# Trace of `terraform/security.tf` — 11 blocks

> PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.

Run `f6267c3f-2848-4aa5-89df-5fee8b15b3b9` · source digest `sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70`

The draft keeps a one-paragraph comment above each block: where it comes from, why its values are what they are, what is not carried and which decision is open. Each section of this file is the whole comment the generators wrote for one block, unabridged and in the order they wrote it: the rule and the knowledge-base stamp, the references with their digests, the evidence of each chosen value, the reason of each attribute that is not written and the caveats of the checks. The `# trace:` line above a block names its section by the anchor, which is the trace id.

<a id="TR-e47c9c2d3326"></a>

## Trace TR-e47c9c2d3326 — stackit_kms_key.retail_app_ecs_cmk

| | |
|---|---|
| Block | `stackit_kms_key.retail_app_ecs_cmk` in `terraform/security.tf` |
| Source units | `module.retail_app_ecs.aws_kms_key.cmk` |
| Comment | 7 lines as the generators wrote it, 7 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.aws_kms_key.cmk (../../lib/ecs/common.tf:1) — RECONFIGURE / MEDIUM
rule aws.kms_key/kms · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required
access_scope is var.kms_access_scope, which has no default: without it the STACKIT API makes the key PUBLIC, a choice the source does not state. PUBLIC or SNA is yours.
display_name made a name the STACKIT KMS API takes (1 to 64 characters of letters, digits, underscores and hyphens); source text: retail-store-ecs CMK
AWS key material cannot be exported: data encrypted with the old key is re-encrypted during migration.
NOT CARRIED (module.retail_app_ecs.aws_kms_key.cmk): deletion_window_in_days = 7 — STACKIT KMS deletes a key scheduled for deletion after 30 days; stackit_kms_key has no deletion window (pinned provider).
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
````

<a id="TR-af9e2a025af8"></a>

## Trace TR-af9e2a025af8 — stackit_kms_keyring.migrated

| | |
|---|---|
| Block | `stackit_kms_keyring.migrated` in `terraform/security.tf` |
| Source units | `module.retail_app_ecs.aws_kms_key.cmk` |
| Comment | 1 lines as the generators wrote it, 2 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
One keyring for the migrated keys.
````

<a id="TR-b77494749ed2"></a>

## Trace TR-b77494749ed2 — stackit_secretsmanager_instance.migrated_secrets

| | |
|---|---|
| Block | `stackit_secretsmanager_instance.migrated_secrets` in `terraform/security.tf` |
| Source units | `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`, `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`, `module.retail_app_ecs.aws_secretsmanager_secret.mq`, `module.retail_app_ecs.aws_secretsmanager_secret.orders_db` |
| Comment | 24 lines as the generators wrote it, 21 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
One Secrets Manager instance holds all migrated secrets; recreate each secret as a key in it.
NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.catalog_db): kms_key_id — the source encrypts with a customer-managed key that the draft does not set on the Secrets Manager instance: the instance also holds module.retail_app_ecs.aws_secretsmanager_secret.mq, which states no customer-managed key (the default key encrypts it), and it would be encrypted with the key too. The instance takes one STACKIT KMS key for all its secret values (kms_key); set it once the keys of the sources are decided.
NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.catalog_db): name — the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.
NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db): secret_id, secret_string — a setting of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db: the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.
CONSUMERS (module.retail_app_ecs.aws_secretsmanager_secret.catalog_db): module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this — each reads it today and is switched to a Vault client or a platform injection (External Secrets Operator on SKE; rule aws.secretsmanager_secret); give a user only to a consumer that may read all the secrets of the instance, or keep this secret in an instance of its own — no stackit_secretsmanager_user is written for a consumer: a user reaches every secret of this instance and keeps its generated password in the state (the migration user that writes the secrets, when the draft has one, is not a consumer's).
NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch): kms_key_id — the source encrypts with a customer-managed key that the draft does not set on the Secrets Manager instance: the instance also holds module.retail_app_ecs.aws_secretsmanager_secret.mq, which states no customer-managed key (the default key encrypts it), and it would be encrypted with the key too. The instance takes one STACKIT KMS key for all its secret values (kms_key); set it once the keys of the sources are decided.
NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch): name — the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.
NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch): secret_id, secret_string — a setting of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch: the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.
CONSUMERS (module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch): module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this — each reads it today and is switched to a Vault client or a platform injection (External Secrets Operator on SKE; rule aws.secretsmanager_secret); give a user only to a consumer that may read all the secrets of the instance, or keep this secret in an instance of its own — no stackit_secretsmanager_user is written for a consumer: a user reaches every secret of this instance and keeps its generated password in the state (the migration user that writes the secrets, when the draft has one, is not a consumer's).
NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.mq): name — the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.
NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.mq): secret_id, secret_string — a setting of module.retail_app_ecs.aws_secretsmanager_secret.mq: the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.
CONSUMERS (module.retail_app_ecs.aws_secretsmanager_secret.mq): module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this — each reads it today and is switched to a Vault client or a platform injection (External Secrets Operator on SKE; rule aws.secretsmanager_secret); give a user only to a consumer that may read all the secrets of the instance, or keep this secret in an instance of its own — no stackit_secretsmanager_user is written for a consumer: a user reaches every secret of this instance and keeps its generated password in the state (the migration user that writes the secrets, when the draft has one, is not a consumer's).
NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.orders_db): name — the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.
NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db): secret_id, secret_string — a setting of module.retail_app_ecs.aws_secretsmanager_secret.orders_db: the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.
CONSUMERS (module.retail_app_ecs.aws_secretsmanager_secret.orders_db): module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this — each reads it today and is switched to a Vault client or a platform injection (External Secrets Operator on SKE; rule aws.secretsmanager_secret); give a user only to a consumer that may read all the secrets of the instance, or keep this secret in an instance of its own — no stackit_secretsmanager_user is written for a consumer: a user reaches every secret of this instance and keeps its generated password in the state (the migration user that writes the secrets, when the draft has one, is not a consumer's).
module.retail_app_ecs.aws_secretsmanager_secret.catalog_db: WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch: WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
module.retail_app_ecs.aws_secretsmanager_secret.mq: WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
module.retail_app_ecs.aws_secretsmanager_secret.orders_db: WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
replaces: module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db
````

<a id="TR-6003c14a24b3"></a>

## Trace TR-6003c14a24b3 — stackit_secretsmanager_user.migration

| | |
|---|---|
| Block | `stackit_secretsmanager_user.migration` in `terraform/security.tf` |
| Source units | `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`, `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`, `module.retail_app_ecs.aws_secretsmanager_secret.mq`, `module.retail_app_ecs.aws_secretsmanager_secret.orders_db` |
| Comment | 3 lines as the generators wrote it, 3 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
The user the API steps of the execution plan log in as to write the migrated secrets into the Secrets Manager instance.
DEFAULT: write_enabled = true gives this user write access to the secrets engine of the whole instance (the provider schema: "If true, the user has writeaccess to the secrets engine"), so every secret of the instance, not one; it exists only for the API steps of the execution plan that write the migrated secrets (the Vault-compatible login of the STACKIT provider guide for Secrets Manager logs in as such a user). STACKIT generates its password; it is the sensitive output stackit_secretsmanager_user_migration_password and the state holds it in plain text. Delete the user (remove this block, then apply) once the secrets are written; a workload that reads a secret gets a user of its own with write_enabled = false, or the instance's role binding.
````

<a id="TR-70b29ec245ac"></a>

## Trace TR-70b29ec245ac — stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix

| | |
|---|---|
| Block | `stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix` in `terraform/security.tf` |
| Source units | `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix` |
| Comment | 31 lines as the generators wrote it, 21 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix (.terraform/modules/retail_app_ecs.alb_sg/main.tf:37) — RECONFIGURE / MEDIUM
rule aws.security_group/sg · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required
WARNING topology-vpc-unproven: The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own).
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
WARNING sg-rule-not-rendered: At least one rule of this group is not in the draft as the source has it.
name derived from the address of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]: the source group has no name of its own: AWS names it from the name_prefix "retail-store-ecs-ui-" and a random suffix (the draft does not use the prefix as the name)
NOTE: default_egress.ipv4 is not written: the source restricts IPv4 egress, and STACKIT creates an allow-all IPv4 egress rule on this group that the draft does not manage; that rule acts on the network interface that lists the group, and no block of the draft lists this one (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group)), so there is no effect to decide about; if you attach the group to an interface by hand, that rule applies to the interface until it is deleted (stackit security-group rule list, then delete with the security group id): decide then [evidence: tested on a STACKIT project on 2026-10-07; a generated draft applied to a STACKIT project on 2026-09-26; terraform-provider-aws v6.66.0, website/docs/r/security_group.html.markdown:67 (knowledge-base evidence, not in this folder)]
NOTE: default_egress.ipv6 is not written: the source restricts IPv6 egress, and STACKIT creates an allow-all IPv6 egress rule on this group that the draft does not manage; that rule acts on the network interface that lists the group, and no block of the draft lists this one (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group)), so there is no effect to decide about; if you attach the group to an interface by hand, that rule applies to the interface until it is deleted (stackit security-group rule list, then delete with the security group id): decide then [evidence: tested on a STACKIT project on 2026-10-07; a generated draft applied to a STACKIT project on 2026-09-26; terraform-provider-aws v6.66.0, website/docs/r/security_group.html.markdown:67 (knowledge-base evidence, not in this folder)]
NOTE: name_prefix is not written: NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL) [evidence: terraform-provider-stackit v0.116.0, stackit/internal/services/iaas/securitygroup/resource.go:158-168; STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows) (knowledge-base evidence, not in this folder)]
NOTE: revoke_rules_on_delete is not written: NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: stateful is not written: the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written [evidence: STACKIT IaaS API v2 specification (components.schemas.Stateful); https://docs.stackit.cloud/products/network/core-networking/security-groups/how-tos/create-and-manage-security-groups-and-rules/; https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html]
NOTE: tags_all is not written: tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows); knowledge base: aws_security_group.tags is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: timeouts is not written: NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows)]
NOT CARRIED (module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix): vpc_id — a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group)]; residual difference (project-scoped on STACKIT): the group is project-scoped and can be attached to network interfaces of any network of the project
TODO: Re-create the rules beyond the known set of group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules) — an unknown number of entries of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules are not visible statically (group-choice): only the known ones were produced (phase BEFORE_PILOT, owner Security Architect)
TODO: Re-create the rules beyond the known set of group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules) — an unknown number of entries of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules are not visible statically (group-choice): only the known ones were produced (phase BEFORE_PILOT, owner Security Architect)
TODO: Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] on the security group it belongs to and write it — the rule is attached to module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix but cannot be attributed to one of its groups (group-choice); a rule on the wrong group allows what the source did not allow there, so none was produced (phase BEFORE_PILOT, owner Security Architect)
TODO: Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] on the security group it belongs to and write it — the rule is attached to module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix but cannot be attributed to one of its groups (group-choice); a rule on the wrong group allows what the source did not allow there, so none was produced (phase BEFORE_PILOT, owner Security Architect)
NOT CARRIED (module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix): module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] — rule withheld: no rule is produced: it cannot be attributed to a group (group-choice) (source: an allow rule of the unit's security group)
NOT CARRIED (module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix): module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] — rule withheld: no rule is produced: it cannot be attributed to a group (group-choice) (source: an allow rule of the unit's security group)
NOT CARRIED (module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix): stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix ingress — intra-group IPv6 traffic not established: IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08; IPv4 needs an explicit rule and has one wherever the source has a self rule (source: the members of the group reach each other only where a rule of the group allows it)
NOT CARRIED (module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix): stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules — rules beyond the known set: only the known entries are produced; an unknown number of unknown entries of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules are not (group-choice) (source: the source allows more than the entries that are visible statically)
NOT CARRIED (module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix): stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules — rules beyond the known set: only the known entries are produced; an unknown number of unknown entries of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules are not (group-choice) (source: the source allows more than the entries that are visible statically)
NOT CARRIED (module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix): stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix name — derived: name retail-app-ecs-alb-sg-this-name-prefix derived from the address module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (source: the source group has no name of its own: AWS names it from the name_prefix "retail-store-ecs-ui-" and a random suffix (the draft does not use the prefix as the name))
LEDGER security group rules: security group rules → ORPHANED: no block of the draft attaches the group, so its rules restrict nothing on STACKIT — REVIEW
ORPHAN: not attached to the load balancer module.retail_app_ecs.module.alb.aws_lb.this (stackit_application_load_balancer.retail_app_ecs_alb_this): a STACKIT Application Load Balancer takes no security group, and no block of the draft lists this group (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group)): the group restricts nothing on STACKIT. The client restriction of its rules on the load balancer is public on source, public on target: no access control is written.
Lifecycle carried from module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: create_before_destroy = true. These are Terraform meta-arguments: the same words hold for the STACKIT provider.
````

<a id="TR-a59ae230c5b5"></a>

## Trace TR-a59ae230c5b5 — stackit_security_group.retail_app_ecs_alb_this

| | |
|---|---|
| Block | `stackit_security_group.retail_app_ecs_alb_this` in `terraform/security.tf` |
| Source units | `module.retail_app_ecs.module.alb.aws_security_group.this` |
| Comment | 22 lines as the generators wrote it, 12 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.alb.aws_security_group.this (.terraform/modules/retail_app_ecs.alb/main.tf:807) — RECONFIGURE / MEDIUM
rule aws.security_group/sg · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required
WARNING topology-vpc-unproven: The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own).
WARNING sg-egress-restricted: The source restricts egress (the AWS provider removes AWS's default allow-all egress rule; only the listed egress rules apply).
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
name derived from the address of module.retail_app_ecs.module.alb.aws_security_group.this[0]: the source group has no name of its own: AWS names it from the name_prefix "retail-store-ecs-ui-" and a random suffix (the draft does not use the prefix as the name)
NOTE: default_egress.ipv4 is not written: the source restricts IPv4 egress, and STACKIT creates an allow-all IPv4 egress rule on this group that the draft does not manage; that rule acts on the network interface that lists the group, and no block of the draft lists this one (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group)), so there is no effect to decide about; if you attach the group to an interface by hand, that rule applies to the interface until it is deleted (stackit security-group rule list, then delete with the security group id): decide then [evidence: tested on a STACKIT project on 2026-10-07; a generated draft applied to a STACKIT project on 2026-09-26; terraform-provider-aws v6.66.0, website/docs/r/security_group.html.markdown:67 (knowledge-base evidence, not in this folder)]
NOTE: default_egress.ipv6 is not written: the source restricts IPv6 egress, and STACKIT creates an allow-all IPv6 egress rule on this group that the draft does not manage; that rule acts on the network interface that lists the group, and no block of the draft lists this one (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group)), so there is no effect to decide about; if you attach the group to an interface by hand, that rule applies to the interface until it is deleted (stackit security-group rule list, then delete with the security group id): decide then [evidence: tested on a STACKIT project on 2026-10-07; a generated draft applied to a STACKIT project on 2026-09-26; terraform-provider-aws v6.66.0, website/docs/r/security_group.html.markdown:67 (knowledge-base evidence, not in this folder)]
NOTE: name_prefix is not written: NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL) [evidence: terraform-provider-stackit v0.116.0, stackit/internal/services/iaas/securitygroup/resource.go:158-168; STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows) (knowledge-base evidence, not in this folder)]
NOTE: revoke_rules_on_delete is not written: NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: stateful is not written: the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written [evidence: STACKIT IaaS API v2 specification (components.schemas.Stateful); https://docs.stackit.cloud/products/network/core-networking/security-groups/how-tos/create-and-manage-security-groups-and-rules/; https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html]
NOTE: tags_all is not written: tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows); knowledge base: aws_security_group.tags is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: timeouts is not written: NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows)]
NOT CARRIED (module.retail_app_ecs.module.alb.aws_security_group.this): vpc_id — a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group)]; residual difference (project-scoped on STACKIT): the group is project-scoped and can be attached to network interfaces of any network of the project
NOT CARRIED (module.retail_app_ecs.module.alb.aws_security_group.this): stackit_security_group.retail_app_ecs_alb_this ingress — intra-group IPv6 traffic not established: IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08; IPv4 needs an explicit rule and has one wherever the source has a self rule (source: the members of the group reach each other only where a rule of the group allows it)
NOT CARRIED (module.retail_app_ecs.module.alb.aws_security_group.this): stackit_security_group.retail_app_ecs_alb_this name — derived: name retail-app-ecs-alb-this derived from the address module.retail_app_ecs.module.alb.aws_security_group.this[0] (source: the source group has no name of its own: AWS names it from the name_prefix "retail-store-ecs-ui-" and a random suffix (the draft does not use the prefix as the name))
ORPHAN: not attached to the load balancer module.retail_app_ecs.module.alb.aws_lb.this (stackit_application_load_balancer.retail_app_ecs_alb_this): a STACKIT Application Load Balancer takes no security group, and no block of the draft lists this group (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group)): the group restricts nothing on STACKIT. The client restriction of its rules on the load balancer is public on source, public on target: no access control is written.
Lifecycle carried from module.retail_app_ecs.module.alb.aws_security_group.this: create_before_destroy = true. These are Terraform meta-arguments: the same words hold for the STACKIT provider.
````

<a id="TR-5cd0f19b7ac7"></a>

## Trace TR-5cd0f19b7ac7 — stackit_security_group.retail_app_ecs_carts_service_this

| | |
|---|---|
| Block | `stackit_security_group.retail_app_ecs_carts_service_this` in `terraform/security.tf` |
| Source units | `module.retail_app_ecs.module.carts_service.aws_security_group.this` |
| Comment | 26 lines as the generators wrote it, 12 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.carts_service.aws_security_group.this (../../lib/ecs/service/sg.tf:1) — RECONFIGURE / MEDIUM
rule aws.security_group/sg · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required
WARNING topology-vpc-unproven: The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own).
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
the source's allow-all egress is covered by the STACKIT default egress rules; no rule is produced for it
NOTE: default_egress.ipv4 is not written: the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409) [evidence: tested on a STACKIT project on 2026-10-07; a generated draft applied to a STACKIT project on 2026-09-26; terraform-provider-aws v6.66.0, website/docs/r/security_group.html.markdown:67 (knowledge-base evidence, not in this folder)]
NOTE: default_egress.ipv6 is not written: the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.this assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then [evidence: tested on a STACKIT project on 2026-10-07; a generated draft applied to a STACKIT project on 2026-09-26; STACKIT provider schema 0.121.0 (resource_schemas.stackit_network has ipv6_prefix, ipv6_prefix_length, ipv6_gateway and ipv6_nameservers: a network without an ipv6_prefix is an IPv4 network); knowledge base rule subnet-ipv6; terraform-provider-aws v6.66.0, website/docs/r/security_group.html.markdown:67 (knowledge-base evidence, not in this folder)]
NOTE: labels is not written: the source group sets no tags, so there are no labels to write [evidence: STACKIT IaaS API v2 specification (components.schemas.Labels); knowledge base: aws_security_group.tags is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: name_prefix is not written: NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL) [evidence: terraform-provider-stackit v0.116.0, stackit/internal/services/iaas/securitygroup/resource.go:158-168; STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows) (knowledge-base evidence, not in this folder)]
NOTE: revoke_rules_on_delete is not written: NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: stateful is not written: the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written [evidence: STACKIT IaaS API v2 specification (components.schemas.Stateful); https://docs.stackit.cloud/products/network/core-networking/security-groups/how-tos/create-and-manage-security-groups-and-rules/; https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html]
NOTE: tags_all is not written: tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows); knowledge base: aws_security_group.tags is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: timeouts is not written: NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows)]
NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_security_group.this): vpc_id — a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group)]; residual difference (project-scoped on STACKIT): the group is project-scoped and can be attached to network interfaces of any network of the project
NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_security_group.this): stackit_security_group.retail_app_ecs_carts_service_this ingress — intra-group IPv6 traffic not established: IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08; IPv4 needs an explicit rule and has one wherever the source has a self rule (source: the members of the group reach each other only where a rule of the group allows it)
LEDGER security group rules: security group rules → ORPHANED: no block of the draft attaches the group, so its rules restrict nothing on STACKIT — REVIEW
ORPHANED: drafted from module.retail_app_ecs.module.carts_service.aws_security_group.this; no target resource attaches it (no block of the draft lists stackit_security_group.retail_app_ecs_carts_service_this), so its rules restrict nothing on STACKIT; they are written as the source states them.
ORPHANED cause: its members are module.retail_app_ecs.module.carts_service.aws_ecs_service.this (an ECS service: its tasks become pods).
The ECS tasks it protected become pods: NetworkPolicy decision DEC-GEN-CONVERT-POD-SEGMENTATION (alias `convert:module.retail_app_ecs.module.carts_service.aws_security_group.this:security-group:POD_SEGMENTATION`).
SECURITY_OBSERVATION World-open ingress on an application port of module.retail_app_ecs.module.carts_service.aws_security_group.this, ingress tcp 8080-8080 from 0.0.0.0/0 (non-blocking): The source security group module.retail_app_ecs.module.carts_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. Source: ../../lib/ecs/service/sg.tf:1. In the draft (NOT_CARRIED): the drafted rule stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Hardening, if wanted (a note, not a change; owner Security Architect): limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.
````

<a id="TR-66eb9edf4074"></a>

## Trace TR-66eb9edf4074 — stackit_security_group.retail_app_ecs_catalog_service_this

| | |
|---|---|
| Block | `stackit_security_group.retail_app_ecs_catalog_service_this` in `terraform/security.tf` |
| Source units | `module.retail_app_ecs.module.catalog_service.aws_security_group.this` |
| Comment | 26 lines as the generators wrote it, 12 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.catalog_service.aws_security_group.this (../../lib/ecs/service/sg.tf:1) — RECONFIGURE / MEDIUM
rule aws.security_group/sg · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required
WARNING topology-vpc-unproven: The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own).
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
the source's allow-all egress is covered by the STACKIT default egress rules; no rule is produced for it
NOTE: default_egress.ipv4 is not written: the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409) [evidence: tested on a STACKIT project on 2026-10-07; a generated draft applied to a STACKIT project on 2026-09-26; terraform-provider-aws v6.66.0, website/docs/r/security_group.html.markdown:67 (knowledge-base evidence, not in this folder)]
NOTE: default_egress.ipv6 is not written: the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.this assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then [evidence: tested on a STACKIT project on 2026-10-07; a generated draft applied to a STACKIT project on 2026-09-26; STACKIT provider schema 0.121.0 (resource_schemas.stackit_network has ipv6_prefix, ipv6_prefix_length, ipv6_gateway and ipv6_nameservers: a network without an ipv6_prefix is an IPv4 network); knowledge base rule subnet-ipv6; terraform-provider-aws v6.66.0, website/docs/r/security_group.html.markdown:67 (knowledge-base evidence, not in this folder)]
NOTE: labels is not written: the source group sets no tags, so there are no labels to write [evidence: STACKIT IaaS API v2 specification (components.schemas.Labels); knowledge base: aws_security_group.tags is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: name_prefix is not written: NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL) [evidence: terraform-provider-stackit v0.116.0, stackit/internal/services/iaas/securitygroup/resource.go:158-168; STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows) (knowledge-base evidence, not in this folder)]
NOTE: revoke_rules_on_delete is not written: NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: stateful is not written: the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written [evidence: STACKIT IaaS API v2 specification (components.schemas.Stateful); https://docs.stackit.cloud/products/network/core-networking/security-groups/how-tos/create-and-manage-security-groups-and-rules/; https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html]
NOTE: tags_all is not written: tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows); knowledge base: aws_security_group.tags is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: timeouts is not written: NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows)]
NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_security_group.this): vpc_id — a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group)]; residual difference (project-scoped on STACKIT): the group is project-scoped and can be attached to network interfaces of any network of the project
NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_security_group.this): stackit_security_group.retail_app_ecs_catalog_service_this ingress — intra-group IPv6 traffic not established: IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08; IPv4 needs an explicit rule and has one wherever the source has a self rule (source: the members of the group reach each other only where a rule of the group allows it)
LEDGER security group rules: security group rules → ORPHANED: no block of the draft attaches the group, so its rules restrict nothing on STACKIT — REVIEW
ORPHANED: drafted from module.retail_app_ecs.module.catalog_service.aws_security_group.this; no target resource attaches it (no block of the draft lists stackit_security_group.retail_app_ecs_catalog_service_this), so its rules restrict nothing on STACKIT; they are written as the source states them.
ORPHANED cause: its members are module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (an ECS service: its tasks become pods).
The ECS tasks it protected become pods: NetworkPolicy decision DEC-GEN-CONVERT-POD-SEGMENTATION (alias `convert:module.retail_app_ecs.module.catalog_service.aws_security_group.this:security-group:POD_SEGMENTATION`).
SECURITY_OBSERVATION World-open ingress on an application port of module.retail_app_ecs.module.catalog_service.aws_security_group.this, ingress tcp 8080-8080 from 0.0.0.0/0 (non-blocking): The source security group module.retail_app_ecs.module.catalog_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. Source: ../../lib/ecs/service/sg.tf:1. In the draft (NOT_CARRIED): the drafted rule stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Hardening, if wanted (a note, not a change; owner Security Architect): limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.
````

<a id="TR-e031d5a780d5"></a>

## Trace TR-e031d5a780d5 — stackit_security_group.retail_app_ecs_checkout_service_this

| | |
|---|---|
| Block | `stackit_security_group.retail_app_ecs_checkout_service_this` in `terraform/security.tf` |
| Source units | `module.retail_app_ecs.module.checkout_service.aws_security_group.this` |
| Comment | 26 lines as the generators wrote it, 12 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.checkout_service.aws_security_group.this (../../lib/ecs/service/sg.tf:1) — RECONFIGURE / MEDIUM
rule aws.security_group/sg · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required
WARNING topology-vpc-unproven: The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own).
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
the source's allow-all egress is covered by the STACKIT default egress rules; no rule is produced for it
NOTE: default_egress.ipv4 is not written: the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409) [evidence: tested on a STACKIT project on 2026-10-07; a generated draft applied to a STACKIT project on 2026-09-26; terraform-provider-aws v6.66.0, website/docs/r/security_group.html.markdown:67 (knowledge-base evidence, not in this folder)]
NOTE: default_egress.ipv6 is not written: the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.this assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then [evidence: tested on a STACKIT project on 2026-10-07; a generated draft applied to a STACKIT project on 2026-09-26; STACKIT provider schema 0.121.0 (resource_schemas.stackit_network has ipv6_prefix, ipv6_prefix_length, ipv6_gateway and ipv6_nameservers: a network without an ipv6_prefix is an IPv4 network); knowledge base rule subnet-ipv6; terraform-provider-aws v6.66.0, website/docs/r/security_group.html.markdown:67 (knowledge-base evidence, not in this folder)]
NOTE: labels is not written: the source group sets no tags, so there are no labels to write [evidence: STACKIT IaaS API v2 specification (components.schemas.Labels); knowledge base: aws_security_group.tags is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: name_prefix is not written: NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL) [evidence: terraform-provider-stackit v0.116.0, stackit/internal/services/iaas/securitygroup/resource.go:158-168; STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows) (knowledge-base evidence, not in this folder)]
NOTE: revoke_rules_on_delete is not written: NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: stateful is not written: the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written [evidence: STACKIT IaaS API v2 specification (components.schemas.Stateful); https://docs.stackit.cloud/products/network/core-networking/security-groups/how-tos/create-and-manage-security-groups-and-rules/; https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html]
NOTE: tags_all is not written: tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows); knowledge base: aws_security_group.tags is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: timeouts is not written: NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows)]
NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_security_group.this): vpc_id — a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group)]; residual difference (project-scoped on STACKIT): the group is project-scoped and can be attached to network interfaces of any network of the project
NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_security_group.this): stackit_security_group.retail_app_ecs_checkout_service_this ingress — intra-group IPv6 traffic not established: IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08; IPv4 needs an explicit rule and has one wherever the source has a self rule (source: the members of the group reach each other only where a rule of the group allows it)
LEDGER security group rules: security group rules → ORPHANED: no block of the draft attaches the group, so its rules restrict nothing on STACKIT — REVIEW
ORPHANED: drafted from module.retail_app_ecs.module.checkout_service.aws_security_group.this; no target resource attaches it (no block of the draft lists stackit_security_group.retail_app_ecs_checkout_service_this), so its rules restrict nothing on STACKIT; they are written as the source states them.
ORPHANED cause: its members are module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (an ECS service: its tasks become pods).
The ECS tasks it protected become pods: NetworkPolicy decision DEC-GEN-CONVERT-POD-SEGMENTATION (alias `convert:module.retail_app_ecs.module.checkout_service.aws_security_group.this:security-group:POD_SEGMENTATION`).
SECURITY_OBSERVATION World-open ingress on an application port of module.retail_app_ecs.module.checkout_service.aws_security_group.this, ingress tcp 8080-8080 from 0.0.0.0/0 (non-blocking): The source security group module.retail_app_ecs.module.checkout_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. Source: ../../lib/ecs/service/sg.tf:1. In the draft (NOT_CARRIED): the drafted rule stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Hardening, if wanted (a note, not a change; owner Security Architect): limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.
````

<a id="TR-382b1ee0a726"></a>

## Trace TR-382b1ee0a726 — stackit_security_group.retail_app_ecs_orders_service_this

| | |
|---|---|
| Block | `stackit_security_group.retail_app_ecs_orders_service_this` in `terraform/security.tf` |
| Source units | `module.retail_app_ecs.module.orders_service.aws_security_group.this` |
| Comment | 26 lines as the generators wrote it, 12 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.orders_service.aws_security_group.this (../../lib/ecs/service/sg.tf:1) — RECONFIGURE / MEDIUM
rule aws.security_group/sg · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required
WARNING topology-vpc-unproven: The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own).
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
the source's allow-all egress is covered by the STACKIT default egress rules; no rule is produced for it
NOTE: default_egress.ipv4 is not written: the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409) [evidence: tested on a STACKIT project on 2026-10-07; a generated draft applied to a STACKIT project on 2026-09-26; terraform-provider-aws v6.66.0, website/docs/r/security_group.html.markdown:67 (knowledge-base evidence, not in this folder)]
NOTE: default_egress.ipv6 is not written: the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.this assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then [evidence: tested on a STACKIT project on 2026-10-07; a generated draft applied to a STACKIT project on 2026-09-26; STACKIT provider schema 0.121.0 (resource_schemas.stackit_network has ipv6_prefix, ipv6_prefix_length, ipv6_gateway and ipv6_nameservers: a network without an ipv6_prefix is an IPv4 network); knowledge base rule subnet-ipv6; terraform-provider-aws v6.66.0, website/docs/r/security_group.html.markdown:67 (knowledge-base evidence, not in this folder)]
NOTE: labels is not written: the source group sets no tags, so there are no labels to write [evidence: STACKIT IaaS API v2 specification (components.schemas.Labels); knowledge base: aws_security_group.tags is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: name_prefix is not written: NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL) [evidence: terraform-provider-stackit v0.116.0, stackit/internal/services/iaas/securitygroup/resource.go:158-168; STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows) (knowledge-base evidence, not in this folder)]
NOTE: revoke_rules_on_delete is not written: NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: stateful is not written: the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written [evidence: STACKIT IaaS API v2 specification (components.schemas.Stateful); https://docs.stackit.cloud/products/network/core-networking/security-groups/how-tos/create-and-manage-security-groups-and-rules/; https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html]
NOTE: tags_all is not written: tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows); knowledge base: aws_security_group.tags is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: timeouts is not written: NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows)]
NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_security_group.this): vpc_id — a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group)]; residual difference (project-scoped on STACKIT): the group is project-scoped and can be attached to network interfaces of any network of the project
NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_security_group.this): stackit_security_group.retail_app_ecs_orders_service_this ingress — intra-group IPv6 traffic not established: IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08; IPv4 needs an explicit rule and has one wherever the source has a self rule (source: the members of the group reach each other only where a rule of the group allows it)
LEDGER security group rules: security group rules → ORPHANED: no block of the draft attaches the group, so its rules restrict nothing on STACKIT — REVIEW
ORPHANED: drafted from module.retail_app_ecs.module.orders_service.aws_security_group.this; no target resource attaches it (no block of the draft lists stackit_security_group.retail_app_ecs_orders_service_this), so its rules restrict nothing on STACKIT; they are written as the source states them.
ORPHANED cause: its members are module.retail_app_ecs.module.orders_service.aws_ecs_service.this (an ECS service: its tasks become pods).
The ECS tasks it protected become pods: NetworkPolicy decision DEC-GEN-CONVERT-POD-SEGMENTATION (alias `convert:module.retail_app_ecs.module.orders_service.aws_security_group.this:security-group:POD_SEGMENTATION`).
SECURITY_OBSERVATION World-open ingress on an application port of module.retail_app_ecs.module.orders_service.aws_security_group.this, ingress tcp 8080-8080 from 0.0.0.0/0 (non-blocking): The source security group module.retail_app_ecs.module.orders_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. Source: ../../lib/ecs/service/sg.tf:1. In the draft (NOT_CARRIED): the drafted rule stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Hardening, if wanted (a note, not a change; owner Security Architect): limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.
````

<a id="TR-da82ede17870"></a>

## Trace TR-da82ede17870 — stackit_security_group.retail_app_ecs_ui_service_this

| | |
|---|---|
| Block | `stackit_security_group.retail_app_ecs_ui_service_this` in `terraform/security.tf` |
| Source units | `module.retail_app_ecs.module.ui_service.aws_security_group.this` |
| Comment | 26 lines as the generators wrote it, 12 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from module.retail_app_ecs.module.ui_service.aws_security_group.this (../../lib/ecs/service/sg.tf:1) — RECONFIGURE / MEDIUM
rule aws.security_group/sg · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required
WARNING topology-vpc-unproven: The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own).
WARNING source-provider-unpinned: No lock file entry pins aws (>= 3.0, >= 3.29, >= 4.18, >= 4.30, >= 4.59, >= 5.64, >= 5.79, ~> 5.0): the version the plan would use is not proven (stated once for the whole estate)
the source's allow-all egress is covered by the STACKIT default egress rules; no rule is produced for it
NOTE: default_egress.ipv4 is not written: the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409) [evidence: tested on a STACKIT project on 2026-10-07; a generated draft applied to a STACKIT project on 2026-09-26; terraform-provider-aws v6.66.0, website/docs/r/security_group.html.markdown:67 (knowledge-base evidence, not in this folder)]
NOTE: default_egress.ipv6 is not written: the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.this assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then [evidence: tested on a STACKIT project on 2026-10-07; a generated draft applied to a STACKIT project on 2026-09-26; STACKIT provider schema 0.121.0 (resource_schemas.stackit_network has ipv6_prefix, ipv6_prefix_length, ipv6_gateway and ipv6_nameservers: a network without an ipv6_prefix is an IPv4 network); knowledge base rule subnet-ipv6; terraform-provider-aws v6.66.0, website/docs/r/security_group.html.markdown:67 (knowledge-base evidence, not in this folder)]
NOTE: labels is not written: the source group sets no tags, so there are no labels to write [evidence: STACKIT IaaS API v2 specification (components.schemas.Labels); knowledge base: aws_security_group.tags is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: name_prefix is not written: NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL) [evidence: terraform-provider-stackit v0.116.0, stackit/internal/services/iaas/securitygroup/resource.go:158-168; STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows) (knowledge-base evidence, not in this folder)]
NOTE: revoke_rules_on_delete is not written: NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: stateful is not written: the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written [evidence: STACKIT IaaS API v2 specification (components.schemas.Stateful); https://docs.stackit.cloud/products/network/core-networking/security-groups/how-tos/create-and-manage-security-groups-and-rules/; https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html]
NOTE: tags_all is not written: tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows); knowledge base: aws_security_group.tags is classified NON_CRITICAL (it states nothing the target allows)]
NOTE: timeouts is not written: NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL) [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix); knowledge base: aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix is classified NON_CRITICAL (it states nothing the target allows)]
NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_security_group.this): vpc_id — a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried [evidence: STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group)]; residual difference (project-scoped on STACKIT): the group is project-scoped and can be attached to network interfaces of any network of the project
NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_security_group.this): stackit_security_group.retail_app_ecs_ui_service_this ingress — intra-group IPv6 traffic not established: IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08; IPv4 needs an explicit rule and has one wherever the source has a self rule (source: the members of the group reach each other only where a rule of the group allows it)
LEDGER security group rules: security group rules → ORPHANED: no block of the draft attaches the group, so its rules restrict nothing on STACKIT — REVIEW
ORPHANED: drafted from module.retail_app_ecs.module.ui_service.aws_security_group.this; no target resource attaches it (no block of the draft lists stackit_security_group.retail_app_ecs_ui_service_this), so its rules restrict nothing on STACKIT; they are written as the source states them.
ORPHANED cause: its members are module.retail_app_ecs.module.ui_service.aws_ecs_service.this (an ECS service: its tasks become pods).
The ECS tasks it protected become pods: NetworkPolicy decision DEC-GEN-CONVERT-POD-SEGMENTATION (alias `convert:module.retail_app_ecs.module.ui_service.aws_security_group.this:security-group:POD_SEGMENTATION`).
SECURITY_OBSERVATION World-open ingress on an application port of module.retail_app_ecs.module.ui_service.aws_security_group.this, ingress tcp 8080-8080 from 0.0.0.0/0 (non-blocking): The source security group module.retail_app_ecs.module.ui_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. Source: ../../lib/ecs/service/sg.tf:1. In the draft (NOT_CARRIED): the drafted rule stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Hardening, if wanted (a note, not a change; owner Security Architect): limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.
````