUISITE, owner Platform Architect)
TODO: Before any log source writes to stackit_logs_instance.logs_retention_180d: create a write access token for the instance (stackit_logs_access_token with the permission write), set the access control list of the instance, and point the shipper at the instance's ingest_url (Loki API) or ingest_otlp_url (OpenTelemetry) — the plan generates no access token: the token is a credential written to the state, its lifetime (unset, it never expires) and its permissions are choices the source does not state, and one token belongs to one instance; what an instance with no ACL entry allows is not established, so the plan sets no ACL and states no default (phase CUTOVER_PREREQUISITE, owner Platform Architect)
TODO: decision DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS (alias `stackitlogs:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks:retention_over_180_days`) — Decide whether the logs of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks older than 180 days are kept in an archive outside the Logs instance — the source keeps its logs for ever and a STACKIT Logs instance keeps at most 180 days, so the instance drafted for it (stackit_logs_instance.logs_retention_180d) holds only the last 180 days; logs older than that exist only if a person configures an archive beside it. Choose the archive if the workload needs them; reject it if the requirement is that more than 180 days stay inside STACKIT Logs with no external archive, which STACKIT Logs alone cannot meet (phase CUTOVER_PREREQUISITE)
NOT CARRIED (module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks): module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (LOG_GROUP) — group not produced: its logs go to the Logs instance stackit_logs_instance.logs_retention_180d, a label-based store with no group or stream object (source: a log group with its own name, settings and facets)
NOT CARRIED (module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks): module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks retention_in_days — no equivalent on STACKIT: the instance keeps its logs for 180 days at most; older logs are not kept (source: keeps its logs for ever)
module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
replaces: module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks
````